10 ms·
Hacker wipes Romania's land registry database
- ExoticPearTree 4mo ago[flagged]
- nananana9 4mo agoShooting people in the head because they're not wearing a helmet is still a crime.
- ajsnigrutin 4mo agoBut you still get fined if you don't wear a helmet In an ideal world, even before you crash your motorcycle and hit your head somewhere, forcing you to start wearing it
- busterarm 4mo agoI'll never forget this one video. A cyclist riding with a helmet on was doing everything proper -- helmeted, obeying traffic laws, riding in the proper part of the road... Then a city bus passes them far too close. The passenger side mirror of the bus catches the rider's helmet and speeds off...carrying the cyclist off of their bike and dangling by their helmet at speed...
- dgellow 4mo agoI will never forget your description of the video :(
- alt227 4mo agoFreak accidents occur everywhere. Helmets save a lot more lives then causee deaths overall.
- ajsnigrutin 3mo agoYep, same with seatbelts... a lot of broken ribs, etc. and people complaining. If you crashed so hard, the belt broke your ribs, without the seatbelt, you'd be dead right now, head first through the windshield. I mean sure, you wouldn't be complaining about broken ribs, but yeah...
- busterarm 3mo agoI wasn't even complaining about either. I use both. I just think it's pointless to bitch about other people gambling with their own lives. If someone wants to win a Darwin award, let them. Because you can just as easily do all the right things and get taken out regardless.
- InsideOutSanta 4mo agoWhat's even funnier is getting upset about people not wearing helmets the second you hear about an accident, with no idea whether people did or did not wear helmets. All the article says is that "the hacker entered using valid credentials." There's no information about how they got the credentials.
- kqp 4mo agoVictim blaming is a form of self soothing. If you can get yourself to believe they deserved it, then you avoid feeling that the world is dangerous and you might get hurt too.
- dredmorbius 3mo agoThere's victim-blaming, and there's gross incompetence. My own problem with the top-level comment wasn't that it claimed fault on the part of the victims, it's that it didn't substantiate why that claim of fault was applicable in this case. Multiple use of weak passwords in a critical system isn't acceptable in 2026 (nor has it been for many decades), and yet there's credible evidence (as my own follow-ups in this subthread and my own top-level comments should indicate) that the victims here did contribute significantly to their own harm. For that they should be found accountable. Hosting inherently insecure data systems is gross negligence, quite arguably criminal.
- ExoticPearTree 4mo agoYou can downvote all you want, but there were actual admin accounts with the password P@ssw0rd. So in your view incompetence should just be ignored because blaming people for lack of common sense will hurt their feelings?
- dredmorbius 4mo agoIn this specific case? Documented? If so, point to references. Otherwise your original comment reads as unsubstantive. Tropes and cliches may have value because they're often true, but if true, in this case, then share that fact and not the trope alone.
- ExoticPearTree 4mo agohttps://spear.cx/Thread-Selling-RO-Thy-arss-shall-be-spanked-Romania-ANCPI https://spear.cx/Thread-Selling-RO-Thy-arss-shall-be-spanked... and click on the links in the article - they are screenshots from inside the system. Like this one for example: https://drive.google.com/file/d/1iZc93XfViOk7izusgIG1ni7KmsxVtPFk/view https://drive.google.com/file/d/1iZc93XfViOk7izusgIG1ni7Kmsx... To answer your question: yes, in this specific case, documented.
- dredmorbius 4mo agoSincerely, thank you. Your initial comment would have been far more substantial, and probably much better received, with these additions.
- nananana9 3mo agoNope. I said that a crime is still a crime, even if the target should know better, in a response to a now flagged comment that was arguing that the criminals were in the right. You somehow twisted that into "incompetence should just be ignored because blaming people for lack of common sense will hurt their feelings" which is such a ridiculous strawman that you're either arguing in bad faith or you've completely lost all ability to do even the most basic of reading and reasoning.
- hnlmorg 4mo agoDo you know that this system was making fundamental security faux pas or are you assuming the reductive argument where determined enough hackers couldn’t break any system with built and maintained by diligent engineers?
- mihaic 4mo agoRomanian here. There really were admin accounts with the password Passw0rd, created so that some incompetent political apointees could browse the data.
- BobBagwill 4mo agoGee, I didn't know Moscul is helping the Romanian government too! :-)
- vkou 4mo agoI'm a quarter Romanian on my step-mother's side, and I too can confirm that the password was Passw0rd.
- ExoticPearTree 4mo ago> Do you know that this system was making fundamental security faux pas or are you assuming the reductive argument where determined enough hackers couldn’t break any system with built and maintained by diligent engineers? You should take a closer look at the screenshots posted by the hacker: entire systems and network devices with the password P@ssw0rd for the admin user. Now you tell me.
- dredmorbius 4mo agoYour comment could have been shortened to: Take a closer look at the screenshots posted by the hacker: entire systems and network devices with the password P@ssw0rd for the admin user. Linking those would be bonus. <https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20swipes&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...>
- otabdeveloper4 4mo agoIf you're using passwords as an authentication methods then you've already lost.
- Squarex 4mo agoThe same thing happened to Slovakia not that long ago.
- boringg 4mo agohow did they solve it?
- jankubica 4mo agoit took months to go back fully online. they also had usable backups (so they used those for the data), but the infrastructure had so many vulnerabilities that they had to fix it first, hence the delay
- andrewshadura 4mo agoRestored from very old backups and paper documents.
- N19PEDL2 4mo ago"Very old" could mean that they were not up to date. What did they do when the backups didn't match the actual situation at the time of the breach?
- wang_li 4mo agoProperty is not fluid and doesn't change hands very often. Sure, in a large enough market lots of activity happens every day, but any given property is only involved in a transaction once a decade. You can have very old backups and still capture the state of the market to 99%+. Any recent activity will have brokers, buyers, and sellers, who all have current copies of their activity. Also, this sort of event should result in some hackers being found and jailed for life as well as their families being bankrupted permanently. Or, if they are being protected by their government, this should be considered an act of war and an appropriate military response should be delivered.
- deleted 4mo ago
- skinfaxi 4mo ago> Since the hack, officials restored their website and posted a message announcing they are rebuilding the agency's entire network from scratch. Even if the hacker claims they deleted backups, the agency appears to have had an offline copy, otherwise things would have gotten really messy over the coming months in Romania. So it seems not all has been lost. I was worried about the societal implications of being unable to prove land ownership but it seems that may be avoided.
- chasd00 4mo agonow they get to do a greenfield implementation too! /joking, i'm sure this is not a happy time for whoever is trying to rebuild everything
- nicman23 4mo agoi think it is a very happy time charging whatever per hour you want
- deleted 4mo ago[deleted]
- ddoolin 4mo agoI wonder why the say "appears to have had," is that an assumption or was it stated somewhere? Without an offline backup, it would indeed be a very serious problem, more than it already is.
- deleted 4mo ago[deleted]
- hughw 4mo agoWas hoping it was a political act in favor of land reform or against owning property.
- subsaharancoder 4mo ago"you will own nothing and be happy"..no thank you!
- jplrssn 4mo agoI always thought the “you will own nothing” expression referred to a Gini coefficient of 1, not 0. The intent of abolishing private property would presumably be the latter.
- rexpop 4mo agoDepends on if you're scaremongering about Capitalists or Commies.
- jplrssn 4mo agoThat’s true. But in a world with monthly toothbrush subscriptions one of those end states feels much closer than the other.
- inigyou 4mo agoCapitalists say "you will own nothing" and want a Gini coefficient of 1. Communists don't say "you will own nothing" - they say "abolish private property" and refer to a Gini coefficient of 0.
- arisAlexis 4mo agoWe will see a lot of those with open source Mythos equivalent models.
- gregoriol 4mo agoThe new world will be: move fast and trust AIs
- LelouBil 4mo agoI mean: > Sources told Risky Business that the hacker entered using valid credentials This is social engineering or corruption.
- rcostin2k2 4mo ago... and an incorrect password policy and poor access control. Usually, in these institutions, if STS is not responsible, there are third-party companies, usually proxies, that are responsible for managing the firewall and accessing the data. The lack of procedures and lack of supervision from the authority, combined with the delay from the service providers, leads to a situation where everyone does backups as they think is best. That's why it takes so long now, because STS restores data from different formats, from different places, made at different times
- sph 4mo ago“This is good for AI”
- deleted 4mo ago[deleted]
- RandomLensman 4mo agoWhat's wrong with an old fashioned paper registry then?
- dizhn 4mo agoI am pretty sure they have that too.
- RandomLensman 4mo agoSo which one is the ground truth if there is a difference between them?
- foarteistescu 4mo agoThe paper rules supreme in Romanian bureaucracy.
- Narishma 4mo agoAs it should.
- drdrey 4mo agofires? floods? documents getting lost/misplaced/stolen/destroyed?
- RandomLensman 4mo agoSeems to be rather sturdy in my experience. Would we even be able to read an electronic record after 100 or 200 years of storage? Old piece of paper is quite accessible.
- AndroTux 4mo ago> Old piece of paper is quite accessible If stored properly. So are digital copies, though. If stored properly.
- c7b 4mo ago[flagged]
- bilekas 4mo agoI would be less comfortable with my land registry tied to a blockchain, as soon as I lose it (who is much more likely to) it's impossible to get my land back. What's wrong with paper records backup up a digital record and audit trail. This all seems like a solution for a non-problem to me.
- c7b 4mo agoA blockchain isn't stopping you from doing any of those things, if anything it's facilitating different backup models by different parties. A paper record is so much more susceptible to various kinds of risks, adversarial and otherwise. I recommend to look past the hype or hate at the technology. A blockchain is the logical extreme of where you end up when you think about how to sync backups, and you recognize that it comes with certain mathematical limitations on how much disruption you can handle.
- margalabargala 4mo ago> A blockchain is the logical extreme of where you end up when you think about how to sync backups It's not. Blockchains are only eventually consistent among nodes. They're designed for synced backups among adversarial peers. There's no reason for a government agency to use one internally. There are better ways to sync backups when the people with access to make updates are also authorized to do so.
- c7b 4mo agoInternally, you don't need it, agreed. But that is centralization risk exemplified in this incident. Which isn't necessary. Every notary could be a node. It would be a lot more resilient, and it would look a lot like a blockchain (not necessarily with a crypto currency though) if you do it properly.
- alexpotato 4mo agoRomanian friends have told me that this is really due to corruption. Specifically: - government gives IT/data contracts to cronies - cronies don't actually do any real security work to protect the data - things like this happen
- dmos62 4mo agoSame thing is rampant in other Eastern European countries as well. Tips on how to address this for those of us that are publicly minded?
- inigyou 4mo agoI'd say form an IT firm and bid on government contracts and do honest work, but we all know how that goes in reality. Honest workers don't get the contracts. You can still try, though.
- reinitctxoffset 4mo agoI'm sure it's obvious to anyone living in a corrupt/oppressive regime, but in case it's not obvious to everyone. Corruption and oppression are signaling and coordination problems. The illegitimate sovereign is exploiting informational assymmetry: they know your neighbors are just as angry as you, they know it because all the walls have ears. They need to prevent you and your neighbors all knowing it at the same time. Your best play is to find some signal, something difficult to censure, hard for the goons to pick out in a crowd but legible to your neighbors. If you all knew that the first guy to shove back when the cop shoves you is going to be followed by a swarm of guys? Very easy to find the first guy in that case. This is why shit like extremely high gas prices scares the shit out of illegitimate sovereigns: they're the ones posting pure data about why everyone should be that angry right now.
- inigyou 4mo agoAre high prices really that bad for the sovereign? Most of them seem to just blame some scapegoat and it works. Remember how Germany responded to hyperinflation?
- cbg0 4mo agoAn update from the land registry (the truthfulness of this remains to be seen depending on how fast this comes back online): ANCPI announced that it had begun migrating its applications to Romania’s Government Cloud. The operation is being coordinated by the Special Telecommunications Service (STS) and is expected to be completed on Wednesday, July 22. After the migration, authorized institutions will inspect the applications and data and prepare a report on the condition of the systems and any additional measures required. Based on that report, ANCPI will announce an estimated date for restoring its applications. Services will be brought back online gradually, according to operational priorities. ANCPI says it is rebuilding its database from backup copies stored in several locations. The agency rejected reports suggesting that it did not have sufficient backups, explaining that the use of multiple storage locations provides redundancy and allows data to be restored after cybersecurity incidents. According to ANCPI, affected systems must remain isolated until every identified vulnerability has been addressed. Although shutting down the services has caused temporary inconvenience, the agency says the measure was necessary to protect the data and ensure that operations restart safely and reliably. The restoration of the IT infrastructure is described as a complex process being conducted in cooperation with the relevant authorities. ANCPI has also confirmed that a criminal investigation is underway, but no official conclusions can yet be released. The agency warned that claims circulating publicly about the alleged consequences of the attack are not based on official information and do not reflect the current state of the investigation.
- curiousObject 4mo ago>it had begun migrating its applications to Romania’s Government Cloud This proclamation, coming from a governmental organization, makes me afraid they are doomed. Effectively they are saying they are fixing the mistake by repeating it. What they should do is admit fault. Freeze the system. Get independent expert help. Best wishes, recent Romanian land buyers and sellers Edit: thank you @cbg0 for giving us this update
- phoronixrly 4mo agoThey are getting expert help. I expect that the agency maintained their own local deployment on infra administered by its own employees. Now they are migrating to the central 'government(-maintained) cloud'. At the same time they are working with authorities. Not everything needs an external consultant.
- deleted 4mo ago[deleted]
- 21asdffdsa12 4mo agoImagine if the hacker was more clever and started writing plausible nonsense into the database, corrupting the backups.
- jopsen 4mo agoSelling properties you don't own, ideally land owned by government..
- PunchTornado 4mo agoideally properties of corrupt politicians
- deleted 4mo ago[deleted]
- pelagicAustral 4mo agoThis is Government, "plausible nonsense" is already being inserted into every single table on a daily basis.
- 21asdffdsa12 4mo agoYou know- that this sentiment, this "decomplexify" society at all cost, because the monetary burden of taxes steals my lifeblood has produced several catastrophes in the past? Pol Pots Khemer Rouge come to mind. The "abandon free trade lets go full bio" of the Lebensraum was in the same spirit. Arguing against all societal complexity is asking for a genocide, how unpersonal and not hate-driven it seems on the surface level. Your sentiment makes sense on a "We deserve a optimal ratio of taxes vs outcome" solution.
- roncesvalles 4mo agoImagine all the times this has already occurred somewhere in the world.
- javawizard 4mo ago> HuggingFace got hacked by an AI. What stuck out to me was the guardrail asymmetry. The attacker had no constraints, but HF's response ran afoul of the abuse guardrails, forcing them into an unplanned switch to local models. This, to me, is the more interesting bit of the article. I don't really know what a good solution looks like, but yeah, that's annoying.
- rimworld 4mo agoaka tokenize everything
- nailz1911 4mo agoarte.tv released a documentary about measuring and registering land just a month ago @ https://www.youtube.com/watch?v=fl7AfiJs5Gk https://www.youtube.com/watch?v=fl7AfiJs5Gk (Romania: The Unmeasured Land | ARTE.tv Documentary)
- UltraSane 4mo agoEnterprise storage arrays have immutable snapshot functionality that makes ransomware easy to recover from.
- iAMkenough 4mo agoWhat does it take to delete a snapshot?
- ExoticPearTree 4mo agoDepends on the vendor. Some just admin access to the array, other require a two person authorization to delete it.
- UltraSane 4mo agolocal admin credentials or two factor or the BEST is a immutable time-lock, so a snapshot cannot be deleted before the retention period that was set when it was taken expires
- iamgopal 4mo agowould blockchain could have prevented it ?
- ceejayoz 4mo agoNo.
- spwa4 4mo agoAmateurs. Everybody knows you should never wipe databases. You should install a cronjob that makes a random, unrecoverable change on a regular (but random) basis.
- deleted 4mo ago[deleted]
- khurs 4mo agoSecurity firm KELA... has doxxed the hacker as Zakaria Mahdjoub, an individual from Oran, Algeria. If I was an evil hacker, I would only hack countries my country hated or did not have extradition agreements with. Like the Russian hackers do. Algeria has a extradition treaty with Romania: https://periodicos.processus.com.br/index.php/egjf/article/view/1612/1516 https://periodicos.processus.com.br/index.php/egjf/article/v...
- basilikum 4mo agoOr just have Opsec.
- khurs 4mo agoI think there are very few hackers in the world who can hack a national government and not get identified, as the budgets and resources at the state level are enormous, and include ability to seek international help
- basilikum 3mo agoThere is no such thing as "the national government" when it comes to computer systems. They hacked one system of one government division. If their Opsec wasn't crap it is extremely difficult to try to identify them after the fact.
- mdavid626 4mo agoWhy not just change ownership then? I'd bet some people would be interested to pay some money for that...
- ajb 4mo agoThe UK used to have a distributed system - everyone had to have a solicitor store "deeds" of their property, which were a sort of paper blockchain of all the transactions the land had been in since - I don't know, since records began I guess. Since we got a centralised land registry cheaper solicitors have binned these, but some properties still have them as a historical record.
- nutjob2 4mo agoNot sure what you mean by 'binned'. In some Common Law jurisdictions the deed document represents the property and whoever psychically holds of the deed controls the property. Any centralized recording system merely records the last known status of the deed and additional information such as the nominal owner, mortgage holders, etc.
- ajb 4mo agoIn the UK, the old common law rule does not apply to land that has been registered centrally, that is then the legal definition of who owns the property. However there are still properties that are not registered and for those, the rule you describe is still applicable; the holder of the deeds is the owner. Registration is now compulsory on sales, but that only came in in 1990. As to what I mean by binned, I mean literally binned, thrown away.
- lbschenkel 4mo agoNot sure if by "centralised recording" you are referring to the UK way or how it is implemented in general (civil law) but I can say that in Brazil the registry definitely does not have only the last deed. In Brazil the books are append-only, they have the whole history of thay piece of land since records began. If it was a bigger plot that was dismembered, it is there too. When ownership changes you have to register the contract/terms of transfer/sale separately in a different process, but that does not change legal ownership and you still must go to the registry and register that registered transfer/sale in the registry, and the paperwork you get is a new certificate of registration which is a new snapshot of the books and includes that whole history from the very beginning. There is no copy or certificate you can can get from the land registry without including that whole history.
- DigitResort 4mo ago[flagged]
- sebow 4mo ago[Fairly off-topic and political] There's a growing (retarded) perspective, not only here in Romania but in most of the EU, that we must digitalize at all costs; this itself is obviously not a problem, but it usually comes with the removal of the "traditional" options too. The same goes for payments (removal of cash) and basically every aspect of the administration/society where this could be applied. The most recent concrete example for Romania is the mandatory digital signature by ANAF (IRS equivalent) for all companies. Unlike other regions of the West: NA/WE/rest of the West (SK, JP, etc.), in EE, people (*younger generations, explained below) don't often think about the aspects of confidentiality that much, or if they do, they usually apply it incorrectly (either IRL [filming in public] or online ["I've accepted a draconian TOS that gives the company rights to all of my data, but I haven't actually read any of it, and now I'm invoking my "GDPR rights" against said company."]). It does not take a genius or a historian to observe that while the older generations do not have this "problem" (they're very skeptical of the gov. [at least in certain aspects], in an almost american fashion — explained by the fact that they've experienced communism), younger generations position themselves in the extreme opposite; they despise the older generations ("boomers") for being luddites and somehow blame them for the gap in civilizational progress between WE and EE. There is a legitimate point here, of course, but it should be noted that the argument is almost always presented in an emotional, overwhelmingly irrational fashion, and almost never includes comparisons between the centralization done by the state in the past [communists] and the new one attempted by current govs [but digitalized]. (This delves into a broader socio-cultural divide between the generations that includes other aspects like religion, traditions, etc.) The biggest portion of the so-called "IT people" who call for this "digitalization wave" are midwits, "inverse luddites" (they don't care about the implications), and, in smaller numbers, grifters and second-order beneficiaries (on the "digitalization" gov. projects). Obviously, it should be mentioned that, despite progress, nepotism and corruption are still present, and there are cases where gov. contracts are not given to the best candidate. As a person who's both working in the IT sector and not a boomer (despite the impression of my comment), "we" should be careful about enabling totalitarians in our endeavors."Hackers" is just one reason out of a multitude of other reasons for not abandoning the sacred paper (see the ES+PT incident one year ago).
- AdrianB1 4mo ago
- luciana1u 4mo ago[flagged]
- charcircuit 4mo agoWhy is deleting the whole database a valid operation? The system should make that impossible.
- daneel_w 4mo agoWhy is deleting a row in a table a valid operation? Why is deleting a table in a schema a valid operation? Most likely they had full privileged access to the database.
- charcircuit 4mo ago>had full privileged access to the database Why does full access include the ability to delete read only data that should never ever be deleted for the rest of time? It's like building a self destruct button that ignites the physical records. It's an unnecessary risk to make such a dangerous thing.
- daneel_w 4mo agoWell, you don't understand databases. Or software.
- charcircuit 4mo agoI understand that many software projects don't understand the principle of least privilege and make god users that can do anything including deleting everything.
- Tangurena2 4mo agoHackers would do it from the operating system level - stop the database executable, then delete the files used to store the database. Likewise, many organizations store the backups on a network share, where a hacker could delete the files. Permissions inside the database should be segregated. The credential used by the webserver should not have enough permissions to DROP DATABASE. Just the appropriate selects/updates/inserts. Likewise, if you are storing backups on the same network (as opposed to a tape backup), network permissions should allow writes/creates but not deletes.
- puritanicdev 4mo agoWell, the land registry database in Serbia hasn't been working for two months now; the government hasn't issued any announcement so far, except for generic system-issue information we get from LRD support. Weird, hopefully we weren't hit too
- riazrizvi 4mo agoMany many times, entire armies have been sent in to adjust another country's land registry.
- osinix 4mo agoThe backups got wiped together with the systems, so they were reachable from same network. A backup the attacker can reach is not a backup. Good they had an offline copy, but a system this important should have that as regular schedule, not depend on luck.
- abanana 4mo agoThat was my thought exactly on reading that line: that is not a backup. (Ok, the word isn't strictly defined, but you know what I mean.) They have said there's a "real" (offline) backup as well, luckily, but that just reinforces that the "pretend" backup was irrelevant and wasn't even worth mentioning in the writeup.
- teravor 4mo ago> backup the attacker can reach is not a backup you can have append-only backup systems.
- alok-g 4mo agoAny guidelines on how to back up such that the attacker cannot reach (when the hacker otherwise had some valid credentials)?
- pqdbr 4mo agoThis is how we implemented this at our company: - We have 2 sources of data that we must backup to continue existing as a business; our postgres and binary files in S3. Everything else is derivable (elasticsearch, so on). - For postgres, we use barman. With the help of opus/fable, you can get a streaming replication backup working in no time. We have one into another server in the same datacenter (we use baremetal) and another one in another server in a different datacenter. - We then have a last resort barman backup with bi-weekly base backups + WAL streaming to S3 (both the base backup and WALs). It sends these backups + wal segments into an specific S3 bucket that has object lock in compliance mode. This is a feature from AWS S3 that even the most privileged account credentials (super admin) can't turn off nor delete the files before the object lock, which is 10 days in our case. Object lock compliance mode can only be extended, never shortened. - For S3, we store them into another versioned bucket, with lifecycle rules to also expire non current versions (== deleted objects) after 10 days. No point in object lock compliance here because it would only protect objects for the most recent 10 days, and you gain nothing. What we do instead: the app servers only have access to these bucket tru an IAM credential that can't delete old versions (so deleted objects have to expire manually via the lifecycle rule) AND this IAM credentials also can't change the object policy. IMHO, this protects us enough so that even in the worst case scenario (ransomware) we have 10 days to sort everything out and recover our AWS access. And yes, we test the S3 barman restoration and it works fine. Data loss is at max 5 minutes due to the archive_timeout=300s on the primary. For the streaming replications in the two servers I mentioned, it's less <1ms, but those wouldn't protect us much in the case of the ransomware - even tough we use tailscale and one compromised server can't ssh into the other.
- m0llusk 4mo agoSeems like property ownership histories could be one of the few good applications of blockchain technology.
- tracker1 4mo agoOffline and pull based backups FTW... This is why I advocate for a pull or at least push/pull model for backups... where the remote system pulls backups out of your production environment, or otherwise from a drop point. Because a corrupt production system that controls backups can corrupt backups. If your production system at most runs a backup to a drop site, then your backup facilities pull down versioned backups from there, you can better ensure older backup files are intact. More so by not allowing the two to see each other at all and not using backup accounts from a system that can access production resources.
- khurs 4mo ago> This is why I advocate No need to advocate on established best practices. The 3-2-1 rule and its variations are already common place and often mandated by standards/investors and partner contracts. https://connection-technologies.co.uk/help/backup-disaster-recovery/3-2-1-backup-rule-explained https://connection-technologies.co.uk/help/backup-disaster-r...
- tiberius_p 4mo agoThe majority of people have paper documents from the land registry. Digitalization of the land registry is a fairly recent development in Romania so people almost always requests papers when they register their land. In the event that all the digital data or large parts if were lost it would be possible to reconstruct it from the papers and interpolate the missing parts if any.
- danieldrehmer 4mo agoDibs on Vlad's castle
- dredmorbius 4mo agoPoor password practice and policy, and likely a lack of 2FA / physical token security, seem to have contributed to this breach. Posts and screenshots apparently by the alleged attacker show "P@ssw0rd" and other well-known / readily-guessable passwords from the hacked systems: <https://spear.cx/Thread-Selling-RO-Thy-arss-shall-be-spanked-Romania-ANCPI https://spear.cx/Thread-Selling-RO-Thy-arss-shall-be-spanked...> <https://drive.google.com/file/d/1iZc93XfViOk7izusgIG1ni7KmsxVtPFk/view https://drive.google.com/file/d/1iZc93XfViOk7izusgIG1ni7Kmsx...> Originally noted, without references, by ExoticPearTree here: <https://news.ycombinator.com/item?id=48978836 https://news.ycombinator.com/item?id=48978836>. NB: If you're going to point out stupidity verging on cliched tropes, do so with sufficient evidence that it doesn't read as a tired and unsubstantiated canard. The fact that this does happen (and apparently did) doesn't mean it's necessarily the case in any specific instance.
- hinkley 4mo agoFor me the first 2FA devices I’d had were for work but for my friends it was for a world of Warcraft. And it was years until my bank offered 2FA. I still think about that every time there is a breach. Blizzard gave hardware tokens out to the entire convention one year. Smart phones became a variable not long after and then they didn’t make them mandatory but game guilds almost universally did. Especially for officers.
- johnnyApplePRNG 4mo agoIncompetent bureaucrats strike again. News at 11.
- DesiLurker 4mo agoI know people flip out when they hear the word crypto but this is exactly why you need blockchain. immutable land registry thats public(anonymized).
- lrvick 4mo agoCentralized tech is an evolutionary dead end and all who attempt it will continue to learn the same lessons.
- ggm 4mo agoUnder the Australian Torrens title system, paper is no longer authoritative and if you bring a deceased estate title document to the registry they keep it after updating the titles registry database, unless you ask to get it back and it's stamped to mark it superseded. I know because I've done this journey. 3 2 1 people.
- lorreyfum 4mo agoWho was there first?
- rzerowan 4mo agoTangentially reminds me of what happened to the South Korean gov data center [1] where a no-backup ~900TB data center got erased due to a battery fire. Withno external backups piecing together all the lost functions must havebeen hair raising, and more forensic archeolgy than data recovery. Last i heard i think they had restored a quarter of the lost services/data. [1] https://www.intermediagroup.org/south-korea-data-loss/ https://www.intermediagroup.org/south-korea-data-loss/
- spicymaki 3mo agoThis is going to sound controversial, but sometimes it is good to have a paper copy stored in a secure vault.
- ElTimuro 3mo agocould be a digital copy but stored in an offline vault
- Greymon 3mo agowhy the backups being reachable from the same compromised environment. if the backup system accepts deletes with the same creds that run production, it is replication, not backups.
- henrycoler 3mo ago[dead]
- henrycoler 3mo ago[dead]
- valentynkit 3mo agoThe recoverable part all comes down to one offline copy the compomised credentials never touched. Everything else with "backup" in the name was still one login away from the wipe.