9 ms·
> Since the hack, officials restored their website and posted a message announcing they are rebuilding the agency's entire network from scratch. Even if the hac
by skinfaxi 3mo ago
> Since the hack, officials restored their website and posted a message announcing they are rebuilding the agency's entire network from scratch. Even if the hacker claims they deleted backups, the agency appears to have had an offline copy, otherwise things would have gotten really messy over the coming months in Romania.
So it seems not all has been lost. I was worried about the societal implications of being unable to prove land ownership but it seems that may be avoided.
- chasd00 3mo agonow they get to do a greenfield implementation too! /joking, i'm sure this is not a happy time for whoever is trying to rebuild everything
- nicman23 3mo agoi think it is a very happy time charging whatever per hour you want
- deleted 3mo ago[deleted]
- ddoolin 3mo agoI wonder why the say "appears to have had," is that an assumption or was it stated somewhere? Without an offline backup, it would indeed be a very serious problem, more than it already is.
- n4r9 3mo agoMy reading is: "The agency would surely be panicking more than this if they didn't have an offline backup".
- rob74 3mo ago"Offline backup", as in "thousands of shelves full of dusty binders spread across offices all over the country"?
- throw1234567891 3mo agoYup. Everyone’s job safe for the next few years!
- rob74 3mo ago"And to think that we just finished digitizing all those paper files five years ago! Oh well, back to square one..."
- embedding-shape 3mo agoI think the "offline" part is what is that "appears" to be, clearly they have backups somewhere, but maybe the attacker just missed to wipe some other "online" location.
- sixothree 3mo agoI interpreted this as a vagueness related to the reporting accuracy, not the existence of a backup.
- stellamariesays 3mo ago[flagged]
- nicce 3mo agoOne more reason to to define the whole infrastructure in code and have offline backups. Recovering could be measured in hours.
- vkou 3mo agoOnly if you routinely test it, and if that kind of access to the offline backup is low friction enough to be doing that monthly, it might not be enough of a redundancy.
- baq 3mo ago> has entire infra in code > spinning up a new shard takes a quarter Both can be true
- ninalanyon 3mo agoA backup that isn't offline is not really a backup as it far too easy to destroy it even by accident/carelessness/lack of understanding. When I was responsible for backups we kept the tape cartridges in a fire safe in a different building. We took a full backup weekly and moved the tape from the robot to the firesafe as soon as the backup was complete. Only the daily incremental backups stayed in the robot for more than a day.
- krisoft 3mo agoThat sounds good, but wouldn’t you worry that the same hackers will let themselves in via the same route again? You would need to understand first how they gained access and verify that they can’t do the same again. That in itself could take days if not weeks. Then of course they might have found new vulnerabilities while they were in, so you would need to worry about that too.
- close04 3mo ago> Recovering could be measured in hours. Yes, even hundreds of them sometimes. The most time consuming part of recovering from an attack is validating everything. It takes more than a few hours to validate the infra that stays put isn’t compromised, the IaC code itself isn’t compromised, deploy the infra, bring a copy of the offline backup of your data (your IaC can’t drive to another site and bring the backups, then make a copy, unless tou are really sure you removed any trace of compromise), validate that the backup is sound, then restore it. In some cases the infrastructure part is the least time consuming. Some platforms are straight forward enough that even manual deployment is fast. But after a hack you can’t trust anything so you need to do the slow validation that takes longer than your projected “hours”.
- gchamonlive 3mo agoI'd bet money the offline copy is far from up-to-date, given the state of the network. It still has potential to be mayhem
- _heimdall 3mo agoIf its at least somewhat recent hopefully those affected still have paperwork for any property ownership transfers. Finding proof of property you bought decades ago would be a huge pain.
- gchamonlive 3mo agoThe problem is that everything will potentially be under dispute, since anyone can claim they purchased a patch of land whose registry was missed in the restoration
- cataphract 3mo agoDon't know exactly on it works in Romania, but proving you purchased a patch of land is a different question -- for that you have the deed. You then submit the deed to the land registry. So this situation could at most result in the seller being able to sell the land more than once or disputes over the priority of sales over liens and other competing acts subject to registration.
- gchamonlive 3mo agoHere in Brazil lots of people deal land by word of mouth. The country is just too big and there isn't enough state present to make every transaction official, so people shake on it, draft an unofficial document and actually living and developing the land over a long period of time is what consistitutes ownership.
- lebuffon 3mo agoThis is well documented in the the book "The Mystery of Capital" by Hernando de Soto. When it was published I thought it would change the world, but apparently nobody cared. :-) In his thesis, this is the reason capitalism cannot work well in Latin America and other nations around the world. He says that registered land ownership is the foundation of capitalism. This is how one can borrow money against your land and invest it to make more capital. Very common for example with farmers in N. America to borrow against their farm, for machines, seeds and fertilizer. (I am not an economist)
- 21asdffdsa12 3mo agoRemember the xerox-scandal years back, that invalidated officially scanned documents. You already life in a world where "scanned before" means you can legally challenge the validity of a document.
- unreal6 3mo agoIs this the scandal to which you are referring? https://www.bbc.com/news/technology-23588202 https://www.bbc.com/news/technology-23588202
- 21asdffdsa12 3mo agoYes, several national archives where affected on all settings. If a institution scanned and archived documents with these- these documents are - in theory challenge-able in court- within reason..
- mmh0000 3mo agoYes, that is what they're referring to. The technical details behind it are kind of cool. It's a "bug" of the JBIG2 compression algorithm. See 1, 2 [1] https://community.apryse.com/t/jbig2-compression-issue/1814 https://community.apryse.com/t/jbig2-compression-issue/1814 [2] https://en.wikipedia.org/wiki/JBIG2#Character_substitution_errors_in_scanned_documents https://en.wikipedia.org/wiki/JBIG2#Character_substitution_e...
- xattt 3mo agoAll I see is 1, 1
- arthurmorgan 3mo agoThere‘s also a great conference talk [0] on this, with an english translation [1]. [0]: https://youtu.be/7FeqF1-Z1g0 https://youtu.be/7FeqF1-Z1g0 [1]: https://youtu.be/zXXmhxbQ-hk https://youtu.be/zXXmhxbQ-hk
- mindslight 3mo agoI am pretty sure I was bitten by this bug, or a similar bug, on an IRA transfer form that I uploaded to a bank. On the scan that I uploaded, one digit in the account number was a clean "5", but the customer service person said it looked like a good clean "6". I presume their document management system was an outcropping of a system originally set up for dealing with faxes, and used that or a similar compression algorithm.
- deleted 3mo ago[deleted]
- nashashmi 3mo agoHas not digital data always been a secondary source of information, instead of a primary source of information? Paper records cannot be thrown away. And new records are probably recorded digital only but a copy is sent to the parties in the transaction
- Kinrany 3mo agoPaper records burn great and are harder to store in multiple locations
- vitally3643 3mo agoFaxes and photocopiers have existed for nearly a century
- floatrock 3mo agoThey're also often stored in basements, which is the first to flood.
- fy20 3mo agoAt least in my EU country, no the digital record is the primary. When you buy property you get a deed for the land, but the details of a property can change after that. The deed also doesn't contain ownership, it just says what is on the land. It's common for land to have multiple owners (1/32 is not unheard of) due to inheritance. I'm building a house, the land deed just has the land plot as we bought it, until the house is 100% finished (and registered) we will not get an updated deed, although the digital system has newer data (you need to register the construction progress).
- b112 3mo agoThe sad part is, the whole world worked perfectly fine without anything online, ever, prior to 20 years ago. Even 10 years ago for slow-moving change. It's literally not a requirement to have it all online. And the cost of developers, plus coding + security updates + platform costs, really just means you replace a few assistants which would process requests by hand, with all that. Except? It's a lot harder to hack a person to delete all the files in the office, from 10k km away, than via a computer. So many things simply don't need to be online. So many things simply are better archived by other means. So many things are safer, more secure, and the backup processes (microfiche, etc) are well understood and just work.
- marginalx 3mo agoEverything comes with a risk, and people usually take it with a decent understanding of how to mitigate it mostly. If we start thinking along the lines of technology has risk and we shouldn't use it, we should go back all the way to the discovery of fire as we all know fire can cause a lot of damage if in the wrong hands.
- b112 3mo agoTechnology can make lives safer. However, software is never secure, cannot be made secure, this is empirically proven to be a 100% valid position. In as software is not secure, and can not be made secure, using it for important records storage makes zero sense, unless you a) have full backups offline in physical, non-digital, read only medium or b) just don't do it online, at all. And my point is, it's not worth the convenience.
- MiloLeo 3mo agoBut physical records also cannot be made secure. And the convenience is gigantic. I think that it is worth it, as clearly does much of the world.
- b112 3mo agoRead the scope I discussed. Physical records can be made exceptionally secure. They can be secure on location (archival location, with guards). They also aren't reachable by every human being on the planet who wants to infiltrate. Think about it. To destroy the public archives, of which there is typically more than one, you must travel to said location, breach it with weapons and other means, and destroy it. Or, you can sit in your parent's basement in your pajama's, and hack and destroy. There is not even remotely the same risk profile. And if you think something is "good" because 'the world thinks it is good', then I have to ask you why you're validating something via popularity. You know what else was popular? Fossil fuels. Smoking. Using uranium in makeup for women. Something being accepted, and being fun or convenient, doesn't make it correct, sensible, or right. So please describe the horrible and incredible "gigantic convenience". Because I lived before the internet, and now after, and yes it is convenient. But it certainly isn't a 'gigantic' one, nor is it sensible compared to the insane attack surface and risk.
- franciscop 3mo agoThis happened in a 50k people town where my father is from in 1982 with a BIG flood that destroyed the town land registry documents (among a lot of the town). Since he's a lawyer, had first hand experience and I was always curious I asked many things about this a while back. Basically, what happened is that they rebuilt it from proof of ownership and testimonies of the people. You can never get to 100% recovery like that, but everyone knows who their neighbor is, at least in a town that is small like this. So they rebuilt it first from first hand proof, then by testimonies, with a period of counter claims available IIRC. For sure there were some false claims, but given the magnitude of the disaster, this is the best solution within that context.
- bombcar 3mo agoThis is where "possession is 9/10ths of the law" comes from.
- franciscop 3mo agoI actually think our discussion came from there! Or at least, there was a previous/later discussion about this exactly related to that.
- bombcar 3mo agoIt's one of those "programmer misconceptions" - we want to make reality fit our neat and tidy list of rules/laws/code; but it's the other way around most of the time.
- kefabean 3mo agoI always wonder how things would be reconciled if something similar happened to a bank. What would be the simplest way to ‘download’ one’s balance whilst proving that the downloaded files were signed by the bank?
- superb_dev 3mo agoYour best chance would probably be mailed statements
- ExoticPearTree 3mo ago> I was worried about the societal implications of being unable to prove land ownership but it seems that may be avoided. You know, it's not like people would come and steal your land overnight because you can't provide proof of ownership.
- anvuong 3mo agoHappens far more often than you would think in developing countries.
- tredre3 3mo agoProperty lines disputes happen every single day in America, too. It's a universal thing.
- notahacker 3mo agoSquatters, boundary disputes and rent defaults happen all the time. Plus having most of your net worth locked up in something no sane person would consider buying off you because you can't prove you own it is ... suboptimal
- dsego 3mo agoPeople can come and cut down trees, use the land for their cattle, raise crops or just start building something. If you don't challenge it and they get away with it for a while, they could even gain use of the land legally.
- iso1631 3mo agohttps://www.bbc.co.uk/news/articles/ckg15ev0347o https://www.bbc.co.uk/news/articles/ckg15ev0347o
- userulluipeste 3mo ago"Under normal circumstances, property law in England and Wales dictates the original owner cannot claim their property back even if the title change was made fraudulently." That's... a curious thing to have in the body of laws. What's its purpose and who does it serve?
- dist-epoch 3mo agoRomania is not very digitalized, and it still has a lot of paper bureaucracy. Even if the digital records were completely lost, they still have the paper ones. > being unable to prove land ownership People know who owns what, there are also paper contracts of ownership which are more authoritative than the digital records.
- cynicalreason 3mo agoReconstructing that archive from the records would be close to impossible. The documents they issue and banks/notaries and others have have 30 day expires. In theory most of these documents are issued on sale / mortgages / loans against these type of assets. Both notaries and banks have their own record system - I don't think there's a common system they all use, for notaries I'm not sure if they keep electronic records of these papers .. the system that was hacked was supposed to be it.
- petre 3mo ago> I'm not sure if they keep electronic records of these papers .. the system that was hacked was supposed to be it. Nope. Thye just keep the papers archived in binders. Maye the banks also keep electorinic records, the notaries are a the paper keeping and issuing public service.
- sph 3mo ago> the agency appears to have had an offline copy, otherwise things would have gotten really messy over the coming months The last thing any government will want to deal with is massive irretrievable data loss. https://www.youtube.com/watch?v=K_FrQnQv0Vw https://www.youtube.com/watch?v=K_FrQnQv0Vw
- theredleft 3mo ago> the societal implications of being unable to prove land ownership accidental communism
- kazinator 3mo agoI'm skeptical that they not missing at least a week's or so worth of land title registry transactions, if the only thing they have left is offline, because offline backups are not made after every single transaction. If the hacker was targeting the erasure of a particular recent transaction, they may well have succeeded. And by deleting numerous others, they have plausible deniability in the subsequent dispute over the property. If you just wipe a record that is related to you, and the manipulation is discovered (which it will be, one way or another), you are part of a narrow circle of suspects.
- matkoniecz 3mo agoIn such case notaries (or whoever reports transaction) can resubmit them. Also, you still have paper documents, kept by parties to transaction, right?
- basilikum 3mo ago> offline backups are not made after every single transaction. All you need is an append only tape or even a printer. Interestingly in the Bangladesh Central Bank hack they used a printer to print out any transactions, but the intruders disabled it or it was just malfunctioning because it's a printer. But I doubt the Romanians actually had such a system.
- hinkley 3mo agoWhen I worked at a stressful place I was worried not only of our version control getting damaged but also someone deciding they had had enough and doing damage on their way out. I had a copy of our code on media in my desk labeled “promotion” and updated it every month. In retrospect someone going through my desk would have assumed blackmail material and been disappointed to find only code.
- gowld 3mo agoIn the US, real estate purchases come with "title insurance", because there is no official, guaranteed, land registry database.
- bluGill 3mo agoThat depends on the state, some do have a registry.
- markdown 3mo agowtf
- dghlsakjg 3mo agoThat’s a simplified explanation. Title insurance covers a number of situations, fraudulent transfer of title is only one of them and is more likely to be something like “A wife sold her dead spouse’s house, but it turns out that there was a dispute about the will and now someone else is claiming that the house actually wasn’t hers to sell”
- markdown 3mo agoThat wouldn't be possible in my country because she would not have any right to sell the house until it was transferred to her. This transfer would happen during the probate process. The probate process is where all issues regarding the will/estate and disputes are settled. Once probate is complete, ownership is set in stone and the widow would have every right to sell her house.
- markdown 3mo agoA land title is written on paper or cardboard, with signatures and stamps on it. The digital copy is just that; a digital copy. The hacker would have to destroy the database and all backups, and also burn down the building holding the registry.
- ragall 3mo agoThat's not how things work in most countries in Europe: the land registry is the authoritative source, and there are no bearer titles any more.
- MagicMoonlight 3mo ago[dead]
- kleton 3mo agoAbout 15% of the UK's land parcels are not in any land registry database, because recording there only became compulsory in 1990, so if an event like a sale/morgtage didn't happen to a property since then, it might not be registered. Regardless of the land registry, the ownership can still easily be proven.
- itake 3mo agoI was just in Hungary and they attempted to return land seized by the communist government by basically asking around. People would get their buddy to agree the land was theirs so not a perfect system, but some families were made more whole.
- ksec 3mo agoI wonder what media they used for their offline copy.