2 ms·
It's fascinating how these secrets are turning up in the press now. The article is (probably intentionally) vague about it's sources: they only say "Lighthouse
by nostrademons 1y ago
It's fascinating how these secrets are turning up in the press now. The article is (probably intentionally) vague about it's sources: they only say "Lighthouse found a vast archive of data on the deep web". But reading between the lines - does that imply that this surveillance company kept records on thousands of targets, and then left them in an open S3 bucket? Not the first time - the TM_Signal leak of upper-echelon U.S. government communications was also facilitated by an open S3 bucket that contained the message archives of everything that, say, the Secretary of Defense was messaging to the POTUS.
But it is highly ironic that these companies specialize in surveillance, tracking, and security, and then have a tendency to leave the data that they steal from others open to the Internet in a very amateurish security lapse that in turn leads to everyone stealing from them.
- dylan604 1y agoIs it possible the phreakers are so specialized they have no experience with cloud admin and just went with some copypasta from SO answers to get the boring shit done so they could get back to phreaking? Not everyone is an expert in cloud management. It is easy to bork something when you have no idea what you're doing because you don't want to be doing it. They could have also hired low level people to do something for them and just didn't spend enough to have it done correctly. There's many reasons for a very specialized group of smart people to do something utterly dumb and easy to avoid by people with other specialized skills. These people would probably look at you as silly and amateur for using SMS.
- deleted 1y ago[deleted]
- dontNotDoDrugs 1y ago[dead]
- mdani 1y agoIf I can make a guess, I'd say that the reporters engaged with them as a potential customer and demanded a sample of the data so they can indeed verify the accuracy. That's how they obtained the sample records, not via a s3 leak.
- r4nd_f 1y agoThe reporters published a YouTube video in which they went undercover to a security convention (ISS Europe), and requested information about how the product works, some usecases, etc. [1]. Although, I don't recall the presenter indicating anything about leaked sample data... [1] https://youtu.be/xfWyU5iXJ3I https://youtu.be/xfWyU5iXJ3I