MESSAGE
| DATE | 2024-09-07 |
| FROM | Ruben Safir
|
| SUBJECT | Subject: [Hangout - NYLXS] We are all fucked - Database Breach
|
krebsonsecurity.com
National Public Data Published Its Own Passwords
6–7 minutes
New details are emerging about a breach at National Public Data (NPD), a
consumer data broker that recently spilled hundreds of millions of
Americans’ Social Security Numbers, addresses, and phone numbers online.
KrebsOnSecurity has learned that another NPD data broker which shares
access to the same consumer records inadvertently published the
passwords to its back-end database in a file that was freely available
from its homepage until today.
In April, a cybercriminal named USDoD began selling data stolen from
NPD. In July, someone leaked what was taken, including the names,
addresses, phone numbers and in some cases email addresses for more than
272 million people (including many who are now deceased).
NPD acknowledged the intrusion on Aug. 12, saying it dates back to a
security incident in December 2023. In an interview last week, USDoD
blamed the July data leak on another malicious hacker who also had
access to the company’s database, which they claimed has been floating
around the underground since December 2023.
Following last week’s story on the breadth of the NPD breach, a reader
alerted KrebsOnSecurity that a sister NPD property — the background
search service recordscheck.net — was hosting an archive that included
the usernames and password for the site’s administrator.
A review of that archive, which was available from the Records Check
website until just before publication this morning (August 19), shows it
includes the source code and plain text usernames and passwords for
different components of recordscheck.net, which is visually similar to
nationalpublicdata.com and features identical login pages.
The exposed archive, which was named “members.zip,” indicates
RecordsCheck users were all initially assigned the same six-character
password and instructed to change it, but many did not.
According to the breach tracking service Constella Intelligence, the
passwords included in the source code archive are identical to
credentials exposed in previous data breaches that involved email
accounts belonging to NPD’s founder, an actor and retired sheriff’s
deputy from Florida named Salvatore “Sal” Verini.
Reached via email, Mr. Verini said the exposed archive (a .zip file)
containing recordscheck.net credentials has been removed from the
company’s website, and that the site is slated to cease operations “in
the next week or so.”
“Regarding the zip, it has been removed but was an old version of the
site with non-working code and passwords,” Verini told KrebsOnSecurity.
“Regarding your question, it is an active investigation, in which we
cannot comment on at this point. But once we can, we will [be] with you,
as we follow your blog. Very informative.”
The leaked recordscheck.net source code indicates the website was
created by a web development firm based in Lahore, Pakistan called
creationnext.com, which did not return messages seeking comment.
CreationNext.com’s homepage features a positive testimonial from Sal Verini.
A testimonial from Sal Verini on the homepage of CreationNext, the
Lahore, Pakistan-based web development firm that apparently designed NPD
and RecordsCheck.
There are now several websites that have been stood up to help people
learn if their SSN and other data was exposed in this breach. One is
npdbreach.com, a lookup page erected by Atlas Data Privacy Corp. Another
lookup service is available at npd.pentester.com. Both sites show NPD
had old and largely inaccurate data on Yours Truly.
The best advice for those concerned about this breach is to freeze one’s
credit file at each of the major consumer reporting bureaus. Having a
freeze on your files makes it much harder for identity thieves to create
new accounts in your name, and it limits who can view your credit
information.
A freeze is a good idea because all of the information that ID thieves
need to assume your identity is now broadly available from multiple
sources, thanks to the multiplicity of data breaches we’ve seen
involving SSN data and other key static data points about people.
Screenshots of a Telegram-based ID theft service that was selling
background reports using hacked law enforcement accounts at USInfoSearch.
There are numerous cybercriminal services that offer detailed background
checks on consumers, including full SSNs. These services are powered by
compromised accounts at data brokers that cater to private investigators
and law enforcement officials, and some are now fully automated via
Telegram instant message bots.
In November 2023, KrebsOnSecurity wrote about one such service, which
was being powered by hacked accounts at the U.S. consumer data broker
USInfoSearch.com. This is notable because the leaked source code
indicates Records Check pulled background reports on people by querying
NPD’s database and records at USInfoSearch. KrebsOnSecurity sought
comment from USInfoSearch and will update this story if they respond.
The point is, if you’re an American who hasn’t frozen their credit files
and you haven’t yet experienced some form of new account fraud, the ID
thieves probably just haven’t gotten around to you yet.
All Americans are also entitled to obtain a free copy of their credit
report weekly from each of the three major credit bureaus. It used to be
that consumers were allowed one free report from each of the bureaus
annually, but in October 2023 the Federal Trade Commission announced the
bureaus had permanently extended a program that lets you check your
credit report once a week for free.
If you haven’t done this in a while, now would be an excellent time to
order your files. To place a freeze, you’ll need to create an account at
each of the three major reporting bureaus, Equifax, Experian and
TransUnion. Once you’ve established an account, you should be able to
then view and freeze your credit file. If you spot errors, such as
random addresses and phone numbers you don’t recognize, do not ignore
them. Dispute any inaccuracies you may find.
--
So many immigrant groups have swept through our town
that Brooklyn, like Atlantis, reaches mythological
proportions in the mind of the world - RI Safir 1998
http://www.mrbrklyn.com
DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002
http://www.nylxs.com - Leadership Development in Free Software
http://www.brooklyn-living.com
Being so tracked is for FARM ANIMALS and extermination camps,
but incompatible with living as a free human being. -RI Safir 2013
_______________________________________________
Hangout mailing list
Hangout-at-nylxs.com
http://lists.mrbrklyn.com/mailman/listinfo/hangout
|
|
