4 ms·

Kinda curious how you never find those dumps by a normal search on Google, basically you have no way to know if your data is there if you don't know where to lo

Kinda curious how you never find those dumps by a normal search on Google, basically you have no way to know if your data is there if you don't know where to look. I don't use Facebook but I always suspected my data is there due to friends having me in their contacts and using their apps.

shiftpgdn 7y ago
You are likely in this database if you added your phone number to your Facebook account. There was a point where if you just typed a phone number into facebook it'd return the person who associated their account with that number.
- docker_up 7y ago
  Even worse. You are likely in this database if even a single one of your contacts uploaded their contacts to Facebook. The probability of your phone number not being uploaded to Facebook is basically 0.
  - gatherhunterer 7y ago
    The article says that each entry has an ID associated with a Facebook account. What leads you to think that there are entries in this dataset for non-users?
    - ineedasername 7y ago
      It's well known that Facebook collects information on non users as well, frequently called "shadow profiles.", Zuck admitted as much to Congress although he claimed not to know what shadow profile meant. [0] Whether or not that information was part of this database isn't clear, but it also isn't something the parent comment claimed. [0] https://slate.com/technology/2018/04/facebook-collects-data-on-non-facebook-users-if-they-want-to-delete-it-they-have-to-sign-up.html https://slate.com/technology/2018/04/facebook-collects-data-...
      - gatherhunterer 7y ago
        That is exactly what the parent comment claimed. > You are likely in this database if even a single one of your contacts uploaded their contacts to Facebook. Shadow profiles are old news. The suspect claim is that the parent comment is more informed on this database than the source that published it. > Whether or not that information was part of this database isn't clear Yes it is. According to the source this particular public data dump consists only of entries with IDs linked a Facebook account. > Each record contained a user’s unique Facebook ID and the phone number listed on the account. A user’s Facebook ID is typically a long, unique and public number associated with their account
        ineedasername 7y ago
        I don't see why shadow profiles couldn't use the same ID system. why not? For the parent comment saying they were in the data set: My initial interpretation was they meant if one Facebook user had done so, and you were also a Facebook user, whether or not you had provided your #, it was now associate with you. Your interpretation might be correct though.
- birdyrooster 7y ago
  What would happen if millions of people changed their phone numbers and did not re-register them with new accounts? Does anyone believe a social effort could dissuade the use of phone numbers for tracking people? How much entropy would need to be added to the system before using phone numbers as identifiers became useless?
- pedrocx486 7y ago
  Well, I never had an FB account. But I have friends who I know have contact search enabled on their phones, so they probably have my phone and maybe first name.
edm0nd 7y ago
Security researchers use search engines like Shodan to find these databases, not Google.
- cbau 7y ago
  Is protocol if you find these things a security researcher not to share the link? I read about these leaks a lot and am always interested in viewing them but never can find them. I assume the links are shared with people carefully because a small number of people will use them maliciously.
  - LocalPCGuy 7y ago
    Depending on the severity of the breach, yes it's generally considered best practice to notify the service first and give them time to deal with it. Depending on how bad it is, the person reporting it may be compensated for finding it. The company would generally fix the issue, and then the person who found it can make it public (based on their agreement with the company sometimes). The time period is often 90 days, but it could be worked out independently per case. As with anything like this, consult a lawyer who knows this area of the law of you find yourself in this situation.
  - Bnshsysjab 7y ago
    It’s never good to disclose PII. Dropping vulns after responsible disclosure is mostly considered ok, not so much with PII - it’s not the victims fault and can be damaging longer term. If the vendor refuses to fix the issue, providing the media with enough redacted info to have them publish a story will force the vendors hand.
bifrost 7y ago
Google only really does http/https, finding mongodb requires scanning for 27019 and then pointing a client at it. I believe Shodan does this.
- devy 7y ago
  Is the background image on the TechCrunch article an UI for monogodb? Or is it just a FB GraphQL query browser UI?
  - MapleWalnut 7y ago
    It's MongoDB Compass, a client for Mongo.
- userbinator 7y ago
  It also indexes ftp, but that may unfortunately be coming to an end[1]. Ironically enough, Google's mission statement is still "to organize the world's information and make it universally accessible and useful", which if taken to its logical conclusion would mean such humorously delightful things as scanning for mongos and indexing their contents too... [1] https://news.ycombinator.com/item?id=20721609 https://news.ycombinator.com/item?id=20721609
  - lioeters 7y ago
    > to organize the world's information ..including any private data they can gather on you, via search, maps, analytics, browser.. I wouldn't put it past Google to be already indexing exposed databases (or continue indexing ftp), just not making it publicly available.
  - bifrost 7y ago
    Its almost like people need a tool to tell them not to leave stuff open like that... Between MongoDB, Jenkins and Elasticsearch, thats a whole ecosystem of pwnability that is probably just starting to be exploited.

shiftpgdn 7y ago

You are likely in this database if you added your phone number to your Facebook account. There was a point where if you just typed a phone number into facebook it'd return the person who associated their account with that number.

docker_up 7y ago
Even worse. You are likely in this database if even a single one of your contacts uploaded their contacts to Facebook. The probability of your phone number not being uploaded to Facebook is basically 0.
- gatherhunterer 7y ago
  The article says that each entry has an ID associated with a Facebook account. What leads you to think that there are entries in this dataset for non-users?
  - ineedasername 7y ago
    It's well known that Facebook collects information on non users as well, frequently called "shadow profiles.", Zuck admitted as much to Congress although he claimed not to know what shadow profile meant. [0] Whether or not that information was part of this database isn't clear, but it also isn't something the parent comment claimed. [0] https://slate.com/technology/2018/04/facebook-collects-data-on-non-facebook-users-if-they-want-to-delete-it-they-have-to-sign-up.html https://slate.com/technology/2018/04/facebook-collects-data-...
    - gatherhunterer 7y ago
      That is exactly what the parent comment claimed. > You are likely in this database if even a single one of your contacts uploaded their contacts to Facebook. Shadow profiles are old news. The suspect claim is that the parent comment is more informed on this database than the source that published it. > Whether or not that information was part of this database isn't clear Yes it is. According to the source this particular public data dump consists only of entries with IDs linked a Facebook account. > Each record contained a user’s unique Facebook ID and the phone number listed on the account. A user’s Facebook ID is typically a long, unique and public number associated with their account
      - ineedasername 7y ago
        I don't see why shadow profiles couldn't use the same ID system. why not? For the parent comment saying they were in the data set: My initial interpretation was they meant if one Facebook user had done so, and you were also a Facebook user, whether or not you had provided your #, it was now associate with you. Your interpretation might be correct though.
birdyrooster 7y ago
What would happen if millions of people changed their phone numbers and did not re-register them with new accounts? Does anyone believe a social effort could dissuade the use of phone numbers for tracking people? How much entropy would need to be added to the system before using phone numbers as identifiers became useless?
pedrocx486 7y ago
Well, I never had an FB account. But I have friends who I know have contact search enabled on their phones, so they probably have my phone and maybe first name.

edm0nd 7y ago

Security researchers use search engines like Shodan to find these databases, not Google.

cbau 7y ago
Is protocol if you find these things a security researcher not to share the link? I read about these leaks a lot and am always interested in viewing them but never can find them. I assume the links are shared with people carefully because a small number of people will use them maliciously.
- LocalPCGuy 7y ago
  Depending on the severity of the breach, yes it's generally considered best practice to notify the service first and give them time to deal with it. Depending on how bad it is, the person reporting it may be compensated for finding it. The company would generally fix the issue, and then the person who found it can make it public (based on their agreement with the company sometimes). The time period is often 90 days, but it could be worked out independently per case. As with anything like this, consult a lawyer who knows this area of the law of you find yourself in this situation.
- Bnshsysjab 7y ago
  It’s never good to disclose PII. Dropping vulns after responsible disclosure is mostly considered ok, not so much with PII - it’s not the victims fault and can be damaging longer term. If the vendor refuses to fix the issue, providing the media with enough redacted info to have them publish a story will force the vendors hand.

bifrost 7y ago

Google only really does http/https, finding mongodb requires scanning for 27019 and then pointing a client at it. I believe Shodan does this.

devy 7y ago
Is the background image on the TechCrunch article an UI for monogodb? Or is it just a FB GraphQL query browser UI?
- MapleWalnut 7y ago
  It's MongoDB Compass, a client for Mongo.
userbinator 7y ago
It also indexes ftp, but that may unfortunately be coming to an end[1]. Ironically enough, Google's mission statement is still "to organize the world's information and make it universally accessible and useful", which if taken to its logical conclusion would mean such humorously delightful things as scanning for mongos and indexing their contents too... [1] https://news.ycombinator.com/item?id=20721609 https://news.ycombinator.com/item?id=20721609
- lioeters 7y ago
  > to organize the world's information ..including any private data they can gather on you, via search, maps, analytics, browser.. I wouldn't put it past Google to be already indexing exposed databases (or continue indexing ftp), just not making it publicly available.
- bifrost 7y ago
  Its almost like people need a tool to tell them not to leave stuff open like that... Between MongoDB, Jenkins and Elasticsearch, thats a whole ecosystem of pwnability that is probably just starting to be exploited.