6 ms·

Hackers sell data of 130M Chinese hotel guests on dark web for 8 Bitcoin

107 points by rapnie 8y ago

djstein 8y ago
so something that happens everyday is news worthy why? because he undersold? or is this type of data so common that it was only worth 50k USD?
- dis-sys 8y ago
  this dataset contains the unique national ID, home address, cell phone number, bank card number of 130 million Chinese. you also get to know the exact time and duration of who they shared a hotel room with. it is _not_ common.
  - TeMPOraL 8y ago
    > you also get to know the exact time and duration of who they shared a hotel room with. it is _not_ common. This is Ashley Madison territory. A goldmine for extortions.
- TomK32 8y ago
  yeah, sad you can't sell those things more than once...
- kjullien 8y ago
  I'd say because he undersold and more importantly made the sale "public" which only lowered the time this data will be useful for, as the more media cover this, the more people will know they need to order a new CC. To give an idea the average price of a person (by that I mean everything you would need to pretend being that person, name, dob, address, social security code, credit card etc) sells for in between 1 and 10 bucks depending on the quality. With bulks such as those however, verifying this information becomes a tad more complicated so prices will be lowered down, usually in bulk you'd pay between 5 cents and about a half a dollar per person. (probably even less with 130M records... I wouldn't know honestly haven't seen many auctions of this size in my life) Do the math real fast and yeah, this kid could've made a bit more cash off of this deal, without people every knowing it happened, the fact this was made public also brings down the cost of the info as people will now take actions to ensure they don't get rekt.
dis-sys 8y ago
For me, the shocking part is not that someone selling such private data online. The really scary thing is the fact that such a doggy company with no privacy & network security concepts whatsoever actually managed to collect private data from 130 million people in a few years. btw, the database was not uploaded to github, some moronic programmer hard coded the url/username/password of their database into a source file and uploaded that to github. As expected, the database can easily be accessed from the internet and more than 100G of data was stolen without being noticed.
- fosco 8y ago
  Agreed. compared to exactis and and experian leaks though, I am wondering what makes this data valuable? (pardon my ignorance) Edit: appears you answered in another thread. > this dataset contains the unique national ID, home address, cell phone number, bank card number of 130 million Chinese. you also get to know who they shared a hotel room with. it is _not_ common.
crtasm 8y ago
Points lost for claiming VPNs are a way to access the dark web. Points gained for referring to Tor as a privacy oriented tool.
- sanityvampire 8y ago
  They got that it's a privacy-related thing, but they still called it a browser...
  - deleted 8y ago
    [deleted]
  - frockington 8y ago
    I'm always conflicted on how "correct" articles like this should be. I would prefer that they were more accurate when it comes to technology, but for the average reader (who might leave a password in git) it might be better to over simplify
rqs 8y ago
> The company's developers accidentally uploaded the entire database to Github Wait, from what I've heard, the programmer just uploaded a configuration file that contains the password of the database? And oh boy, he's not the only one, Maybe GitHub can do something about it. To the topic: This is the exact reason why I don't support any sort of system that log users personal information without user's control. Because regardless how strong and secure you think your system is, all it takes is one careless action, then everything blows up.
- dis-sys 8y ago
  please don't over estimate their skills and qualification. the leaked database username is root and the password is 123456. the screenshot of the github file can be access here: https://www.secrss.com/articles/4851 https://www.secrss.com/articles/4851 and yes, that "programmer" pushed such highly sensitive company information to his personal github repo.
  - subcosmos 8y ago
    This happens so frequently, and is easy to scan for, sadly. What is missing is a way to programmatically, and secretly, inform people of their mistakes. I've personally found literally hundreds of examples of this and lack the manpower to file that many tickets....
    - jjoonathan 8y ago
      Missing? I thought they already did that. IIRC a couple of my teammates reported getting emails from github about accidentally uploading AWS credentials and the like.
    - hinkley 8y ago
      What is missing is a default or recommended git hook to reject pushes that contain passwords for the patterns that are obvious.
    - deleted 8y ago
      [deleted]
LarryL 8y ago
Ignoring the moral/ethics concerns, how would a potential buyer know that the data is legit (if it even exists at all?). Give me a couple of days and I'll create a fake -but real looking- set of records with millions of false customers (it would be made real enough by using public information)... If you tell me that they'll provide an extract as "proof", I'll answer: it's easy to cook-up a realistic small sample, just using and remixing former leaks/hacks for instance... In summary: the money aspect makes the data MUCH more suspicious than a "bragging/4tehLULz" hack.
- NedIsakoff 8y ago
  mapping of 居民身份证 to real names..
- swarnie_ 8y ago
  Reputation and repeat business. You might get away with selling fake information once, i highly doubt you would get away with it twice. I imagine its a similar scenario to how other dodgy markets work such as drugs or cryptolocker decryption keys, reputation and customer service mean a lot.
  - 21 8y ago
    For hackers good opsec would require them to use a new persona for each separate hack. Compartimentalization. Linking separate hacks together is a really bad idea.
- ALittleLight 8y ago
  Perhaps if you are a buyer of this data you have similar, if smaller, databases. You could then say, here's ten thousand hashed credit card numbers from my collection. Give me the full data for ~1,000 of them. If their data lines up with yours that's a good sign. This wouldn't be a perfect method, but if the seller could do it then it would increase my confidence a lot.
- yangzx 8y ago
  For this particular example, the buyer can simply look himself up in the dataset. LOL. This dataset is the database of the largest hotel brand of China. I am pretty sure there are entries about me in the database (I am Chinese). It's damn embarrassing, people know me can know who I slept with if he pay 8 bitcoin now. Now I hope the price of bitcoins goes up.
weej 8y ago
Folks, please remember to PURGE GIT COMMIT HISTORY of the file. It does no good to simply remove a password if it's there in plain (historical) sight. https://help.github.com/articles/removing-sensitive-data-from-a-repository/ https://help.github.com/articles/removing-sensitive-data-fro...
- stevekemp 8y ago
  And obviously rotate the exposed credentials - because even if it was only public for "a while" it could have been viewed by many users.
  - meowface 8y ago
    Plus it could've been archived by another website or a private scraping tool which looks for exactly these sorts of exposures. Removing it from the git history is almost irrelevant and just stops future people who find it from sniffing around. The crucial part is rotating the credentials and ensuring the credentials aren't used anywhere else. The second step should be reviewing all logs to ensure no unauthorized logins occurred before the credentials were changed (even if the exposure was only exploitable for a few seconds).
northfoxz2015 8y ago
wondering if there is a service to be built selling data through cryptocurrencies...

107 points by rapnie 8y ago

so something that happens everyday is news worthy why? because he undersold? or is this type of data so common that it was only worth 50k USD?

dis-sys 8y ago
this dataset contains the unique national ID, home address, cell phone number, bank card number of 130 million Chinese. you also get to know the exact time and duration of who they shared a hotel room with. it is _not_ common.
- TeMPOraL 8y ago
  > you also get to know the exact time and duration of who they shared a hotel room with. it is _not_ common. This is Ashley Madison territory. A goldmine for extortions.
TomK32 8y ago
yeah, sad you can't sell those things more than once...
kjullien 8y ago
I'd say because he undersold and more importantly made the sale "public" which only lowered the time this data will be useful for, as the more media cover this, the more people will know they need to order a new CC. To give an idea the average price of a person (by that I mean everything you would need to pretend being that person, name, dob, address, social security code, credit card etc) sells for in between 1 and 10 bucks depending on the quality. With bulks such as those however, verifying this information becomes a tad more complicated so prices will be lowered down, usually in bulk you'd pay between 5 cents and about a half a dollar per person. (probably even less with 130M records... I wouldn't know honestly haven't seen many auctions of this size in my life) Do the math real fast and yeah, this kid could've made a bit more cash off of this deal, without people every knowing it happened, the fact this was made public also brings down the cost of the info as people will now take actions to ensure they don't get rekt.

dis-sys 8y ago

For me, the shocking part is not that someone selling such private data online. The really scary thing is the fact that such a doggy company with no privacy & network security concepts whatsoever actually managed to collect private data from 130 million people in a few years. btw, the database was not uploaded to github, some moronic programmer hard coded the url/username/password of their database into a source file and uploaded that to github. As expected, the database can easily be accessed from the internet and more than 100G of data was stolen without being noticed.

fosco 8y ago
Agreed. compared to exactis and and experian leaks though, I am wondering what makes this data valuable? (pardon my ignorance) Edit: appears you answered in another thread. > this dataset contains the unique national ID, home address, cell phone number, bank card number of 130 million Chinese. you also get to know who they shared a hotel room with. it is _not_ common.

crtasm 8y ago

Points lost for claiming VPNs are a way to access the dark web. Points gained for referring to Tor as a privacy oriented tool.

sanityvampire 8y ago
They got that it's a privacy-related thing, but they still called it a browser...
- deleted 8y ago
  [deleted]
- frockington 8y ago
  I'm always conflicted on how "correct" articles like this should be. I would prefer that they were more accurate when it comes to technology, but for the average reader (who might leave a password in git) it might be better to over simplify

rqs 8y ago

> The company's developers accidentally uploaded the entire database to Github Wait, from what I've heard, the programmer just uploaded a configuration file that contains the password of the database? And oh boy, he's not the only one, Maybe GitHub can do something about it. To the topic: This is the exact reason why I don't support any sort of system that log users personal information without user's control. Because regardless how strong and secure you think your system is, all it takes is one careless action, then everything blows up.

dis-sys 8y ago
please don't over estimate their skills and qualification. the leaked database username is root and the password is 123456. the screenshot of the github file can be access here: https://www.secrss.com/articles/4851 https://www.secrss.com/articles/4851 and yes, that "programmer" pushed such highly sensitive company information to his personal github repo.
- subcosmos 8y ago
  This happens so frequently, and is easy to scan for, sadly. What is missing is a way to programmatically, and secretly, inform people of their mistakes. I've personally found literally hundreds of examples of this and lack the manpower to file that many tickets....
  - jjoonathan 8y ago
    Missing? I thought they already did that. IIRC a couple of my teammates reported getting emails from github about accidentally uploading AWS credentials and the like.
  - hinkley 8y ago
    What is missing is a default or recommended git hook to reject pushes that contain passwords for the patterns that are obvious.
  - deleted 8y ago
    [deleted]

LarryL 8y ago

Ignoring the moral/ethics concerns, how would a potential buyer know that the data is legit (if it even exists at all?). Give me a couple of days and I'll create a fake -but real looking- set of records with millions of false customers (it would be made real enough by using public information)... If you tell me that they'll provide an extract as "proof", I'll answer: it's easy to cook-up a realistic small sample, just using and remixing former leaks/hacks for instance... In summary: the money aspect makes the data MUCH more suspicious than a "bragging/4tehLULz" hack.

NedIsakoff 8y ago
mapping of 居民身份证 to real names..
swarnie_ 8y ago
Reputation and repeat business. You might get away with selling fake information once, i highly doubt you would get away with it twice. I imagine its a similar scenario to how other dodgy markets work such as drugs or cryptolocker decryption keys, reputation and customer service mean a lot.
- 21 8y ago
  For hackers good opsec would require them to use a new persona for each separate hack. Compartimentalization. Linking separate hacks together is a really bad idea.
ALittleLight 8y ago
Perhaps if you are a buyer of this data you have similar, if smaller, databases. You could then say, here's ten thousand hashed credit card numbers from my collection. Give me the full data for ~1,000 of them. If their data lines up with yours that's a good sign. This wouldn't be a perfect method, but if the seller could do it then it would increase my confidence a lot.
yangzx 8y ago
For this particular example, the buyer can simply look himself up in the dataset. LOL. This dataset is the database of the largest hotel brand of China. I am pretty sure there are entries about me in the database (I am Chinese). It's damn embarrassing, people know me can know who I slept with if he pay 8 bitcoin now. Now I hope the price of bitcoins goes up.

weej 8y ago

Folks, please remember to PURGE GIT COMMIT HISTORY of the file. It does no good to simply remove a password if it's there in plain (historical) sight. https://help.github.com/articles/removing-sensitive-data-from-a-repository/ https://help.github.com/articles/removing-sensitive-data-fro...

stevekemp 8y ago
And obviously rotate the exposed credentials - because even if it was only public for "a while" it could have been viewed by many users.
- meowface 8y ago
  Plus it could've been archived by another website or a private scraping tool which looks for exactly these sorts of exposures. Removing it from the git history is almost irrelevant and just stops future people who find it from sniffing around. The crucial part is rotating the credentials and ensuring the credentials aren't used anywhere else. The second step should be reviewing all logs to ensure no unauthorized logins occurred before the credentials were changed (even if the exposure was only exploitable for a few seconds).

northfoxz2015 8y ago

wondering if there is a service to be built selling data through cryptocurrencies...