8 ms·

I don’t really think he should be naming who his unnamed sources “think” is behind an attack on this scale, especially with full name, city of origin, Instagram

I don’t really think he should be naming who his unnamed sources “think” is behind an attack on this scale, especially with full name, city of origin, Instagram, suggested current location, age, etc. It feels a very, very small step away from doxxing to me. Added to which he has somebody in the comments essentially calling for the death penalty over this. If he has this personal information and evidence, pass it to the relevant authorities and don’t sensationalise it on a blog. Technical details fine, but people’s personal information feels like it’s crossing a line on something like this.

Qw3r7 6y ago
He might just be inferring what he believes rather than an out right allegation. You are right though, I would consider this to be doxxing.
yjftsjthsd-h 6y ago
> It feels a very, very small step away from doxxing to me. What small step is that? Looks like a textbook case of doxxing to me.
- elliotec 6y ago
  > Researching and publicly broadcasting private or identifying information (especially personally identifying information) about an individual or organization. Yeah this is definitionally doxxing
- Forbo 6y ago
  This isn't his first time doing it, either. https://itwire.com/security/infosec-researchers-slam-ex-wapo-man-krebs-over-doxxing.html https://itwire.com/security/infosec-researchers-slam-ex-wapo...
  - hoppelhase 6y ago
    Some people claim that the coinhive story had some unnecessary doxxing aswell: https://krebsonsecurity.com/2020/03/annual-protest-to-fight-krebs-raises-e150k/ https://krebsonsecurity.com/2020/03/annual-protest-to-fight-... (see comments) The users of said image board do a yearly fundraiser to protest against the unnecessary doxxing. The first one was started by a random user.
  - ziddoap 6y ago
    I was personally unaware of these stories, and am slightly disgusted by the fact that I used to think Krebs was a fairly stand-up guy. Doxxing someone because of a bad book review? I guess I shouldn't be surprised he's now doxxing someone based on a loose thread with no evidence. I would have thought someone who has been swatted before would realize the dangers of releasing someones personal address to outrage-hungry vigilantes.
  - _ma2q 6y ago
    He also doxxed a guy who registered a bunch of domains defensively. He didn't even really apologize, just updated the story a few days later. [1] I called it out here prior to the update. [2] 1. https://krebsonsecurity.com/2020/04/whos-behind-the-reopen-domain-surge/ https://krebsonsecurity.com/2020/04/whos-behind-the-reopen-d... 2. https://twitter.com/cyberingcc/status/1252460981546090496 https://twitter.com/cyberingcc/status/1252460981546090496
  - reactchain 6y ago
    That is just embarrassingly petty - I've just lost a little more respect for the guy.
malwarebytess 6y ago
It's doxxing. My question is why is that a bad thing in this case? Zero tolerance policies don't make any sense to me.
- ziddoap 6y ago
  Because... Because it's not confirmed?
- wolco 6y ago
  Because the person he is doxxing isn't behind this. Unnamed telco source is not credible or is a rectangle swimming pools being used as a fingerprint.
  - malwarebytess 6y ago
    > Because the person he is doxxing isn't behind this. Don't think you can say that with certainty. It looks like a fairly solid series of deductions.
- the_svd_doctor 6y ago
  Maybe because the person he is pointing to may herself become a target of attacks/harassment other. If he (or she) is really the perpetrator, he should ideally be arrested and convicted. But it may also not be him. I'm not sure I understand your comment actually.
- pixelbash 6y ago
  Because doxxing as a strategy has a nasty habit of ruining the lives of people that turn out to be innocent. Skipping legal process and all that.
- zymhan 6y ago
  Do you also support vigilante justice?
- scubbo 6y ago
  On the off-chance that you're serious - doxxing someone who is suspected to be linked to a crime is staggeringly irresponsible, because you are then effectively convicting them in the court of public opinion. If they are innocent, but you have not only levelled accusations at them, but provided ways to access them, then you are partially responsible for what others choose to do with that information.
deleted 6y ago
[deleted]
dcow 6y ago
I never understood the whole doxing thing... the actions you take in this world are real. You can't take them back. You don't get to be anonymous just because you wish to be or because you frequent hacker sub-cults where doxing is some holy transgression. Bad op sec is bad op sec. Nothing more, nothing less. If Krebs got it wrong, well, he can suffer the consequences of that, too.
- ziddoap 6y ago
  >If Krebs got it wrong, well, he can suffer the consequences of that, too. And, if he got it wrong, the innocent person he doxxed has to suffer the (potentially much more harsh) consequences of someone else's irresponsible actions. While Krebs begins working on his next story, and if we're lucky, posts an "oopsie" comment. How can you justify that as okay?
  - dcow 6y ago
    Do you think Krebs got it wrong? But regardless, harassment is harassment. If the public starts harassing the dude, even if he is guilty, they're just as guilty of their own offenses. Two wrongs don't make a right.
    - alacombe 6y ago
      > Do you think Krebs got it wrong? This is irrelevant, how can you have a fair justice system if the mob has already condemned the defender.
      - dcow 6y ago
        I don't want a mob to condemn anyone. A mob should not be condemning anyone, ever. Why is the baseline assumption that a public accusation must be followed by swift and undue internet mob justice? That's what's fucked up if you ask me.
    - celticninja 6y ago
      He has in the past, and his response has been to delete the tweets but not offer an apology, or retraction. So when those tweets are re-posted, and/or screenshotted, there is no way to tell that the information is incorrect.
pixelface 6y ago
It's not one step away from doxxing at all -- in this case Lucky225 is not an unnamed source, that is actually his real legal name per his twitter [1] and the FCC database entry for his ham radio license (not linking that) [1] https://twitter.com/lucky225/status/1258503072323526657 https://twitter.com/lucky225/status/1258503072323526657
- coderintherye 6y ago
  Well, I think they meant doxxing Joe, but also seems to be doxxing Lucky225 as you noted. Once you look at Lucky225's Ham then you get an address. Of course, what is somewhat interesting is their listed address actually is located at Colorado's Division of Central Services building, which very interestingly is a way to obtain a confidential mail forwarding address. It says it is only to be used by victims of stalking/violence/harassment but who knows how well that is enforced: https://www.colorado.gov/pacific/dcs/acp-faq https://www.colorado.gov/pacific/dcs/acp-faq Either way, I think SexyCyborg (well-known Maker) is quite right to call out HAM license as a vector for getting doxxed.
  - vonmoltke 6y ago
    > Either way, I think SexyCyborg (well-known Maker) is quite right to call out HAM license as a vector for getting doxxed. The ham license process itself is the doxxing, not a vector to it. The FCC is the one doing the public publishing of identifying information.
deleted 6y ago
[deleted]
kabacha 6y ago
> Added to which he has somebody in the comments essentially calling for the death penalty over this Don't feed the trolls. If anything we've seen a lot of praise for this person. That has probably been the most responsible hack when you think about it.
d23 6y ago
I lost a lot of respect for krebs a while ago when he doxxed a minor. I haven't followed him much since, so I don't know how repeatedly he has offended, but this doesn't surprise me.
celticninja 6y ago
There is also a link in the comments on that page to a very comprehensive doxxing of j0e and his family members.
jacquesm 6y ago
100% right. Krebs is useful but an attention whore and an asshole to boot. He couldn't resist the temptation. All he should have done is share his findings with investigators but hey: clicks and the mortgage > ethics.
pelliphant 6y ago
+1. serious media outlets generally don't name suspects untill they are convicted. This is a rule that we as a society have established after generations of experience with how media works. Then we get "social media", and all the old rules get thrown out... So, how long will it take to reinvent the same rules for this new platform?

Qw3r7 6y ago

He might just be inferring what he believes rather than an out right allegation. You are right though, I would consider this to be doxxing.

yjftsjthsd-h 6y ago

> It feels a very, very small step away from doxxing to me. What small step is that? Looks like a textbook case of doxxing to me.

elliotec 6y ago
> Researching and publicly broadcasting private or identifying information (especially personally identifying information) about an individual or organization. Yeah this is definitionally doxxing
Forbo 6y ago
This isn't his first time doing it, either. https://itwire.com/security/infosec-researchers-slam-ex-wapo-man-krebs-over-doxxing.html https://itwire.com/security/infosec-researchers-slam-ex-wapo...
- hoppelhase 6y ago
  Some people claim that the coinhive story had some unnecessary doxxing aswell: https://krebsonsecurity.com/2020/03/annual-protest-to-fight-krebs-raises-e150k/ https://krebsonsecurity.com/2020/03/annual-protest-to-fight-... (see comments) The users of said image board do a yearly fundraiser to protest against the unnecessary doxxing. The first one was started by a random user.
- ziddoap 6y ago
  I was personally unaware of these stories, and am slightly disgusted by the fact that I used to think Krebs was a fairly stand-up guy. Doxxing someone because of a bad book review? I guess I shouldn't be surprised he's now doxxing someone based on a loose thread with no evidence. I would have thought someone who has been swatted before would realize the dangers of releasing someones personal address to outrage-hungry vigilantes.
- _ma2q 6y ago
  He also doxxed a guy who registered a bunch of domains defensively. He didn't even really apologize, just updated the story a few days later. [1] I called it out here prior to the update. [2] 1. https://krebsonsecurity.com/2020/04/whos-behind-the-reopen-domain-surge/ https://krebsonsecurity.com/2020/04/whos-behind-the-reopen-d... 2. https://twitter.com/cyberingcc/status/1252460981546090496 https://twitter.com/cyberingcc/status/1252460981546090496
- reactchain 6y ago
  That is just embarrassingly petty - I've just lost a little more respect for the guy.

malwarebytess 6y ago

It's doxxing. My question is why is that a bad thing in this case? Zero tolerance policies don't make any sense to me.

ziddoap 6y ago
Because... Because it's not confirmed?
wolco 6y ago
Because the person he is doxxing isn't behind this. Unnamed telco source is not credible or is a rectangle swimming pools being used as a fingerprint.
- malwarebytess 6y ago
  > Because the person he is doxxing isn't behind this. Don't think you can say that with certainty. It looks like a fairly solid series of deductions.
the_svd_doctor 6y ago
Maybe because the person he is pointing to may herself become a target of attacks/harassment other. If he (or she) is really the perpetrator, he should ideally be arrested and convicted. But it may also not be him. I'm not sure I understand your comment actually.
pixelbash 6y ago
Because doxxing as a strategy has a nasty habit of ruining the lives of people that turn out to be innocent. Skipping legal process and all that.
zymhan 6y ago
Do you also support vigilante justice?
scubbo 6y ago
On the off-chance that you're serious - doxxing someone who is suspected to be linked to a crime is staggeringly irresponsible, because you are then effectively convicting them in the court of public opinion. If they are innocent, but you have not only levelled accusations at them, but provided ways to access them, then you are partially responsible for what others choose to do with that information.

deleted 6y ago

[deleted]

dcow 6y ago

I never understood the whole doxing thing... the actions you take in this world are real. You can't take them back. You don't get to be anonymous just because you wish to be or because you frequent hacker sub-cults where doxing is some holy transgression. Bad op sec is bad op sec. Nothing more, nothing less. If Krebs got it wrong, well, he can suffer the consequences of that, too.

ziddoap 6y ago
>If Krebs got it wrong, well, he can suffer the consequences of that, too. And, if he got it wrong, the innocent person he doxxed has to suffer the (potentially much more harsh) consequences of someone else's irresponsible actions. While Krebs begins working on his next story, and if we're lucky, posts an "oopsie" comment. How can you justify that as okay?
- dcow 6y ago
  Do you think Krebs got it wrong? But regardless, harassment is harassment. If the public starts harassing the dude, even if he is guilty, they're just as guilty of their own offenses. Two wrongs don't make a right.
  - alacombe 6y ago
    > Do you think Krebs got it wrong? This is irrelevant, how can you have a fair justice system if the mob has already condemned the defender.
    - dcow 6y ago
      I don't want a mob to condemn anyone. A mob should not be condemning anyone, ever. Why is the baseline assumption that a public accusation must be followed by swift and undue internet mob justice? That's what's fucked up if you ask me.
  - celticninja 6y ago
    He has in the past, and his response has been to delete the tweets but not offer an apology, or retraction. So when those tweets are re-posted, and/or screenshotted, there is no way to tell that the information is incorrect.

pixelface 6y ago

It's not one step away from doxxing at all -- in this case Lucky225 is not an unnamed source, that is actually his real legal name per his twitter [1] and the FCC database entry for his ham radio license (not linking that) [1] https://twitter.com/lucky225/status/1258503072323526657 https://twitter.com/lucky225/status/1258503072323526657

coderintherye 6y ago
Well, I think they meant doxxing Joe, but also seems to be doxxing Lucky225 as you noted. Once you look at Lucky225's Ham then you get an address. Of course, what is somewhat interesting is their listed address actually is located at Colorado's Division of Central Services building, which very interestingly is a way to obtain a confidential mail forwarding address. It says it is only to be used by victims of stalking/violence/harassment but who knows how well that is enforced: https://www.colorado.gov/pacific/dcs/acp-faq https://www.colorado.gov/pacific/dcs/acp-faq Either way, I think SexyCyborg (well-known Maker) is quite right to call out HAM license as a vector for getting doxxed.
- vonmoltke 6y ago
  > Either way, I think SexyCyborg (well-known Maker) is quite right to call out HAM license as a vector for getting doxxed. The ham license process itself is the doxxing, not a vector to it. The FCC is the one doing the public publishing of identifying information.

deleted 6y ago

[deleted]

kabacha 6y ago

> Added to which he has somebody in the comments essentially calling for the death penalty over this Don't feed the trolls. If anything we've seen a lot of praise for this person. That has probably been the most responsible hack when you think about it.

d23 6y ago

I lost a lot of respect for krebs a while ago when he doxxed a minor. I haven't followed him much since, so I don't know how repeatedly he has offended, but this doesn't surprise me.

celticninja 6y ago

There is also a link in the comments on that page to a very comprehensive doxxing of j0e and his family members.

jacquesm 6y ago

100% right. Krebs is useful but an attention whore and an asshole to boot. He couldn't resist the temptation. All he should have done is share his findings with investigators but hey: clicks and the mortgage > ethics.

pelliphant 6y ago

+1. serious media outlets generally don't name suspects untill they are convicted. This is a rule that we as a society have established after generations of experience with how media works. Then we get "social media", and all the old rules get thrown out... So, how long will it take to reinvent the same rules for this new platform?