4 ms·

I just gave a talk last week at 28C3 [1,2] about how all the personal details of Israeli citizens are up for grabs for anyone inclined enough to get them. I'm

by yuvadam 15y ago

I just gave a talk last week at 28C3 [1,2] about how all the personal details of Israeli citizens are up for grabs for anyone inclined enough to get them. I'm ashamed to see that we've learned nothing in the past 10 years. [1] - http://www.youtube.com/watch?v=ow7cvZOzp6w http://www.youtube.com/watch?v=ow7cvZOzp6w [2] - http://speakerdeck.com/u/yuvadm/p/28c3-data-mining-the-israeli-population-census http://speakerdeck.com/u/yuvadm/p/28c3-data-mining-the-israe... EDIT: Israeli media now claims that 400K is an exaggerated number, and the actual number of leaked CC is much smaller. EDIT2: I'm gonna go ahead and publish a mirror list [3] for the leaked data and for affected accounts by email [4]. I might be affected and I prefer to know if I am ASAP, even if this means the data leaks more, which it will anyway. [3] - http://pastebay.com/186092 http://pastebay.com/186092 [4] - http://pastebin.com/EnY7E0Hw http://pastebin.com/EnY7E0Hw

maayank 15y ago
what's the password of the rar inside the rar? the page referenced in the "readme" file is unavailable
- runn1ng 15y ago
  At least the file, hosted on hacked sites, called israeli.rar, is without a password.
  - maayank 15y ago
    I downloaded one of the files yuvadam posted (not sure if it's the same one there now - the post was edited) and it had a password protected rar in a rar
yahelc 15y ago
Where can I access the raw Israeli Census registry? I'm an non-resident Israeli citizen; I'm curious as to what it has on me (and if I can de-anonymize myself.)
tcas 15y ago
Does anybody know the legality of checking these lists? I'm always concerned that the access logs are sent to various authorities.
- pvarangot 15y ago
  I'm mostly certain no one could really give you a determining answer pertaining the legality of just browsing trough the list. From my own experience in this matters, security forces may eventually get the logs, but are then going to cross check them against other information before even asking an ISP about information pertaining the IP addresses they get. If I were worried that someone with powerful connections in security forces would be determined enough to get me into trouble, I would use Tor to open them from a securely wipeable VM and won't save them in my hard disk. I always click them from my PC... but in any case things get nasty I am currently working for a recognized information security company, and clicking this stuff is sort of part of my job.
etcet 15y ago
That was a great talk. It seemed like maybe you were a little unprepared for the questions at the end. Have you found someone (or more) who gave up their Israeli citizenship between the leak dates to test the questioners hypothesis? And though it is trivial, I'm definitely still curious about the most popular name. I couldn't parse the names you said. Are you going to release your tools? And then there's the big question: what do you do now that the data is out there? (and putting biometrics in the database isn't the answer)

by yuvadam 15y ago

maayank 15y ago

what's the password of the rar inside the rar? the page referenced in the "readme" file is unavailable

runn1ng 15y ago
At least the file, hosted on hacked sites, called israeli.rar, is without a password.
- maayank 15y ago
  I downloaded one of the files yuvadam posted (not sure if it's the same one there now - the post was edited) and it had a password protected rar in a rar

yahelc 15y ago

Where can I access the raw Israeli Census registry? I'm an non-resident Israeli citizen; I'm curious as to what it has on me (and if I can de-anonymize myself.)

tcas 15y ago

Does anybody know the legality of checking these lists? I'm always concerned that the access logs are sent to various authorities.

pvarangot 15y ago
I'm mostly certain no one could really give you a determining answer pertaining the legality of just browsing trough the list. From my own experience in this matters, security forces may eventually get the logs, but are then going to cross check them against other information before even asking an ISP about information pertaining the IP addresses they get. If I were worried that someone with powerful connections in security forces would be determined enough to get me into trouble, I would use Tor to open them from a securely wipeable VM and won't save them in my hard disk. I always click them from my PC... but in any case things get nasty I am currently working for a recognized information security company, and clicking this stuff is sort of part of my job.

etcet 15y ago

That was a great talk. It seemed like maybe you were a little unprepared for the questions at the end. Have you found someone (or more) who gave up their Israeli citizenship between the leak dates to test the questioners hypothesis? And though it is trivial, I'm definitely still curious about the most popular name. I couldn't parse the names you said. Are you going to release your tools? And then there's the big question: what do you do now that the data is out there? (and putting biometrics in the database isn't the answer)