2 ms·

How do you exfil data on 1.3M users by guessing a few passwords?

SketchySeaBeast 3y ago
Well, it seems they took advantage of a feature that indicates who you may be related to, so they must have guessed Genghis Khan's password.
- ganeshkrishnan 3y ago
  MONGOLIAN71682@HOTMAIL.com and password "SHADOW_RAIDERZ123" that was easy.
worksonmine 3y ago
They're not guessing passwords, they have a list of e-mails and passwords from other leaks and are hoping the users are using the same credentials on all their accounts. Since password managers aren't mainstream yet it works.
- nemacol 3y ago
  How do you hide authenticating 1.3+m unique accounts? A distributed system? A mess of VPN's? Or they don't hide it because the auth system is not checking for 1.3 million auth attemps?
  - juunpp 3y ago
    The latter. Forget tracking auth attempts: > The researcher added that he discovered another issue where someone could enter a 23andme profile ID, like the ones included in the leaked data set, into their URL and see someone’s profile.
    - jtriangle 3y ago
      Ah, so they were able to use a few accounts, then fuzzed the URLS to victory... Amazingly incompetent.
      - gwbas1c 3y ago
        I recently had to explain to a tech lead that you can "never trust the client," because any dedicated party can just curl around your UI and send whatever HTTP request they want.
        dylan604 3y ago
        I remember when this first occurred to me from me deciding that I didn't want to click download a series of things on some website where this was the intended use. I wrote a small shell script to curl it for me, and somewhere during the process of writing the script, I realized the true "power" of this. Ever since then, GET with search queries were protected against in everything I wrote from that point forward. Luckily, that was in the late 90s, so it's been a minute.
varenc 3y ago
Each valid login+password got the scrapers many many profiles. 23andMe has a feature that lets you see people you're related to and view their profiles. My guess is this feature had few rate limits and allowed you to view the profiles of people very distantly related. So perhaps with a couple thousand valid account logins you could eventually look up the profiles for 1.3M users.

Well, it seems they took advantage of a feature that indicates who you may be related to, so they must have guessed Genghis Khan's password.

ganeshkrishnan 3y ago
MONGOLIAN71682@HOTMAIL.com and password "SHADOW_RAIDERZ123" that was easy.

worksonmine 3y ago

They're not guessing passwords, they have a list of e-mails and passwords from other leaks and are hoping the users are using the same credentials on all their accounts. Since password managers aren't mainstream yet it works.

nemacol 3y ago
How do you hide authenticating 1.3+m unique accounts? A distributed system? A mess of VPN's? Or they don't hide it because the auth system is not checking for 1.3 million auth attemps?
- juunpp 3y ago
  The latter. Forget tracking auth attempts: > The researcher added that he discovered another issue where someone could enter a 23andme profile ID, like the ones included in the leaked data set, into their URL and see someone’s profile.
  - jtriangle 3y ago
    Ah, so they were able to use a few accounts, then fuzzed the URLS to victory... Amazingly incompetent.
    - gwbas1c 3y ago
      I recently had to explain to a tech lead that you can "never trust the client," because any dedicated party can just curl around your UI and send whatever HTTP request they want.
      - dylan604 3y ago
        I remember when this first occurred to me from me deciding that I didn't want to click download a series of things on some website where this was the intended use. I wrote a small shell script to curl it for me, and somewhere during the process of writing the script, I realized the true "power" of this. Ever since then, GET with search queries were protected against in everything I wrote from that point forward. Luckily, that was in the late 90s, so it's been a minute.

varenc 3y ago

Each valid login+password got the scrapers many many profiles. 23andMe has a feature that lets you see people you're related to and view their profiles. My guess is this feature had few rate limits and allowed you to view the profiles of people very distantly related. So perhaps with a couple thousand valid account logins you could eventually look up the profiles for 1.3M users.