Posted on 06/24/2020 7:24:32 PM PDT by gandalftb
Hundreds of thousands of potentially sensitive files from police departments across the United States were leaked online last week. The collection, dubbed “BlueLeaks” and made searchable online, stems from a security breach at a Texas web design and hosting company that maintains a number of state law enforcement data-sharing portals.
The collection — nearly 270 gigabytes in total — is the latest release from Distributed Denial of Secrets (DDoSecrets), an alternative to Wikileaks that publishes caches of previously secret data.
The archive indexes “ten years of data from over 200 police departments, fusion centers and other law enforcement training and support resources,” and that “among the hundreds of thousands of documents are police and FBI reports, bulletins, guides and more.”
the documents include names, email addresses, phone numbers, PDF documents, images, and a large number of text, video, CSV and ZIP files.
“Additionally, the data dump contains emails and associated attachments,” the alert reads. “Our initial analysis revealed that some of these files contain highly sensitive information such as ACH routing numbers, international bank account numbers (IBANs), and other financial data as well as personally identifiable information (PII) and images of suspects listed in Requests for Information (RFIs) and other law enforcement and government agency reports.”
(Excerpt) Read more at krebsonsecurity.com ...
Thats what you get when hire cheap, know-nothing H1B Indian web developers
“Netsential confirmed that this compromise was likely the result of a threat actor who leveraged a compromised Netsential customer user account and the web platform’s upload feature to introduce malicious content, allowing for the exfiltration of other Netsential customer data.”
One thing it may expose is anybody that has negative marks in their record.
“stems from a security breach at a Texas web design and hosting company that maintains a number of state law enforcement data-sharing portals.”
I wonder how many H-1Bs that company employs.
It sort of reminds me of another political hacking. wait a minute ...
Netsential.com is a Texas small business with 39 people and $8M/year in revenue.
My understanding is that misconduct is not part of the database. What is compromised is undercover ops, ongoing surveillance and nation-wide fusion center data.
...........
Organized crime, the Chinese and Russians will have a field day.
Somebody didn’t learn to code.
The documents reveal what information the police have on people — it’s even searchable by police badge number.
>> Thats what you get when hire cheap, know-nothing H1B Indian web developers
Can’t agree with that generality.
Likely the work of an insider, woke Millennial that had direct access to the databases.
FOrget police departments — every person who was a suspected criminal now has all of their bank data free for everyone.
These people are not “targeting the police”, they are destroying the lives of the suspects they claim they are helping.
The enemy and just how powerful and entrenched he is, continues to be revealed. This enemy is organized and well funded. I do not see this on our side.
The word, BLUE probably refers to the Democrat who did the hacking, rather than the police.
“Netsential confirmed that this compromise was likely the result of a threat actor who leveraged a compromised Netsential customer user account and the web platform’s upload feature to introduce malicious content, allowing for the exfiltration of other Netsential customer data.”
Why was the account compromisable? Why was malware uploadable? Poor technical design.
The article says it was an upload exploit which tells me they didn’t properly limit and check the kinds of files being uploaded...someone uploaded a backdoor
Little Bobby Tables
The malicious “file” would need to be executed/opened in order for something else to happen. And I’m still dubious about 270 GB pull or push to where ever. But I’m not saying it didn’t happen that way.
>> Poor technical design.
Or a serious neglect/breach of security. Perhaps someone leaked the creds to a hypothetical S3 bucket.
Without insights into the stack design & implementation, there’s really no way for us to know what happened — unless we’re to trust the reports which are too often incomplete and inaccurate.
Poor crap Indian H1B design with no concepts of web or database security and done as cheaply as possible.
Its always the fault of the coding team. Thats why you harden stuff.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.