6 ms·
> Edit 3: It's been 11 hours since the contact, about 1.37 billion entries have been pulled. DBeaver has crashed multiple times and we've left it running. It's
by jw1224 4y ago
> Edit 3: It's been 11 hours since the contact, about 1.37 billion entries have been pulled. DBeaver has crashed multiple times and we've left it running. It's "fetching rows" still. So I guess there's still more.
Considering the entries are from all over the world, it is unlikely we will sell or release this. Lastly, this data contains a lot of under aged people. Releasing such information, along with the data that is being stored without user's knowledge is so dire that we think it could spark something dangerous. Example: WeChat (Which is state owned) is within the same database as the TikTok DB (which claims not to give such information to their government).
Via https://breached.to/Thread-TikTok-WeChat-breach https://breached.to/Thread-TikTok-WeChat-breach
- nabakin 4y agoThey have this data and aren't going to sell/release it? Their provided sample doesn't seem to have any critical user data like passwords and phone numbers. All the user data is publicly available. Not to mention there are very few sample rows for 2 billion records. Not sure how to confirm the PayPal data. So far, I'm skeptical. Edit: Looks like Troy Hunt is digging through the sample right now and coming to similar conclusions https://twitter.com/troyhunt/status/1566565409939427328 https://twitter.com/troyhunt/status/1566565409939427328
- jw1224 4y agoI saw someone confirm passwords were hashed with bcrypt, but I can’t find it now. Nonetheless this is very interesting to see unfold.
- nabakin 4y agoI don't see passwords anywhere in the sample and Troy hasn't found any either so I doubt unless they can be pointed out
- tway223 4y agoThe data could be very likely legit. But they are not TikTok's user database. It is more like TikTok's ad/activity log for some customers. The passwords are for the logins from those customers if any. This also explains why WeChat data is in the same database. And if you are paying attention, the WeChat tables are more complex which makes sense because WeChat has a much longer history in business.
- nabakin 4y agoI don't know anything about what ad databases look like, but so far I haven't seen any evidence that the data is legit. Fake breaches happen every now and then so I wouldn't be surprised if this is one. The sample has very little data for such a comparatively large claim of 2 billion.
- tway223 4y agoTo be clear this is not a TikTok ad database. This is a tracking database from a third party who manages their clients' business with TikTok (and others). 2 billion ad views are not that big. You are likely looking at logs not the core tables.
- nabakin 4y agoHave you looked at the sample data yet?
- deleted 4y ago[deleted]
- zo1 4y agoI'm not sure I can take them seriously if they're "extracting" the data using DBeaver as opposed to some command-line utility that could probably do chunk/batching without spinning up a UI. If it's "crashed multiple times", that'd be a clue to use a more dedicated tool or process even. How many DBAs do you see starting up DBeaver or SSMS in order to do database backups or restores or any large-amount-of-data action?