4 ms·
Isn't this considered public data anyways? Illinois (and I believe every other US state) requires that certain voter data be publicly accessible. To access it i
by SamuelAdams 9y ago
Isn't this considered public data anyways? Illinois (and I believe every other US state) requires that certain voter data be publicly accessible. To access it in bulk, you'll have to pay a small fee, but anyone can get this.
A misconfigured AWS instance is always an issue. I'm not trying to downplay that. Only that this data being released to the public isn't anything new - the public already had access to it.
https://www.elections.il.gov/votinginformation/computerizedvoterdata.aspx https://www.elections.il.gov/votinginformation/computerizedv...
- mcone 9y agoNo. The Chicago Tribune [0] reported on the type of data exposed: > The files included names, addresses, dates of birth, the last four digits of many voters' Social Security numbers, driver's license and state ID numbers for the 1.8 million who are registered to vote in Chicago. [0] http://www.chicagotribune.com/news/local/politics/ct-chicago-voter-data-cloud-met-0818-20170817-story.html http://www.chicagotribune.com/news/local/politics/ct-chicago...
- SamuelAdams 9y agoSo the question becomes - what types of data is available using legal channels?
- mcone 9y agoAccording to Forbes [0]: - Name - Street address - Party affiliation - Elections in which you did (or did not) vote - Phone number - Email address [0] https://www.forbes.com/sites/metabrown/2015/12/28/voter-data-whats-public-whats-private/#76f45d481591 https://www.forbes.com/sites/metabrown/2015/12/28/voter-data...
- GauntletWizard 9y agoLast four of social is so abused it shouldn't count, and date of birth is in nearly every company's loyalty database. That leaves drivers license and state ID number as the leaked data. I'm honestly not sure how important or secure those are.
- nrb 9y agoThey are a requirement if you were wanting to fraudulently open a bank account in someone else's name.
- bpicolo 9y agoNeed a whole SSN for that no?
- tomsthumb 9y agoBoth the first three and the middle two have a pretty clear rhyme and reason to them which would likely make getting them right a not-so-difficult task after a bit of homework. https://www.ssa.gov/history/ssn/geocard.html https://www.ssa.gov/history/ssn/geocard.html Anecdotally, while bored in math class we figured out that 10 or so of the guys in the class had one of two numbers for their first three.
- vkou 9y ago> Last four of social is so abused it shouldn't count Yet it does. Almost every single business/government service in America uses DoB + last 4 SSN to identify you. The two together make fraud trivial.
- GauntletWizard 9y agoExactly. Every leak already has it. Every company already has it. The fact that fraud is trivial is already true, and this leak really adds little to it.
- pavel_lishin 9y agoCan I have the last four numbers of your social security number?
- GauntletWizard 9y ago
- samgranieri 9y agofuck. I live in Chicago.
- Bartweiss 9y agoWell, there's an unpleasant reminder of why knowledge-based authentication should never be based on something immutable. How many services do all of use use that accept name/birthdate/SSN as identification? How many other services, like phone companies, claim not to but would still yield for someone who sounded earnest and knew all of that? And what can the leak victims possibly do? TFA is great where you can get it, but it's not universal, and none of this information can be refreshed.
- ransom1538 9y agoYes. One of my first jobs out of school I worked with a Standford professor Doug Rivers (@pollingpoint) that had millions of users voting records he obtained from the government for 'research' purposes. That data: your name, address, what party you are in, et al. is TOTALLY public and passed around legally to other research centers and government agencies. He had me match address information with other databases.
- jsjohnst 9y agoConsidering this was Chris Vickery, my money is on it being an unsecured Mongo instance on AWS. He's spent the last 2+ years consistently probing for Mongo instances (mostly via Shodan) and then ransoming the owners if he can find them.
- dark_shadow 9y agoRansoms the owners? That's a big claim. What proof do you have or are you just trolling him?
- Chris_Vickery 9y agoThis is a false and defamatory. I (Chris Vickery) have never ransomed any data. I have protected the private data of hundreds of millions. Post some evidence or retract your comment.
- jsjohnst 9y agoI never said "you" (assuming it's really you, new account and all) ransomed the "data" specifically, but I do know of two instances where you threatened companies to go to their customers and/or the FTC unless they met your specific demands.
- qu4z-2 9y agoDid those specific demands pretty much total up to "fix the problem in a non-braindead way"?
- Chris_Vickery 9y agojsjohnst- I've posted on my twitter account (@vickerysec) to verify that this is indeed me. Now, please explain the two situations you refer to. I vehemently deny the accusation and would love to know the origin of those false claims.
- tbgvi 9y agoVoter registration data is available for purchase, but only by registered political committees and can't be used for commercial purposes. This also doesn't include a lot of the breached data like partial SS#'s and drivers license #'s. As a Chicagoan I'm not too happy about this breach, and there has been surprisingly little coverage of it locally.