6 ms·

Massive mortgage and loan data leak gets worse, original documents also exposed

131 points by PretzelFisch 8y ago

xfour 8y ago
So sloppy, this is why it becomes clear that your developers need to know the scope of your business. Best practices sure don’t leave an open server with production data. But, if you know you have tons of pii in there, you should treat that like proverbial nuclear radiating material and lock it down with whatever means are at your disposal, regardless of difficulty to do so.
- packet_nerd 8y ago
  Also evaluate which data really needs to be saved in the first place.
- stronglikedan 8y ago
  Securing the data costs money. Leaking the data doesn't. Until it does, businesses will take the path that least affects their bottom line.
cascom 8y ago
This is getting so tiresome - consumers need direct recourse against those institutions that are mishandling/losing their data Edit: if this were the case, the perception would change from viewing large troves of personal private data as an asset, to being viewed as a liability that needs to be mitigated.
- dhh2106 8y ago
  Agreed. I feel like a barely flinch at these headlines anymore. My guess is most people also are getting desensitized, which means the PR costs of a hack are decreasing. We need some mechanism to increase costs (or fundamentally change the way data ownership works)
  - shados 8y ago
    I think part of the problem is that the impact for individuals is also decreasing. Right now, if you want to know my email, my address, my SSN and the name of my family members, you can find it in some torrent file somewhere on the internet. There just isn't a whole lot about me that isn't already available through the bazillion previous data breaches. Only people who were not part of those are impacted by the new ones. So my credit is already frozen, I already monitor my reports, I already know that most emails I get with personal information is fishing... one more literally doesn't do anything. We can only think about the future generations at this point, who aren't yet impacted. People are really bad at that though (see: global warming).
- BoiledCabbage 8y ago
  This will continue to happen as long as data is viewed as an asset to hoard. It needs to be viewed like debt - a liability to manage. Ie only hold it when it provides you value greater than the risk and cost involved. Current time in society "data" is a zero interest rate loan, that is never due, with no credit worthiness check, and no penalty for default. The incentives are perverse. It absolutely doesn't align with the costs to society. At bare minimum you need penalty for default, and a non-zero interest rate (with regular payments).
  - rrhyne 8y ago
    Well put.
  - maxxxxx 8y ago
    Equifax already has shown that there are no consequences. If they took data security seriously then a breach of that severity should have seriously endangered the company but in reality nothing happened. I am sure other companies have been watching closely and concluded that the cost for proper security practices is too high compared to the cost of a breach.
  - specialist 8y ago
    Please say more. -- My current position is that my data is me. Anyone using my data owes me money. To guard my privacy, I get to choose what is publicly known about me. Being a very simple bear, I envision modern privacy as an extension of property rights, a fundamental human right. I want to hear more about your (?) ideas of debt, liability. It feels more flexible, but I'm having hard time envisioning the mechanics. My notion does not cover the decay rate (shelf-life) of data. eg When I die, what happens to my data? Do I really care that anyone knows my autopsy report, my DNA, my lifetime earnings, my favorite sports ball teams, etc? Nor does it cover (pseudo-)anonymous data. How would my data be included in longitudinal datasets like public health, surveys, traffic, etc? -- I've been chewing on this stuff for a long time. I have direct experience with (in order) electronic medical records, voter privacy, marketing, metrics & analytics. This topic always makes my head hurt.
    - 8y ago
- PretzelFisch 8y ago
  I work in this industry, anything that doesn't have the regulated retention period for audits has high pressure to be burned asap.
- SmellyGeekBoy 8y ago
  You mean like GDPR?
- deleted 8y ago
  [deleted]
lykr0n 8y ago
There needs to be fines for this kind of stuff. Each and every person affected needs to be notified, and the companies sued into oblivion. It's just negligence.
- breakingcups 8y ago
  Europe has it, with the GDPR. It'll never happen in the U.S., corporate America has too much lobby power.
  - maxxxxx 8y ago
    I can see in my (US) company how the GDPR already has an influence on data collection practices. Three years ago we wanted to just suck up all available data and figure out later what to do with it. Now there is much more thought and we have to set up processes for deleting data and other things. It's a little more work but definitely a good thing.
    - WrtCdEvrydy 8y ago
      My favorite part is salting someone's database. Sign up as a US citizen, switch your country in the preferences to Spain like 2 minutes later... Boom
      - maxxxxx 8y ago
        That's why it's often easier to go full GDPR if you have worldwide customers.
psychometry 8y ago
Was Elasticsearch on AWS, too? I wouldn't be surprised since they don't support x-pack, making only more inconvenient forms of authentication available to users.
ulkesh 8y ago
So how do we truly know if we're affected? OpticsML claims they are "working to notify all affected parties", but they have lost all trust and credibility, so I'm not holding my breath.
- misiti3780 8y ago
  who is behind OpticsML, cant find anything about them
  - matheweis 8y ago
    From the archive.org cache (https://web.archive.org/web/20180824215739/https://www.opticsml.com/ https://web.archive.org/web/20180824215739/https://www.optic...) of their homepage, it looks like they were a company that did OCR, indexing, & AI assisted data extraction. Seems like a pretty good use of ML really - shouldn’t be an intractable problem to identify something like a scanned W2, run OCR on it and extract the income fields.
sct202 8y ago
I don't understand how do people just leave servers with open access. Don't you have to manually set them up to be unprotected and accessible that way? Edit: missed a word
- technofiend 8y ago
  No, the opposite is often true. To get you working quickly software often has open-to-all by default and the user is left to lock down as they see fit.
  - travisr 8y ago
    The new leak came from an S3 server, which would have been locked down by default. Someone had to make it open to the public.
    - PretzelFisch 8y ago
      Didn't S3 used to default to public? I know older versions of Elasticsearch didn't need authentication when first setup.
      - WrtCdEvrydy 8y ago
        Yes, now you get even a warning for opening the bucket but I bet you someone googled the answer and was like 'fuck it, too much a headache to set up IAM for my app.'
    - Cshelton 8y ago
      What most likely happened is, the developer setting it up did have it locked down. But then some upper management decree came down and said, these people/department needs to be able to access this data however they please. The developer probably told them, ok, here is how we need to set that up. The manager said, no, too hard. Just let them call it directly, don't encrypt it, don't check for authorization, make it "easy for them to get to"... And here we are today. If I were a developer in that position, after pushing back with nothing coming from it. You should do what doctors do. Tell whoever is ordering you to do X, that you need it in writing and coming from him personally. Other than that, you don't have many options as a developer. Your other option is to be fired, and they'll bring in the next guy. So ultimately, there needs to be accountability, not just on developers, but the business as a whole. A developer should have the ability to raise a flag to someone without recourse.
dwyerm 8y ago
> "Campbell confirmed that the company will inform all affected customers" Even though they might be holding my data, I'm most likely not their customer. So, will I ever get informed if they leaked my data? The ownership of data is getting to be a tricky problem. My employer is asking me to submit to regular and continuous background checks through a third-party service. My employer claims that this third-party has remedies to my employer in their contract in case of a breach, but when I asked what the remedies were to ME I was met with silence.
deleted 8y ago
[deleted]
crb002 8y ago
This does not disturb me (modulo leak of SSNs). If documents for federal mortgages were public we would have seen 90% less mortgage fraud.

131 points by PretzelFisch 8y ago

So sloppy, this is why it becomes clear that your developers need to know the scope of your business. Best practices sure don’t leave an open server with production data. But, if you know you have tons of pii in there, you should treat that like proverbial nuclear radiating material and lock it down with whatever means are at your disposal, regardless of difficulty to do so.

packet_nerd 8y ago
Also evaluate which data really needs to be saved in the first place.
stronglikedan 8y ago
Securing the data costs money. Leaking the data doesn't. Until it does, businesses will take the path that least affects their bottom line.

cascom 8y ago

This is getting so tiresome - consumers need direct recourse against those institutions that are mishandling/losing their data Edit: if this were the case, the perception would change from viewing large troves of personal private data as an asset, to being viewed as a liability that needs to be mitigated.

dhh2106 8y ago
Agreed. I feel like a barely flinch at these headlines anymore. My guess is most people also are getting desensitized, which means the PR costs of a hack are decreasing. We need some mechanism to increase costs (or fundamentally change the way data ownership works)
- shados 8y ago
  I think part of the problem is that the impact for individuals is also decreasing. Right now, if you want to know my email, my address, my SSN and the name of my family members, you can find it in some torrent file somewhere on the internet. There just isn't a whole lot about me that isn't already available through the bazillion previous data breaches. Only people who were not part of those are impacted by the new ones. So my credit is already frozen, I already monitor my reports, I already know that most emails I get with personal information is fishing... one more literally doesn't do anything. We can only think about the future generations at this point, who aren't yet impacted. People are really bad at that though (see: global warming).
BoiledCabbage 8y ago
This will continue to happen as long as data is viewed as an asset to hoard. It needs to be viewed like debt - a liability to manage. Ie only hold it when it provides you value greater than the risk and cost involved. Current time in society "data" is a zero interest rate loan, that is never due, with no credit worthiness check, and no penalty for default. The incentives are perverse. It absolutely doesn't align with the costs to society. At bare minimum you need penalty for default, and a non-zero interest rate (with regular payments).
- rrhyne 8y ago
  Well put.
- maxxxxx 8y ago
  Equifax already has shown that there are no consequences. If they took data security seriously then a breach of that severity should have seriously endangered the company but in reality nothing happened. I am sure other companies have been watching closely and concluded that the cost for proper security practices is too high compared to the cost of a breach.
- specialist 8y ago
  Please say more. -- My current position is that my data is me. Anyone using my data owes me money. To guard my privacy, I get to choose what is publicly known about me. Being a very simple bear, I envision modern privacy as an extension of property rights, a fundamental human right. I want to hear more about your (?) ideas of debt, liability. It feels more flexible, but I'm having hard time envisioning the mechanics. My notion does not cover the decay rate (shelf-life) of data. eg When I die, what happens to my data? Do I really care that anyone knows my autopsy report, my DNA, my lifetime earnings, my favorite sports ball teams, etc? Nor does it cover (pseudo-)anonymous data. How would my data be included in longitudinal datasets like public health, surveys, traffic, etc? -- I've been chewing on this stuff for a long time. I have direct experience with (in order) electronic medical records, voter privacy, marketing, metrics & analytics. This topic always makes my head hurt.
  - 8y ago
PretzelFisch 8y ago
I work in this industry, anything that doesn't have the regulated retention period for audits has high pressure to be burned asap.
SmellyGeekBoy 8y ago
You mean like GDPR?
deleted 8y ago
[deleted]

lykr0n 8y ago

There needs to be fines for this kind of stuff. Each and every person affected needs to be notified, and the companies sued into oblivion. It's just negligence.

breakingcups 8y ago
Europe has it, with the GDPR. It'll never happen in the U.S., corporate America has too much lobby power.
- maxxxxx 8y ago
  I can see in my (US) company how the GDPR already has an influence on data collection practices. Three years ago we wanted to just suck up all available data and figure out later what to do with it. Now there is much more thought and we have to set up processes for deleting data and other things. It's a little more work but definitely a good thing.
  - WrtCdEvrydy 8y ago
    My favorite part is salting someone's database. Sign up as a US citizen, switch your country in the preferences to Spain like 2 minutes later... Boom
    - maxxxxx 8y ago
      That's why it's often easier to go full GDPR if you have worldwide customers.

psychometry 8y ago

Was Elasticsearch on AWS, too? I wouldn't be surprised since they don't support x-pack, making only more inconvenient forms of authentication available to users.

ulkesh 8y ago

So how do we truly know if we're affected? OpticsML claims they are "working to notify all affected parties", but they have lost all trust and credibility, so I'm not holding my breath.

misiti3780 8y ago
who is behind OpticsML, cant find anything about them
- matheweis 8y ago
  From the archive.org cache (https://web.archive.org/web/20180824215739/https://www.opticsml.com/ https://web.archive.org/web/20180824215739/https://www.optic...) of their homepage, it looks like they were a company that did OCR, indexing, & AI assisted data extraction. Seems like a pretty good use of ML really - shouldn’t be an intractable problem to identify something like a scanned W2, run OCR on it and extract the income fields.

sct202 8y ago

I don't understand how do people just leave servers with open access. Don't you have to manually set them up to be unprotected and accessible that way? Edit: missed a word

technofiend 8y ago
No, the opposite is often true. To get you working quickly software often has open-to-all by default and the user is left to lock down as they see fit.
- travisr 8y ago
  The new leak came from an S3 server, which would have been locked down by default. Someone had to make it open to the public.
  - PretzelFisch 8y ago
    Didn't S3 used to default to public? I know older versions of Elasticsearch didn't need authentication when first setup.
    - WrtCdEvrydy 8y ago
      Yes, now you get even a warning for opening the bucket but I bet you someone googled the answer and was like 'fuck it, too much a headache to set up IAM for my app.'
  - Cshelton 8y ago
    What most likely happened is, the developer setting it up did have it locked down. But then some upper management decree came down and said, these people/department needs to be able to access this data however they please. The developer probably told them, ok, here is how we need to set that up. The manager said, no, too hard. Just let them call it directly, don't encrypt it, don't check for authorization, make it "easy for them to get to"... And here we are today. If I were a developer in that position, after pushing back with nothing coming from it. You should do what doctors do. Tell whoever is ordering you to do X, that you need it in writing and coming from him personally. Other than that, you don't have many options as a developer. Your other option is to be fired, and they'll bring in the next guy. So ultimately, there needs to be accountability, not just on developers, but the business as a whole. A developer should have the ability to raise a flag to someone without recourse.

dwyerm 8y ago

> "Campbell confirmed that the company will inform all affected customers" Even though they might be holding my data, I'm most likely not their customer. So, will I ever get informed if they leaked my data? The ownership of data is getting to be a tricky problem. My employer is asking me to submit to regular and continuous background checks through a third-party service. My employer claims that this third-party has remedies to my employer in their contract in case of a breach, but when I asked what the remedies were to ME I was met with silence.

deleted 8y ago

[deleted]

crb002 8y ago

This does not disturb me (modulo leak of SSNs). If documents for federal mortgages were public we would have seen 90% less mortgage fraud.