5 ms·

It's time to dump the full 75,000 names, addresses, CCs and md5 hashed passwords to every customer that has ever paid Stratfor. We almost have sympathy fo

It's time to dump the full 75,000 names, addresses, CCs and md5 hashed passwords to every customer that has ever paid Stratfor. We almost have sympathy for those poor DHS employees and australian billionaires who had their bank accounts looted by the lulz Wow. Apologies for venting, but this is fucking ludicrous. I am a middle-class mid-20s programmer who purchased a Stratfor subscription because their material is incredibly well-researched and about a million times more enlightening than your average CNN article. And now I have to cancel my credit card and deal with fraud services. Thanks a ton, Anonymous. Congratulations, you've exposed the personal details of the rich bankers and military analysts that recognized Stratfor as the intelligent news service it is. And in the process, you've managed to completely alienate the rest of the Stratfor community, members of the "99%", who care enough about understanding global politics that they were willing to give up a portion of their hard-earned paychecks to become better-informed. Something tells me it won't be worth it. I just can't understand it. These guys are either agent provocateurs, or complete morons.

robryan 15y ago
I'd be blaming the company more than those releasing it. If these guys can how are you to know if someone hasn't come across the db silently? At least this way there is some warning.
- Mithrandir 15y ago
  If the person/people who did this just wanted to expose security flaws, releasing a DB filled with innocent people's personal information is really over the top.
- dandelany 15y ago
  You're kidding, right? The people releasing it are presumably the ones who stole it in the first place. In a bank robbery, do you blame the manufacturer of the safe that was cracked? Or home invasions on the alarm system that failed to catch the thieves? No, the perpetrators of the crime are at fault. Even if I agreed with you on who was at fault here (which I clearly don't), do you think any significant number of victims of this leak will honestly blame Stratfor more than they blame the hackers behind the attack? If not, the point I made above still stands: Anonymous has alienated anyone who has ever paid for a Stratfor membership. Which is quite a diverse, and likely intelligent, group of people.
  - joshAg 15y ago
    To continue using your metaphor of a real world safe: I also blame the manufacturer of the safe because the safe was not as secure as they claimed and because it's not like securing things correctly is an unsolved problem or even just np-hard. information can be stolen more than once, and if it can be stolen by these people, then you can damn well bet that it can be stolen by people who might not want to let you know that they took the information. how long has that data been sitting there unsecured? how many times has that data been stolen through unauthorized access? is it even reasonable to ask to be able to run a pen test against anyone who wants my information, so that i can actually know my data is secure?
    - sambeau 15y ago
      In what way is this any different than someone picking the lock to the front door of your house, smashing things up with a baseball bat, carrying your valuables out to the street and then leaving you a note saying "you should have bought a better lock"? I'd far rather live in a world where we didn't need the lock in the first place.
      - joshAg 15y ago
        it's not. the issue (for me) is how valuable the valuables are and how much security is protecting the valuables. There's a good reason why there's a major difference between the security protecting the mona lisa and the security protecting my car, even though both are secured and both are valuable. when people under-secure assests that they claim to be securing, especially when those assets aren't theirs, I think they're partially to blame when the assets are eventually stolen. I'm blaming stratfor because i think they did a shitty job securing their customers' info, especially since the info belonged to paying customers.
    - nl 15y ago
      not like securing things correctly is an unsolved problem or even just np-hard. Given that Google, RSA and Intel have all been penetrated (that we know about), and all have a passing knowledge of security I think this has turned out to be harder than you seem to think it is.
- TheCowboy 15y ago
  My information was released without warning. They dumped everything days ago. They could have informed Stratfor about the vulnerability, or even waited to give people a chance to cancel their cards. Stratfor probably is to blame for lax security. But the hackers are as much to blame for violating my privacy. I think Dan's point about alienating the wrong people by picking the wrong battles is the most important. Treating innocent people as 'collateral damage' is dehumanizing. Edit for zobzu: They posted everything days ago. My post contains none of the implied strawmen you assume. I believe we're on the same side, so I'm not sure why you are flaming me. You didn't address anything I said in my post. Please review the guidelines so we can keep the discussion civil and useful: http://ycombinator.com/newsguidelines.html http://ycombinator.com/newsguidelines.html
  - zobzu 15y ago
    Actually they warned people a few days ago. But yeah, I agree with you, you're much better off when people hack those accounts, steal the money and not do tell anybody, so they can keep stealing from it from time to time, and since you don't know about it, you're secure! Plus I guess it's only ok to see collateral damage when it's poor people getting killed by the army in other countries, on TV. Cause yeah it's TV. Feel sad for 2 min and go grab a coffee. Heck in this war all you have to do is switch credit card. Not switch a leg for a plastic one. Oh I know this is not going to be popular.
    - tomjen3 15y ago
      Nice troll.
  - robryan 15y ago
    Yeah I agree they haven't take the best form of action which would be to email everyone in the dataset and give them a chance to change their credit card without giving out the whole set. At the same time though this is a better outcome than the information being silently sold.
majelix 15y ago
> And now I have to cancel my credit card and deal with fraud services. Thanks a ton, Anonymous. Just an FYI -- you probably already know this -- but Stratfor is offering credit protection. Link: http://www.forbes.com/sites/alexknapp/2011/12/30/stratfor-offers-customers-identity-theft-protection-after-hack/ http://www.forbes.com/sites/alexknapp/2011/12/30/stratfor-of...
JoshTriplett 15y ago
At least according to http://pastebin.com/8yrwyNkt http://pastebin.com/8yrwyNkt , Anonymous didn't do this. They claim that they like Stratfor, and wouldn't attack it. (To the extent Anonymous can coherently claim anything, but it makes sense.)
- zobzu 15y ago
  Anonymous doesn't really have centralized power though. So technically it can still be people "from Anonymous". It can even be just a few who decided to say "its not us!". In fact, it can be anyone. It could even be US agents. Seriously.
- grandalf 15y ago
  I think this was likely a US Government backed attack to find out who the whistleblowers giving tips to Stratfor are. Anonymous provides perfect cover for such operations.
  - jonhendry 15y ago
    And the government would post it... why? As opposed to just keeping the information to themselves, so the leakers wouldn't know they were discovered? The 'govmint did it' theory makes no sense.
    - grandalf 15y ago
      I don't think it makes sense, but I think it makes more sense than Anonymous doing it. Note that Obama recently declared war on whistleblowers, and Stratfor's entire operation is based on George Friedman's cozy relationships with a lot of top officials who tell him things off the record. Obama's promises to end the wars go directly against Friedman's predictions, and anyone who trusts Friedman's judgment will realize that Obama is lying about pulling out of Afganistan and Iraq. The attack on Stratfor could be intended to silence any insiders who may have planned to debunk the idea that the US will leave either of the occupied countries any time soon.
    - ge0rg 15y ago
russellallen 15y ago
As someone who has also just cancelled my credit card because of these morons, I feel your pain.
vl 15y ago
On the bright side I haven't heard about Stratfor before and now I'm considering purchasing an account because so many people on HN give it positive reviews.
- Symmetry 15y ago
  I had an account for a while. I eventually stopped because its much better than TV news, it was only a bit better than The Economist.
  - grandalf 15y ago
    It depends on what's going on in the world. In some cases Stratfor is way better b/c of the historical analysis offered -- most periodicals operate on the assumption that the reader is fully versed in all the background details. Stratfor has a section where you can read up on its full historical analysis of every country, region, etc.
justsee 15y ago
Stratfor is a geopolitical analysis company which helps shape a world-view for decision-makers in the existing power structure. What don't you understand about their infrastructure being a completely valid target? The question of identities and motives of the actors is certainly interesting, but there are a bunch of plausible theories: * WikiLeaks sympathetic individuals who subscribe to the Assange theory of conspiracy (see: http://estaticos.elmundo.es/documentos/2010/12/01/conspiracies.pdf http://estaticos.elmundo.es/documentos/2010/12/01/conspiraci...). If you grok this, it's a textbook play in the 'throttling weighted conspiracies' game, ain't it? * Agent provocatuers, as you already mention. That you'd pre-announce a hack like this days before releasing credit card numbers makes absolutely no sense from a Project Mayhem, anarchist perspective, does it? You're giving everyone enough time to cancel cards and minimize mayhem but still maximize reporting of the reckless, misguided behavior of hackers. It only seems to benefit the establishment over the longer-term with a public release like this. If you really care about undermining the system you'd quietly analyze the data and build up an under-the-radar picture of the establishement network to act on, no? * morons. They got lucky with a target, and care less about gifting SOPA supporters in Washington a delightful Christmas present. I'm not clever enough to have a view either way, but getting irate based on superficial internet evidence as to the identities and motives of players is not conducive to good health in 2011.
- anamax 15y ago
  > Stratfor is a geopolitical analysis company which helps shape a world-view for decision-makers in the existing power structure. What don't you understand about their infrastructure being a completely valid target? Then surely the New York Times and Washington Post are as well.
  - justsee 15y ago
    Well, of course? As is The Economist and other publications that are part of the existing power structure. It is possible to make these pedestrian observations without supporting the people who oppose the power structure. I would also say that in the context of the Cold War, Radio Free Europe HQ would be a "completely valid target". It doesn't mean I actually a) support such an attack, or b) am a communist.

robryan 15y ago

I'd be blaming the company more than those releasing it. If these guys can how are you to know if someone hasn't come across the db silently? At least this way there is some warning.

Mithrandir 15y ago
If the person/people who did this just wanted to expose security flaws, releasing a DB filled with innocent people's personal information is really over the top.
dandelany 15y ago
You're kidding, right? The people releasing it are presumably the ones who stole it in the first place. In a bank robbery, do you blame the manufacturer of the safe that was cracked? Or home invasions on the alarm system that failed to catch the thieves? No, the perpetrators of the crime are at fault. Even if I agreed with you on who was at fault here (which I clearly don't), do you think any significant number of victims of this leak will honestly blame Stratfor more than they blame the hackers behind the attack? If not, the point I made above still stands: Anonymous has alienated anyone who has ever paid for a Stratfor membership. Which is quite a diverse, and likely intelligent, group of people.
- joshAg 15y ago
  To continue using your metaphor of a real world safe: I also blame the manufacturer of the safe because the safe was not as secure as they claimed and because it's not like securing things correctly is an unsolved problem or even just np-hard. information can be stolen more than once, and if it can be stolen by these people, then you can damn well bet that it can be stolen by people who might not want to let you know that they took the information. how long has that data been sitting there unsecured? how many times has that data been stolen through unauthorized access? is it even reasonable to ask to be able to run a pen test against anyone who wants my information, so that i can actually know my data is secure?
  - sambeau 15y ago
    In what way is this any different than someone picking the lock to the front door of your house, smashing things up with a baseball bat, carrying your valuables out to the street and then leaving you a note saying "you should have bought a better lock"? I'd far rather live in a world where we didn't need the lock in the first place.
    - joshAg 15y ago
      it's not. the issue (for me) is how valuable the valuables are and how much security is protecting the valuables. There's a good reason why there's a major difference between the security protecting the mona lisa and the security protecting my car, even though both are secured and both are valuable. when people under-secure assests that they claim to be securing, especially when those assets aren't theirs, I think they're partially to blame when the assets are eventually stolen. I'm blaming stratfor because i think they did a shitty job securing their customers' info, especially since the info belonged to paying customers.
  - nl 15y ago
    not like securing things correctly is an unsolved problem or even just np-hard. Given that Google, RSA and Intel have all been penetrated (that we know about), and all have a passing knowledge of security I think this has turned out to be harder than you seem to think it is.
TheCowboy 15y ago
My information was released without warning. They dumped everything days ago. They could have informed Stratfor about the vulnerability, or even waited to give people a chance to cancel their cards. Stratfor probably is to blame for lax security. But the hackers are as much to blame for violating my privacy. I think Dan's point about alienating the wrong people by picking the wrong battles is the most important. Treating innocent people as 'collateral damage' is dehumanizing. Edit for zobzu: They posted everything days ago. My post contains none of the implied strawmen you assume. I believe we're on the same side, so I'm not sure why you are flaming me. You didn't address anything I said in my post. Please review the guidelines so we can keep the discussion civil and useful: http://ycombinator.com/newsguidelines.html http://ycombinator.com/newsguidelines.html
- zobzu 15y ago
  Actually they warned people a few days ago. But yeah, I agree with you, you're much better off when people hack those accounts, steal the money and not do tell anybody, so they can keep stealing from it from time to time, and since you don't know about it, you're secure! Plus I guess it's only ok to see collateral damage when it's poor people getting killed by the army in other countries, on TV. Cause yeah it's TV. Feel sad for 2 min and go grab a coffee. Heck in this war all you have to do is switch credit card. Not switch a leg for a plastic one. Oh I know this is not going to be popular.
  - tomjen3 15y ago
    Nice troll.
- robryan 15y ago
  Yeah I agree they haven't take the best form of action which would be to email everyone in the dataset and give them a chance to change their credit card without giving out the whole set. At the same time though this is a better outcome than the information being silently sold.

majelix 15y ago

> And now I have to cancel my credit card and deal with fraud services. Thanks a ton, Anonymous. Just an FYI -- you probably already know this -- but Stratfor is offering credit protection. Link: http://www.forbes.com/sites/alexknapp/2011/12/30/stratfor-offers-customers-identity-theft-protection-after-hack/ http://www.forbes.com/sites/alexknapp/2011/12/30/stratfor-of...

JoshTriplett 15y ago

At least according to http://pastebin.com/8yrwyNkt http://pastebin.com/8yrwyNkt , Anonymous didn't do this. They claim that they like Stratfor, and wouldn't attack it. (To the extent Anonymous can coherently claim anything, but it makes sense.)

zobzu 15y ago
Anonymous doesn't really have centralized power though. So technically it can still be people "from Anonymous". It can even be just a few who decided to say "its not us!". In fact, it can be anyone. It could even be US agents. Seriously.
grandalf 15y ago
I think this was likely a US Government backed attack to find out who the whistleblowers giving tips to Stratfor are. Anonymous provides perfect cover for such operations.
- jonhendry 15y ago
  And the government would post it... why? As opposed to just keeping the information to themselves, so the leakers wouldn't know they were discovered? The 'govmint did it' theory makes no sense.
  - grandalf 15y ago
    I don't think it makes sense, but I think it makes more sense than Anonymous doing it. Note that Obama recently declared war on whistleblowers, and Stratfor's entire operation is based on George Friedman's cozy relationships with a lot of top officials who tell him things off the record. Obama's promises to end the wars go directly against Friedman's predictions, and anyone who trusts Friedman's judgment will realize that Obama is lying about pulling out of Afganistan and Iraq. The attack on Stratfor could be intended to silence any insiders who may have planned to debunk the idea that the US will leave either of the occupied countries any time soon.
  - ge0rg 15y ago

russellallen 15y ago

As someone who has also just cancelled my credit card because of these morons, I feel your pain.

vl 15y ago

On the bright side I haven't heard about Stratfor before and now I'm considering purchasing an account because so many people on HN give it positive reviews.

Symmetry 15y ago
I had an account for a while. I eventually stopped because its much better than TV news, it was only a bit better than The Economist.
- grandalf 15y ago
  It depends on what's going on in the world. In some cases Stratfor is way better b/c of the historical analysis offered -- most periodicals operate on the assumption that the reader is fully versed in all the background details. Stratfor has a section where you can read up on its full historical analysis of every country, region, etc.

justsee 15y ago

Stratfor is a geopolitical analysis company which helps shape a world-view for decision-makers in the existing power structure. What don't you understand about their infrastructure being a completely valid target? The question of identities and motives of the actors is certainly interesting, but there are a bunch of plausible theories: * WikiLeaks sympathetic individuals who subscribe to the Assange theory of conspiracy (see: http://estaticos.elmundo.es/documentos/2010/12/01/conspiracies.pdf http://estaticos.elmundo.es/documentos/2010/12/01/conspiraci...). If you grok this, it's a textbook play in the 'throttling weighted conspiracies' game, ain't it? * Agent provocatuers, as you already mention. That you'd pre-announce a hack like this days before releasing credit card numbers makes absolutely no sense from a Project Mayhem, anarchist perspective, does it? You're giving everyone enough time to cancel cards and minimize mayhem but still maximize reporting of the reckless, misguided behavior of hackers. It only seems to benefit the establishment over the longer-term with a public release like this. If you really care about undermining the system you'd quietly analyze the data and build up an under-the-radar picture of the establishement network to act on, no? * morons. They got lucky with a target, and care less about gifting SOPA supporters in Washington a delightful Christmas present. I'm not clever enough to have a view either way, but getting irate based on superficial internet evidence as to the identities and motives of players is not conducive to good health in 2011.

anamax 15y ago
> Stratfor is a geopolitical analysis company which helps shape a world-view for decision-makers in the existing power structure. What don't you understand about their infrastructure being a completely valid target? Then surely the New York Times and Washington Post are as well.
- justsee 15y ago
  Well, of course? As is The Economist and other publications that are part of the existing power structure. It is possible to make these pedestrian observations without supporting the people who oppose the power structure. I would also say that in the context of the Cold War, Radio Free Europe HQ would be a "completely valid target". It doesn't mean I actually a) support such an attack, or b) am a communist.