4 ms·

True, but the fact remains that this does not sound dangerous.

by marvy 12y ago

andreyf 12y ago
I'm pretty sure that "have access to someone's account number once" => "have access to past and future traffic usage forever" is not good security practice regardless if there are or are not obvious vulnerabilities, and you really don't have to think very hard to construct a scenario where it can be abused.
yourad_io 12y ago
Security isn't about mitigating danger. You're leaking information that you aren't supposed to. There is no benefit or legitimate use case for this leak; it is a leak. You gotta plug it.
frio 12y ago
You could send large amounts of data to an IP in sporadic bursts, find which graph correlates, get their account number and use that as a starting point for social engineering the helpdesk staff. Elaborate, sure, but plausible. The more important part of the leak is all the account numbers anyway :).
thefreeman 12y ago
A good one mentioned in the OP comments is deducing when people are on vacation due to their traffic usage (or rather lack there of). Also, we don't know what other information may have been listed there. What if they decided to add your name and IP address to the graph?
Argorak 12y ago
Case A: An attacker knows person A has account number 123. They also know that this person has a tablet, a phone and an Apple notebook that A always takes with them when leaving the home. A uses Twitter and a couple of other social networks that those devices sync with in regular intervals and syncs to iCloud (which can happen while the notebook is closed). I'd be surprised if this constant chatter isn't visible on the graphs. That means: The attacker can track rather well whether the person is at home or not. Or at least make informed guesses. They plan a robbery during a holiday. Or, much more malicious: some attack on the persons other web properties like their iCloud and Amazon account, as presented a while ago.[1] Case B: Consider that the attacker doesn't have the account number. Another leak in their platform allows them to link personal information with account numbers. In itself, that info is also not very interesting and would also not be "dangerous". Because the leak of the traffic graphs exists, they go on and plan the biggest heist in Toronto ever :). A good exploit is often the combination of multiple seemingly innocuous flaws. [1] is also a good example of that. [1]: http://www.emptyage.com/post/28679875595/yes-i-was-hacked-hard http://www.emptyage.com/post/28679875595/yes-i-was-hacked-ha...
Kiro 12y ago
Not one serious reply to your statement. Makes me think you're right.
- marvy 12y ago
  On the contrary, I consider these good answers.
noselasd 12y ago
That's with an assumption that the data was anonymous - an assumption we don't know was true. Was there any account/customer number, IP addresses, naming scheme or similar in the graphs or file names ?

True, but the fact remains that this does not sound dangerous.

by marvy 12y ago

True, but the fact remains that this does not sound dangerous.

I'm pretty sure that "have access to someone's account number once" => "have access to past and future traffic usage forever" is not good security practice regardless if there are or are not obvious vulnerabilities, and you really don't have to think very hard to construct a scenario where it can be abused.

yourad_io 12y ago

Security isn't about mitigating danger. You're leaking information that you aren't supposed to. There is no benefit or legitimate use case for this leak; it is a leak. You gotta plug it.

frio 12y ago

You could send large amounts of data to an IP in sporadic bursts, find which graph correlates, get their account number and use that as a starting point for social engineering the helpdesk staff. Elaborate, sure, but plausible. The more important part of the leak is all the account numbers anyway :).

thefreeman 12y ago

A good one mentioned in the OP comments is deducing when people are on vacation due to their traffic usage (or rather lack there of). Also, we don't know what other information may have been listed there. What if they decided to add your name and IP address to the graph?

Argorak 12y ago

Case A: An attacker knows person A has account number 123. They also know that this person has a tablet, a phone and an Apple notebook that A always takes with them when leaving the home. A uses Twitter and a couple of other social networks that those devices sync with in regular intervals and syncs to iCloud (which can happen while the notebook is closed). I'd be surprised if this constant chatter isn't visible on the graphs. That means: The attacker can track rather well whether the person is at home or not. Or at least make informed guesses. They plan a robbery during a holiday. Or, much more malicious: some attack on the persons other web properties like their iCloud and Amazon account, as presented a while ago.[1] Case B: Consider that the attacker doesn't have the account number. Another leak in their platform allows them to link personal information with account numbers. In itself, that info is also not very interesting and would also not be "dangerous". Because the leak of the traffic graphs exists, they go on and plan the biggest heist in Toronto ever :). A good exploit is often the combination of multiple seemingly innocuous flaws. [1] is also a good example of that. [1]: http://www.emptyage.com/post/28679875595/yes-i-was-hacked-hard http://www.emptyage.com/post/28679875595/yes-i-was-hacked-ha...

Kiro 12y ago

Not one serious reply to your statement. Makes me think you're right.

marvy 12y ago
On the contrary, I consider these good answers.

noselasd 12y ago

That's with an assumption that the data was anonymous - an assumption we don't know was true. Was there any account/customer number, IP addresses, naming scheme or similar in the graphs or file names ?