5 ms·

I found it scarily easy to find info on some people. I was talking to my friend about it, so I tested it out on them (with their permission). With just their p

I found it scarily easy to find info on some people. I was talking to my friend about it, so I tested it out on them (with their permission). With just their public facing instagram account handle, I: Found full name from family members in following list -> email, phone #, etc from full name Found email + phone of most of the close family Found address, PO box, and usernames from their past accounts Found their (current!) password for email, social media, etc (but not bank) from a breach from 2016 (!!!) Found their old wattpad account (!!!!!!) Found out that their instagram had no 2fa and "hijacked it" with them next to me, changed email and password (not sure if they could have recovered it afterwards). Notifications did come through but given their email, I used an email newsletter spammer I made and a text spammer to blow up their phone to hopefully distract for the few minutes it took, to simulate a real attack. Needless to say, it was bad news all around. (I already knew some of the info I found, but my search consisted of me pretending I didn't) Edit: the irony of me posting about data security when I just divulged where I grew up & school district less than 2 weeks ago :'( (though I bet I'm fine given I have no other accounts with this username)

btown 6y ago
That "spam distraction" tactic is scary - no doubt it's being used in the wild!
- sodality2 6y ago
  Surely so! I just spent a few hours signing up for newsletters I had saved previously and gathering submit POST requests, concatenating it into one script, etc. I honestly can't think of any white hat use for it (besides what I did). I haven't open sourced it, because it will probably be used for malicious purposes by script kiddies 99% of the time, and I don't really want that associated with me.
- iamacyborg 6y ago
  It was, a few years ago Mailchimp and a few other ESP's were subject to major listbombing attacks. https://wordtothewise.com/2016/08/subscription-bombing-esps-spamhaus/ https://wordtothewise.com/2016/08/subscription-bombing-esps-...
  - sodality2 6y ago
    Unfortunately nearly every mailing list sends a confirmation email. that's good enough for an initial flood... A better solution would be "send an email to newsletter@domain.com"! Very surprised this hasn't been implemented
    - LeifCarrotson 6y ago
      Ah, but then fewer people would "sign up for the newsletter" by failing to toggle the box on the checkout page. Then your list membership growth rate would go down! Can't risk that, no wonder it hasn't been implemented.
    - iamacyborg 6y ago
      Mailchimp turned off double opt-in as the default list behaviour, presumably as a result of this listbombing taking place. It eliminates the immediate flood from the listbomb attack but does mean the email address now has to opt-out from every list they've been susbcribed to. https://wordtothewise.com/2017/10/mailchimp-changes-signup-process/ https://wordtothewise.com/2017/10/mailchimp-changes-signup-p...
raisedbyninjas 6y ago
If they're still on Facebook, their parents are likely there too. Find an uncle and you may have their mother's maiden name. Facebook still allows non-friends to see the friends list of private accounts through URL tweaking AFAIK.
- sodality2 6y ago
  Don't think I found anyone on facebook when I searched- just an instagram. If that's true, though, that's... par for Facebook I guess? I wish any other better site took off with people (especially teenagers) than something Facebook has their tendrils in.
- dado3212 6y ago
  If you submit the URL thing through the bug bounty, FB will pay out.
dogman144 6y ago
This is an area of sec research I'm very interested in: classic attacks with a major IRL impact. It's similar to social engineering but that's not a correct comparison. More like an attack that hops the cyber<>physical barrier but uses standard TTPs from pure-cyber. There are proof of concepts like this out there, to start. It's like you DDoS'd someones real life - that's intense.
- ggggtez 6y ago
  > It's like you DDoS'd someones real life No... It's called "doxxing". DDoS is completely different.
  - dogman144 6y ago
    No, it's called DDoS'ing, at least for threat model that I'm referring to. The user just near about doxx'd themselves by all the OSINT that was available. That's not particularly interesting. Trolling with IRL effects is a the better peer as well, in that case. It's also similar to malicious pop-ups in a browser, but a browser never had the life-governance abilities that a smart phone has now. What is interesting, from an exploit dev standpoint, is that in a sense you can DDoS someone's life by overwhelming their human data intake systems of notification-based services, which they use to govern their own behaviors. Think of this in terms of a notification == a connection, and human == router. * Baseline: 5 notifications per hour -> parseable by a human with 1 brain and a single iphone to triage them. No discernable effect on ability to rely on other key notifications (calendar alerts, banking messages, so on). * Elevated from baseline: 5 notifications per 10 mins: odd, but still parseable, maybe calendar alerts and watching for an important email take a back seat. * Malicious DDoS: 5 notifications per minute, on repeat: you don't know what's going on, it is overwhelming, you can't particularly turn off a phone because you still need the calendar app, and so on. When the notification system, taken in aggregate, is providing some key service to how a person runs their life, overwhelming that system is a DDoS. Another vector: many calendars such as Gcal and especially with recreational users, allow appointments to be dropped onto the calendar. This is a common sales tactic too. Generate N appointments, overwhelm a calendar, and it's up to the user to remove malicious appointments manually vs. a very bulk, automated appointment attack. DDoS as well.
aesclepius 6y ago
I've got another anecdote about exposed information. Saw a car's 'Instagram handle' while next to them (was passenger) and got curious. Sure enough, their car's Instagram handle was public-facing and had links to the presumable owner's instagram handle (public facing) and his wife's handle (also public). Within five minutes of horrified clicking, I found both parents' birthdays, occupations (and photos of locations where they worked at) full legal names and birthdays of their parents, sisters, brothers (they had posted birthday celebrations and funeral announcements with names and dates), their wedding date (and all subsequent vacations they took), residence (posted about buying a new house), their children's full legal names and where they went to school (posted dropping them off at school), and the makes and models of all their cars (posted about buying new cars) over the last 5-6 years. It was a little scary to see how open they were.
- RandallBrown 6y ago
  What potential dangers do you see from getting this information?
  - sodality2 6y ago
    That's likely enough to pull off an identity theft on some level.
  - sneak 6y ago
    Extortion, blackmail, stalking, credible threats of kidnapping or robbery due to pattern of life exposure, et c.
ggggtez 6y ago
> Found their (current!) password for email, social media, etc (but not bank) from a breach from 2016 (!!!) When a friend of mine asked me to do a similar challenge, I actually forgot to check password dumps. Then again, I also didn't bother spending the $10 for ancestry information which probably would have yielded yet more info (mother's maiden name, etc). But I kind of lost interest after reading several dozen pages of their Twitter feed.
Item_Boring 6y ago
That reminds me when I was still in high school and got to school by bus. I was around 16 and used to carry a binder with my full name on its back in my hand because it was a bit too large for my backpack. One day, I got a letter by a guy whose name I didn’t know. He saw me on the bus and thought I was cute, so he decided to look me up and somehow found out my current address. He couldn’t have used the phone boom because my family wasn’t listed, so he must’ve googled me. Luckily, the guy didn’t have any bad intentions but it was very scary nevertheless.
- sodality2 6y ago
  That sounds very scary- I'm glad he didn't have any overtly malicious reason for it. What did the letter say? Was it a "hi date me" type of thing?
  - Item_Boring 6y ago
    Yeah, me too. Yes, it was essentially a love letter ending with “please call me“. I actually did text him - since he included his phone number and I wanted to know who he was - but I “ghosted“ him after some months when he kept asking me to come to his home (he was twentysomething so several years older than me). Afterward, I received one more postcard from him telling me how much he misses me and how he wished I was there with him (he was travelling at that time) but then it stopped.
    - sodality2 6y ago
      Wow, that's very weird and very inappropriate of him, hopefully he got in trouble / didn't do that to anyone else. I'd be very anxious if someone had my home address and was harassing me, I'm sorry you had to deal with that.
      - deleted 6y ago
        [deleted]

btown 6y ago

That "spam distraction" tactic is scary - no doubt it's being used in the wild!

sodality2 6y ago
Surely so! I just spent a few hours signing up for newsletters I had saved previously and gathering submit POST requests, concatenating it into one script, etc. I honestly can't think of any white hat use for it (besides what I did). I haven't open sourced it, because it will probably be used for malicious purposes by script kiddies 99% of the time, and I don't really want that associated with me.
iamacyborg 6y ago
It was, a few years ago Mailchimp and a few other ESP's were subject to major listbombing attacks. https://wordtothewise.com/2016/08/subscription-bombing-esps-spamhaus/ https://wordtothewise.com/2016/08/subscription-bombing-esps-...
- sodality2 6y ago
  Unfortunately nearly every mailing list sends a confirmation email. that's good enough for an initial flood... A better solution would be "send an email to newsletter@domain.com"! Very surprised this hasn't been implemented
  - LeifCarrotson 6y ago
    Ah, but then fewer people would "sign up for the newsletter" by failing to toggle the box on the checkout page. Then your list membership growth rate would go down! Can't risk that, no wonder it hasn't been implemented.
  - iamacyborg 6y ago
    Mailchimp turned off double opt-in as the default list behaviour, presumably as a result of this listbombing taking place. It eliminates the immediate flood from the listbomb attack but does mean the email address now has to opt-out from every list they've been susbcribed to. https://wordtothewise.com/2017/10/mailchimp-changes-signup-process/ https://wordtothewise.com/2017/10/mailchimp-changes-signup-p...

raisedbyninjas 6y ago

If they're still on Facebook, their parents are likely there too. Find an uncle and you may have their mother's maiden name. Facebook still allows non-friends to see the friends list of private accounts through URL tweaking AFAIK.

sodality2 6y ago
Don't think I found anyone on facebook when I searched- just an instagram. If that's true, though, that's... par for Facebook I guess? I wish any other better site took off with people (especially teenagers) than something Facebook has their tendrils in.
dado3212 6y ago
If you submit the URL thing through the bug bounty, FB will pay out.

dogman144 6y ago

This is an area of sec research I'm very interested in: classic attacks with a major IRL impact. It's similar to social engineering but that's not a correct comparison. More like an attack that hops the cyber<>physical barrier but uses standard TTPs from pure-cyber. There are proof of concepts like this out there, to start. It's like you DDoS'd someones real life - that's intense.

ggggtez 6y ago
> It's like you DDoS'd someones real life No... It's called "doxxing". DDoS is completely different.
- dogman144 6y ago
  No, it's called DDoS'ing, at least for threat model that I'm referring to. The user just near about doxx'd themselves by all the OSINT that was available. That's not particularly interesting. Trolling with IRL effects is a the better peer as well, in that case. It's also similar to malicious pop-ups in a browser, but a browser never had the life-governance abilities that a smart phone has now. What is interesting, from an exploit dev standpoint, is that in a sense you can DDoS someone's life by overwhelming their human data intake systems of notification-based services, which they use to govern their own behaviors. Think of this in terms of a notification == a connection, and human == router. * Baseline: 5 notifications per hour -> parseable by a human with 1 brain and a single iphone to triage them. No discernable effect on ability to rely on other key notifications (calendar alerts, banking messages, so on). * Elevated from baseline: 5 notifications per 10 mins: odd, but still parseable, maybe calendar alerts and watching for an important email take a back seat. * Malicious DDoS: 5 notifications per minute, on repeat: you don't know what's going on, it is overwhelming, you can't particularly turn off a phone because you still need the calendar app, and so on. When the notification system, taken in aggregate, is providing some key service to how a person runs their life, overwhelming that system is a DDoS. Another vector: many calendars such as Gcal and especially with recreational users, allow appointments to be dropped onto the calendar. This is a common sales tactic too. Generate N appointments, overwhelm a calendar, and it's up to the user to remove malicious appointments manually vs. a very bulk, automated appointment attack. DDoS as well.

aesclepius 6y ago

I've got another anecdote about exposed information. Saw a car's 'Instagram handle' while next to them (was passenger) and got curious. Sure enough, their car's Instagram handle was public-facing and had links to the presumable owner's instagram handle (public facing) and his wife's handle (also public). Within five minutes of horrified clicking, I found both parents' birthdays, occupations (and photos of locations where they worked at) full legal names and birthdays of their parents, sisters, brothers (they had posted birthday celebrations and funeral announcements with names and dates), their wedding date (and all subsequent vacations they took), residence (posted about buying a new house), their children's full legal names and where they went to school (posted dropping them off at school), and the makes and models of all their cars (posted about buying new cars) over the last 5-6 years. It was a little scary to see how open they were.

RandallBrown 6y ago
What potential dangers do you see from getting this information?
- sodality2 6y ago
  That's likely enough to pull off an identity theft on some level.
- sneak 6y ago
  Extortion, blackmail, stalking, credible threats of kidnapping or robbery due to pattern of life exposure, et c.

ggggtez 6y ago

> Found their (current!) password for email, social media, etc (but not bank) from a breach from 2016 (!!!) When a friend of mine asked me to do a similar challenge, I actually forgot to check password dumps. Then again, I also didn't bother spending the $10 for ancestry information which probably would have yielded yet more info (mother's maiden name, etc). But I kind of lost interest after reading several dozen pages of their Twitter feed.

Item_Boring 6y ago

That reminds me when I was still in high school and got to school by bus. I was around 16 and used to carry a binder with my full name on its back in my hand because it was a bit too large for my backpack. One day, I got a letter by a guy whose name I didn’t know. He saw me on the bus and thought I was cute, so he decided to look me up and somehow found out my current address. He couldn’t have used the phone boom because my family wasn’t listed, so he must’ve googled me. Luckily, the guy didn’t have any bad intentions but it was very scary nevertheless.

sodality2 6y ago
That sounds very scary- I'm glad he didn't have any overtly malicious reason for it. What did the letter say? Was it a "hi date me" type of thing?
- Item_Boring 6y ago
  Yeah, me too. Yes, it was essentially a love letter ending with “please call me“. I actually did text him - since he included his phone number and I wanted to know who he was - but I “ghosted“ him after some months when he kept asking me to come to his home (he was twentysomething so several years older than me). Afterward, I received one more postcard from him telling me how much he misses me and how he wished I was there with him (he was travelling at that time) but then it stopped.
  - sodality2 6y ago
    Wow, that's very weird and very inappropriate of him, hopefully he got in trouble / didn't do that to anyone else. I'd be very anxious if someone had my home address and was harassing me, I'm sorry you had to deal with that.
    - deleted 6y ago
      [deleted]