17 ms·
800M Email Addresses Leaked Online by Email Verification Service
- deleted 8y ago[deleted]
- smallgovt 8y agoThe linked article is down. Here is a Wired article discussing the same leak: https://www.wired.com/story/email-marketing-company-809-million-records-exposed-online/ https://www.wired.com/story/email-marketing-company-809-mill...
- eli 8y agoMirror https://web.archive.org/web/20190307231618/https://securitydiscovery.com/800-million-emails-leaked-online-by-email-verification-service/ https://web.archive.org/web/20190307231618/https://securityd...
- bhhaskin 8y agoThe fact that the company shutdown their website is a little bit sketchy.... I wonder if it was a legit operation.
- odorousrex 8y agoUnsecured MongoDB in the default configuration. Why am I not surprised...
- ams6110 8y ago> in the default configuration MongoDB shares some of the blame here. Software needs be secure by default.
- baroffoos 8y agoAbsolutely. If software needs configuration before it is secure than the default behavior should be to throw an error while starting up with a link to the documentation for configuration. The default should NEVER be to just start up unsecured.
- astrodust 8y agoRedis and MySQL have started to lock down with random passwords now when installed, which is nice.
- SXX 8y agoDid MySQL let you connect to instance from remote without password like ever? I used it first time like 16-17 years ago and don't remember anything like that. PS: And yeah I remember that famous password bypass bug from 2012, but that's all.
- astrodust 8y agoMySQL's "security model" used to be that it only bound to 127.0.0.1, but beyond that there was no passwords. I may be recalling incorrectly, but root did have access via `%` on most systems I used. I'm not sure if the reason MySQL was open with no password is MySQL's fault or the various distribution packagers, they have a lot of say in how its ultimately configured, but it wasn't a good look.
- SXX 8y agoI really can't recall if / when it's changed, but for many years you just wouldn't be able to connect to MySQL as root unless you set the password. Also if someone have access to your localhost it's almost always mean you're already in trouble no matter how well database configured.
- achillean 8y agoMongoDB listens to localhost by default and provides a few warnings on startup if you don't have authentication enabled. See: https://blog.shodan.io/its-still-the-data-stupid/ https://blog.shodan.io/its-still-the-data-stupid/ I believe more of the blame should be put onto markets that provide images with insecure settings as MongoDB doesn't bind to the public interface by default and hasn't done so for years.
- beatgammit 8y agoWhich is true for most popular systems, which I appreciate. I need to consciously decide to put something on an externally accessible port, which reminds me that it's time to make sure everything is secure (TLS, authentication, user privileges, etc).
- rasz 8y agoits Web scale
- Fzzr 8y agoTime to advise your friends to be extra cautious against phishing attempts.
- diek00 8y agoThere needs to be a wall of shame
- Sohcahtoa82 8y agoHere's two of them: https://haveibeenpwned.com/PwnedWebsites https://haveibeenpwned.com/PwnedWebsites http://plaintextoffenders.com/ http://plaintextoffenders.com/
- beatgammit 8y agoFair warning on the second link: it's Tumblr and redirects https -> http (probably intentionally, given the content), and I didn't see an obvious way to search. The first is an awesome resource, and they publish password leaks as well, and they have a secure way to check if your password has been in a leak (my password manager, Bitwarden, integrates with them).
- albertgoeswoof 8y agoI strongly believe that we should be keeping our email addresses as secure as our passwords. It’s a really important attack vector as it’s often the starting point for any targeted attack, and although it’s not usually considered as a factor, it is the 2nd factor required for most logins (email and password). Triggering important security processes (eg reset password, social engineering attacks) are trivial once you know someone’s email address. It’s clear from this hack that the owners of the hacked site didn’t see emails as something worth securing (stored in plain text on a wide open mongo server) If you want to keep your email address private (you should), generate a new, random email address whenever you give yours out (the same way you use a password manager). If you have your own domain you can use a catch all/wildcard address, eg. *@mydomain.com, if you use gmail you can use their plus support, e.g. John+uniqueidentifier@gmail.com, if you use neither or want more security I’ve recently launched https://idbloc.co https://idbloc.co which aims to help deal with this.
- sbov 8y ago> If you have your own domain you can use a catch all/wildcard address, eg. @mydomain.com I've done this before. You will get a shitload of spam. I recommend suffixing the user of all addresses with something you want to go to your inbox. E.g. I use *.r@mydomain.com (r for "real"). Anything that doesn't end in .r@mydomain.com never hits my main inbox.
- NightlyDev 8y agoYou don't use wildcard addresses for this, you use sub/plus-addresses. That way the spam problem is completely avoided and multiple users per domain will work normally.
- ndnxhs 8y agoI'd use something else not plus because gmail uses plus so spammers may be aware they can change the plus to anything
- css 8y ago
- aaronharnly 8y ago[WAS: If I'm reading the Wired article[1] correctly, the haveibeenpwned.com database of email addresses has itself been leaked?] EDIT: Replies have corrected my misunderstanding, thanks! Troy was saying that his own personal email was also in the dataset. Hunt says some of his own information is included in the Verifications.io exposure. "The main takeaway for me is that this is just another case where someone has my data, and hundreds of millions of other people’s data, and I’ve absolutely no idea how they got it," Hunt says. "I’d never heard of the company until now and I certainly can’t ever recall consenting to their use of my data. Of course, it’s entirely possible that buried in some other service’s terms and conditions it says they’re allowed to pass my data around in this fashion, but that’s not really consistent with my expectations of how my data should be used."" [1] https://www.wired.com/story/email-marketing-company-809-million-records-exposed-online/ https://www.wired.com/story/email-marketing-company-809-mill...
- ineedasername 8y agoNo, he's saying the leaked database has an entry for him. Not that his own database of leaks has been breached.
- aaronharnly 8y agoAh, got it. Like, Troy is a real person who has his own email address too :)
- triangleman 8y agoNo, he's adding this email dump to his DB. And I don't exactly understand why, I mean is there any evidence that this mongodb was actually harvested? Other than by security researchers.
- outworlder 8y agoThat's not how security works. If someone gains unauthorized access to a system you own, you assume it's compromised and take it down, even if logs don't show anything. If you leave a system unsecured on the internet, assume it has been compromised and take appropriate measures. In this case, it is more likely than not that this guy was not the first to discover the database. In the absence of proof, assume it has been compromised before.
- aboutruby 8y agoFor fun: - I see 67,569 mongodb results on shodan - I searched for shodan API keys on a shady website known as "Github", found one that works, queried for all the mongodb databases - Tried connecting on the first one, it works... - What next? edit: I guess it's a choose your own adventure game: 1) Delete all the data 2) Look up domains from IPs, find owner's emails and email them 3) Make nice stats about all the data 4) Sell the data on the black market 5) Find user's emails, and tell them they are using a service that just doesn't care 6) Just make every ~third integer off by 1 7) Mine bitcoins on them ... So many ideas, so little time
- opportune 8y agoAs much of a game as it may seem, a lot of these could put you in prison.
- aboutruby 8y agoI will go with "Let it be, hoping someone does something about it someday somehow"
- Sendotsh 8y agoDepending on your country, just loading that first one up to see if it worked could put you in prison.
- btown 8y agoIn the United States, simply accessing a publicly accessible URL can put you in prison, assuming the government doesn't lose the appeal on the technicality of a choice of venue, which they won't do a second time... https://www.eff.org/press/releases/appeals-court-overturns-andrew-weev-auernheimer-conviction https://www.eff.org/press/releases/appeals-court-overturns-a...
- Pristina 8y agoHe was convicted by a jury of his 'peers'.
- skilled 8y agoI honestly don't see how this could have went in a positive direction, even if it was stated somewhere deep in the TOS that they might use the data. An interesting situation nonetheless.
- mortehu 8y agoFor other confused readers: no emails were leaked, only email addresses.
- deleted 8y ago[deleted]
- FuckOffNeemo 8y agoHN, Hug of Death?
- maherbeg 8y agoI wish Google would build an OAuth flow that would provide an obfuscated and unique email address to services that need an email address for logins or any communication at all.
- zaidf 8y agoI’d just be happy if Google made it harder for third parties implementing “login with google” to not get access to your entire org’s user list (when the org uses gsuite.)
- tgsovlerkhgsel 8y agoCan you elaborate? I thought "login with Google" meant a pretty useless token (granting access to that user's basic profile info). Can additional OAuth scopes be requested and do the third parties request the contacts permission, then harvest the organizations' contacts, and is there no setting in the admin menu to prevent either the OAuth grant or the contact access?
- zaidf 8y agoLots of SaaS companies have a “sign up with google” button which gives them access to the employee directory assuming your org uses google suite. It’s unfortunate yesteryear’s shit growth hack for consumer apps is reappearing in a worse way.
- NightShade112 8y agoOriginal story here: https://www.wired.com/story/email-marketing-company-809-million-records-exposed-online/ https://www.wired.com/story/email-marketing-company-809-mill...
- NightShade112 8y agoHere is the original article: https://www.wired.com/story/email-marketing-company-809-million-records-exposed-online/ https://www.wired.com/story/email-marketing-company-809-mill...
- mattbeckman 8y agoCompany I work for was using an email verification service for the first time. We have a lot of brands, so I was being my white hat self and checking it out before we risked importing our largest subscriber brands. It took me all of 10 minutes to find a convenient JSON endpoint with incrementing IDs that didn't disallow cross-account pulls. It wasn't a public MongoDB endpoint like the above, but we did get a pretty sweet discount rate for reporting it to them and, you know, not abusing some other customer lists with 300M+ emails.
- notFrontPage 8y ago.....and website down.
- Ellipsis753 8y agoHere's a cached version as it's down at the moment. https://web.archive.org/web/20190307231618/https://securitydiscovery.com/800-million-emails-leaked-online-by-email-verification-service/ https://web.archive.org/web/20190307231618/https://securityd...
- hendersoon 8y agoThis is why I sign up with a different email address for every site. You need your own domain to do that properly, but Gmail users can use (for example) "email+hackernews@gmail.com" to end up with a unique address. Of course it would be simple to get your real address out of that, but I doubt anyone but a spear phisher would bother.
- upofadown 8y ago>They do this by literally sending the people an email. If it does not bounce, the email is validated. That's a pretty dumb way to validate an email address. You can just end the connection after a successful RCPT TO and no one needs to be the wiser. The method causes a false validation in the case of an intermediate mail relay that accepts everything but that is such a bad idea that no one does that.
- samrohn 8y agocatch-all domains cannot be validated this way. The only way(wrong) to verify them is to send a real mail and see if it bounces.
- chaosprophet 8y agoActually a lot of email addresses cannot be validated this way since most ESPs including gmail have adopted an 'accept-all' approach to incoming email. So getting the email accepted by the server is no indication that the address exists, or that the email will actually be delivered to that address even if it exists.
- upofadown 8y ago>... including gmail ... #> swaks --quit-after RCPT --TO kdskr3j2@gmail.com === Trying gmail-smtp-in.l.google.com:25... === Connected to gmail-smtp-in.l.google.com. <- 220 mx.google.com ESMTP a199si3828494itd.133 - gsmtp -> EHLO example.com <- 250-mx.google.com at your service, [xx.xx.xx.xx] <- 250-SIZE 157286400 <- 250-8BITMIME <- 250-STARTTLS <- 250-ENHANCEDSTATUSCODES <- 250-PIPELINING <- 250-CHUNKING <- 250 SMTPUTF8 -> MAIL FROM:<bob@example.com> <- 250 2.1.0 OK a199si3828494itd.133 - gsmtp -> RCPT TO:<kdskr3j2@gmail.com> <** 550-5.1.1 The email account that you tried to reach does not exist. Please try <** 550-5.1.1 double-checking the recipient's email address for typos or <** 550-5.1.1 unnecessary spaces. Learn more at <** 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser a199si3828494itd.133 - gsmtp -> QUIT <- 221 2.0.0 closing connection a199si3828494itd.133 - gsmtp === Connection closed with remote host.
- deleted 8y ago[deleted]
- sfopdxnonstop 8y agoI do what others have said - I have domains and use pre-defined (DreamHost, no catch all) addresses different for most sites. I also define a bunch of generic ones I cam reach for on the go. I have about 150 now. Is it worth it? I don't know. It's part of the patchwork of steps I take, better than many people but by no means failsafe.
- Dahoon 8y agoWhy do you not use catch all? I do and if someone somehow should get the main mail address I'd just change it.
- deleted 8y ago[deleted]
- alxmdev 8y ago> Some of data was much more detailed than just the email address and included personally identifiable information (PII) ... ‘Emailrecords’ was structured to include zip / phone / address / gender / email / user IP / DOB How messed up is it that random 3rd parties collect and assemble all this information to begin with, leaks aside? Sounds to me like all this data fell into unscrupulous hands way before any hackers may have found it on the public internet.
- satya71 8y agoI've seen a demo where given my email address they could pull up my name, address, profession, age, and I forget what else. Yes, it's already in unscrupulous hands.
- WillPostForFood 8y agoFacebook?
- unreal37 8y agoLinkedIn.
- groestl 8y agoFullContact? Although it's "Enhanced Contact API" has been discontinued.
- Pristina 8y agopeople were so afraid of BIGTECHs getting their hands on all your personal data. When in reality, a 13 year old can just ask around on some forums and get it.
- thejohnconway 8y agoThe 13 year old can get it because BIGTECH collected it and shared it carelessly, no?
- 8y ago
- auslander 8y ago> .. Troy Hunt is adding the Verifications.io data to his service. Now my data is in another database. Sigh.
- jaunkst 8y agoI have more than that in my spam folder
- SunnyS 8y agoUnsecured MongoDB as the default configuration. No wonder it was leaked.
- openloop 8y agoGood.