4 ms·

Hacker has been discovered to be a random disgruntled employee looking for a quick buck. Hope he serves as a lesson of how to not behave as a public servant.

ByThyGrace 5y ago
Source?
- otrahuevada 5y ago
  Nobleza obliga, latest news indicate the guy extricated a whole lot of records and it would appear authorities are nowhere near as close to unequivocally identifying him as was originally said.
- otrahuevada 5y ago
  https://www.lanacion.com.ar/sociedad/tras-un-confuso-episodio-desmienten-que-se-haya-hackeado-la-web-con-los-datos-de-todos-los-dni-del-nid13102021/ https://www.lanacion.com.ar/sociedad/tras-un-confuso-episodi... IT talked to Twitter and found a very narrow amount of people with the ability to do this.
  - ByThyGrace 5y ago
    But that was before what the OP article is claiming. > However, The Record contacted the individual who was renting access to the RENAPER database on hacking forums. > In a conversation earlier today, the hacker said they have a copy of the RENAPER data, contradicting the government’s official statement. > The individual proved their statement by providing the personal details, including the highly sensitive Trámite number, of an Argentinian citizen of our choosing.
    - otrahuevada 5y ago
      "Breach" in this case would imply this was an external attacker and not an inside job; from all the info that is available at the moment, what appears to have happened is some guy with continous access to an entirely legitimate system but malicious intent basically managed to craft his own dump of all the records. Based solely on the exposed field names those are not typical for government databases either, so this might have been reconstructed from a report or something. It also looks like the underlying permissions scheme is garbage, as there is literally no reason for this volume of data to be exportable by a random -even authorized!- user at the reported location.

ByThyGrace 5y ago

Source?

otrahuevada 5y ago
Nobleza obliga, latest news indicate the guy extricated a whole lot of records and it would appear authorities are nowhere near as close to unequivocally identifying him as was originally said.
otrahuevada 5y ago
https://www.lanacion.com.ar/sociedad/tras-un-confuso-episodio-desmienten-que-se-haya-hackeado-la-web-con-los-datos-de-todos-los-dni-del-nid13102021/ https://www.lanacion.com.ar/sociedad/tras-un-confuso-episodi... IT talked to Twitter and found a very narrow amount of people with the ability to do this.
- ByThyGrace 5y ago
  But that was before what the OP article is claiming. > However, The Record contacted the individual who was renting access to the RENAPER database on hacking forums. > In a conversation earlier today, the hacker said they have a copy of the RENAPER data, contradicting the government’s official statement. > The individual proved their statement by providing the personal details, including the highly sensitive Trámite number, of an Argentinian citizen of our choosing.
  - otrahuevada 5y ago
    "Breach" in this case would imply this was an external attacker and not an inside job; from all the info that is available at the moment, what appears to have happened is some guy with continous access to an entirely legitimate system but malicious intent basically managed to craft his own dump of all the records. Based solely on the exposed field names those are not typical for government databases either, so this might have been reconstructed from a report or something. It also looks like the underlying permissions scheme is garbage, as there is literally no reason for this volume of data to be exportable by a random -even authorized!- user at the reported location.