7 ms·
"It is important to note that the exposed details do not constitute personally identifiable information, so it wouldn't be possible to use this data leak to tra
by StillBored 3y ago
"It is important to note that the exposed details do not constitute personally identifiable information, so it wouldn't be possible to use this data leak to track individuals unless the attacker knew the VIN (vehicle identification number) of their target's car."
Am I dumb or are they? If you know someones home address, then all you need is a geo lookup, and a filter which selects for cars parked near that address at 3AM over some time period. Which then gives you the VIN and the entire location history, right? Sure you might get more than one car if the someone lives in a city and uses street parking but its still going to reduce down to just a handful of cars which can then be cross referenced against place of work, relatives, etc.
And of course home address lookup can be made with any number of public databases with little more than a name and maybe some additional filtering (age, city, phone number, etc).
- asdfman123 3y ago> Am I dumb or are they I don't think you're wrong. I wonder what incentive bleepingcomputer has to make it seem not so bad.
- hammyhavoc 3y agoAvoiding getting rekt for defamation or a potentially libellous article.
- jstarfish 3y ago> its still going to reduce down to just a handful of cars which can then be cross referenced against place of work, relatives, etc. You are correct, but I can't imagine why anybody would go to that much trouble for a speculative answer. Your idea requires quite a bit of intelligence collection as well (relatives' addresses, addresses of known hangouts, etc. that you have to vet for accuracy). If you have a confirmed home or work address, just go to their home or work and take a picture of the target VIN through the windshield.
- detrites 3y agoThe scammer in the third world country folks may be at threat of this breach being exploited by does not have that ability. But they do have the internet, and further no meatspace means scams can be automated/scaled. Honestly, this seems very bad.
- WeylandYutani 3y agoI read an article today about someone who was called by his daughter to transfer money. It turned out to be an AI deepfake. The criminal networks are pretty sophisticated.
- conductr 3y agoI’d imagine the play here would be to search known people of prominence/public figures/clergy/politicians/etc and then review the logs for signs of I’ll doing. Most likely infidelity. Then blackmail ensues.
- SV_BubbleTime 3y ago>The criminal networks are pretty sophisticated. I’ve had to relay this on to people I train: It’s their job. It’s a business and it’s unreasonable for you to be better at aspects of it than they are. I think the slide is titled “Someone is going to be the goose, hopefully not you”.
- heresie-dabord 3y agoThe attacker has the advantage of knowing when and how the attack will occur. In nature, the predator has the fangs and claws.
- MichaelZuo 3y agoIt seems like the old Bell system with its monopoly rents was a feature then. Scams like this were impossible economically since even the cheapest long distance phone call rates were high enough to discourage scam call centres.
- hanoz 3y agoOkay, massive tangent, but it's been bugging me for a while and this has finally tipped me over the edge - why is it called personally identifiable information? That would be information that someone can personally identify surely? Shouldn't it be personally identifying information?
- TheSpiceIsLife 3y agoWords mean whatever people who use them intend them to mean.
- deleted 3y ago[deleted]
- ynx 3y agoBecause it's information that may be able to identify, but is not necessarily conclusively identifying of, a person.
- jvanderbot 3y agoI know the VIN on my wife's car. It'd be beyond a few boundaries to track her vehicle and internal cameras if, say, we split up at some point. You can read the VIN of neighbors and significant others pretty easy.
- maximinus_thrax 3y agoThe VIN on my Toyota is displayed right beneath the windshield. Anyone can walk up to my car and read it.
- SomaticPirate 3y agoVINwiki leverages this to form a community
- int_19h 3y agoVIN being visible through the windshield is a legal requirement in US.
- pnw 3y agoMore accurately, you can’t alter or remove the VIN. I don’t believe it has to be visible at all times. Some car owners obscure their VIN because of public sourced databases like Vinwiki. https://www.justice.gov/archives/jm/criminal-resource-manual-1359-motor-vehicle-theft-prevention-statutes-general-overview https://www.justice.gov/archives/jm/criminal-resource-manual...
- int_19h 3y agoI don't know if there's any liability for doing that, but some of those car owners occasionally find out that their car was seized by the cops to "investigate". This might depend on state law, too. E.g. in New York: "Members of the state police, any local police department or any peace officer acting pursuant to his special duties shall seize and confiscate a motor vehicle or trailer if any original identification number or special identification number is destroyed, removed, altered, defaced or so covered as to be effectually concealed."
- deleted 3y ago[deleted]
- batch12 3y agoIn my state you can look up the vehicle property tax records of anyone by name or VIN.
- JKCalhoun 3y agoAlso, just looking into the window of the car at the dashboard is usually all you need to get the VIN for a car.
- osigurdson 3y agoDefinitely agree. If I have a time series of geo location information, which visits point x,y once per day at 5:00pm I can probably conclude they probably live at this location. Of course it would all be incredibly boring to analyze. We can conclude that people live at a certain location, (dumbly for no good reason) drive to another one 5 times per week and go a few other places. Sure you might be able to find the odd person that is doing something weird or illegal but if you already know location x1, y1 contains bad guys might as well just go there and arrest them instead of creepily analyzing data that you know you shouldn’t have.
- 14 3y agoYes people can finally see if their spouse was cheating. Or learn when a target is typically not at home. Or what church they go to. You are not dumb. The statement in the article is dumb however.
- emodendroket 3y agoIf you commute from home to a job I think even with somewhat coarse information it’s easy to figure out who you are. The NYT did a story like this based on advertiser data.
- edejong 3y agoIf an IP-address is PII, then so should be a VIN and chassis number.
- albert_e 3y agoAlso, among these 2M customers there are surely a few high-profile ones that have implications for politics/crime/forensics/espionage ?
- yoaviram 3y agoYes, all location tracking data is personaly identifiable. Given any dataset like this it is trivial to pick any entry and trace where is home and where is work thus de-anonymizing it. Conversely given any home or work addreas it's trivial to find all other related entries for the individual.