5 ms·
> “The breach consisted of unauthorized access to the LetMeSpy website’s database, downloading and at the same time deleting data from the website by the author
by yodon 3y ago
> “The breach consisted of unauthorized access to the LetMeSpy website’s database, downloading and at the same time deleting data from the website by the author of the attack,” the notice reads.
"Good guys" don't usually download large amounts of potentially incriminating information about the people they are supposedly "saving".
- capableweb 3y ago? Are you saying that people who shut down companies that creates spyware are not the good guys? I don't really care if it happens by legal means or by blackhat ops like this, but feels like it's hard to argue it's immoral to shut them down, even if you copy and share all their private data while doing so.
- zoklet-enjoyer 3y agoOf course it's immoral. How can you argue dumping private data isn't?
- DougN7 3y agoIs it private data of criminals and thieves? If that’s the case it’s hard to feel sympathy.
- pxc 3y agoIt's private data about the victims of criminals and thieves.
- zoklet-enjoyer 3y agoNope. It's data from their victims
- swarnie 3y agoI struggle to differentiate it from investigative journalism. > You've given data to Company X, they aren't looking after it correctly.
- gopher_space 3y agoIn what way is this data private? Wasn’t that point crossed on collection from private individuals? This seems like a technical consideration more than an avenue for judgement.
- zoklet-enjoyer 3y agoYeah, it was private data that was stolen and then released publicly by someone who stole the stolen data. Would it be ok with you if I installed malware on your phone, stole your private messages, and then those messages were stolen from me and released for the world to see? That's what happened.
- gopher_space 3y agoFrom an individual perspective it doesn’t fundamentally matter who has my data. It’s either within my control or it isn’t. This is just a status update. Horse still out of barn.
- tetha 3y agoHm. There are several reasons for this I can come up assuming good intent. You could shuffle this data towards security researchers or the police to identify and notify affected people. It could also contain information which enables or simplifies secondary attacks against the service. Or it could contain data allowing to attack other related groups. All of these are too big to decide and analyze in the moment the attack goes active and visible in the infrastructure. You'd just dump it and then wipe it and figure it out later. It's certainly a sensitive dataset and it doesn't feel any kind of "good" for literally anyone to have it. But to me it's not slam-dunk just evil.
- marcus0x62 3y agoI'm not saying this is morally right or anything, but the other reason is to cause the spyware company's current and potential clients to lose faith in their reliability as a partner. It's one thing to pop one of these companies and dump their tooling -- they'll just get a new set of 0-days if that's part of their MO and keep selling the tools, maybe changing them a bit to evade AV detection if that's a concern. It is another thing entirely for their client list and the identities of their client's targets to get leaked. That's the sort of thing potential customers of these companies want to avoid at all costs. All that said, I think they could have achieved much the same effect by just dumping their client list and maybe quietly (and privately) notifying the victims.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]