View Single Post
  #6  
Old 17-10-2016, 06:21 AM
icedpinata's Avatar
icedpinata icedpinata is offline
Samster
 
Join Date: Sep 2016
Location: dun tell u
Posts: 98
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 0 Post(s)
My Reputation: Points: 1951 / Power: 8
icedpinata has a brilliant futureicedpinata has a brilliant futureicedpinata has a brilliant futureicedpinata has a brilliant futureicedpinata has a brilliant futureicedpinata has a brilliant futureicedpinata has a brilliant futureicedpinata has a brilliant futureicedpinata has a brilliant futureicedpinata has a brilliant futureicedpinata has a brilliant future
Re: To all the Victims and potential Victims of "scandals".

Whenever data comes off your PC and onto any online service, don't think it's safe. For every widely publicised data breach there are countless others that remain underground.

Epoch had an un-patched SQL injection for years that very few are aware of. Unless the database is dumped into public view, they'll keep quiet about it. So far for Epoch it's worked and they've avoided the fallout. It's the same corporate risk management strategy that other companies have used and continue to use.

Dropbox were aware of their leak years ago and admitted to it, but somehow neglected to mention that passwords had also been stolen. That was until recently when they were caught out. Similar risk management strategy but in this case it failed.

To be fair Dropbox did introduce a CAPTCHA system at time of the initial leak. They knew hackers would use the stolen passwords to access accounts using automated bots. Unfortunately the idiots managed to cock up it's implementation and didn't fix it until the next year. How much material was stolen in the meantime? Your guess is as good as mine. Again, Dropbox have been pretty quiet about it.

Over the last year iCloud has had a bug with photos/ videos that was only just patched the other month. Depending on your iPhone settings, if you took a photo and then deleted it, your phone would have no trace of it and it would be inaccessible by any normal means. However that photo data would remain on iCloud servers for months accessible to hackers using specialised tools. Apple have been pretty quiet about it so far. Unless it blows up in the media, they'll keep quiet about it.

Yahoo, 500 million accounts breached in 2014. That data has been in the hands of hackers for that long. Girl has an old Yahoo account. She last used it to forward some work documents to a new Gmail account she made that uses the same password. Wakes up one morning to find that her complex iCloud password doesn't work anymore. She resets it using her Gmail and doesn't worry too much about it. Six months later some random messages her on Facebook to tell her that her tits are out on the internet.

Just a few examples out of countless vulnerabilities, many of which are never discovered/ disclosed.

It's true security is getting better, but so are the hackers.There is a breed of 'hacker' out there that is truly dangerous, they operate on human factors. I'm aware of the official Dropbox press releases, but there are rumours that the employee concerned was deceived/ manipulated into handing over their confidential information by one such operative. This information was then used to mount additional attacks. Even with a physically secure system, your data still isn't safe.

I could write a whole book about this stuff. Most people in their own lines of work are aware of bad practices, cock ups and all sorts of stupidity that customers never see. Cyber security is no different. Hackers have literally walked off with databases worth millions and the team have been like, oh shit, I hope no one notices. They also get to hear the rumours that no one else does.

The bottom line: any time you take a photo/ video using a modern device and that data is transmitted over the internet, you have no idea who will have access to it. There are many un-patched vulnerabilities out there, most of them you'll never hear about. You'll just sit there wondering how you got hacked.

'Check if you have an account that has been compromised in a data breach':
https://haveibeenpwned.com/

This is a useful site, but then it only has known breaches, most are never made public.

Last edited by icedpinata; 18-10-2016 at 04:37 AM. Reason: Corrections.