4 ms·

You're assuming this is a database dump. It looks more like logs from the service that creates PDF versions of reports for download. That would have a more simp

You're assuming this is a database dump. It looks more like logs from the service that creates PDF versions of reports for download. That would have a more simplistic data structure that might look like this.

astura 9y ago
Very good point. I admit, I looked at the JSON pretty quick assuming it was a database dump export (obviously the database isn't a JSON file) and thought "this doesn't make sense" and didn't think about it much more. It still looks sorta "off" to me even as logs.
smsm42 9y ago
If it's a service request log, why service would have field requestId and then set it to null? Of course, you can expect anything from people that have admin/admin security on their employee portal, but looks weird. Also, street data have no field for apartment number - does nobody live in multi-tenant buildings? Of course, there may be optional field for this, but given how many null fields there are, it doesn't look like this API does optional fields. In summary, API response format could be anything, as I said, especially from people who do admin/admin, but on the fact of it it looks questionable. Also, why credit reports for Donald Trump and Kim Kardashian were created at the same second and then modified at the same second? Probability of this happening as a result of natural client activity - i.e. just watching the logs of the active service - is zero. If the attackers had access to this service and initiated the requests, then why not show the resulting PDFs, that they supposedly also must have had access to if they had access to the API?
- smsm42 9y ago
  Also, quick search shows that SSNs of Trump, Kardashian and Gates has been published before. Which means this sample contains only the information that is in the public sources already, or is meaningless (like IDs). Thus, at least the JSON dump thing proves exactly nothing. Of course, if they published a previously unpublished SSN, we'd have hard time verifying it too, so not sure what could be a good proof here...
  - pbadenski 9y ago
    Presumably if someone wanted to sell this data for big bucks they would have found a way to provide a sufficient and satisfying proof.

astura 9y ago

Very good point. I admit, I looked at the JSON pretty quick assuming it was a database dump export (obviously the database isn't a JSON file) and thought "this doesn't make sense" and didn't think about it much more. It still looks sorta "off" to me even as logs.

smsm42 9y ago

If it's a service request log, why service would have field requestId and then set it to null? Of course, you can expect anything from people that have admin/admin security on their employee portal, but looks weird. Also, street data have no field for apartment number - does nobody live in multi-tenant buildings? Of course, there may be optional field for this, but given how many null fields there are, it doesn't look like this API does optional fields. In summary, API response format could be anything, as I said, especially from people who do admin/admin, but on the fact of it it looks questionable. Also, why credit reports for Donald Trump and Kim Kardashian were created at the same second and then modified at the same second? Probability of this happening as a result of natural client activity - i.e. just watching the logs of the active service - is zero. If the attackers had access to this service and initiated the requests, then why not show the resulting PDFs, that they supposedly also must have had access to if they had access to the API?

smsm42 9y ago
Also, quick search shows that SSNs of Trump, Kardashian and Gates has been published before. Which means this sample contains only the information that is in the public sources already, or is meaningless (like IDs). Thus, at least the JSON dump thing proves exactly nothing. Of course, if they published a previously unpublished SSN, we'd have hard time verifying it too, so not sure what could be a good proof here...
- pbadenski 9y ago
  Presumably if someone wanted to sell this data for big bucks they would have found a way to provide a sufficient and satisfying proof.