Hacker dumps thousands of sensitive Mexican embassy documents online

https://techcrunch.com/2019/04/19/mexican-embassy-hack/

by oropolo • 7 years ago

113 22 7 years ago

techcrunch.com

sgt• 7 years ago

But will this wake up the Mexican ambassador?

moftz• 7 years ago

Any cables from the German Empire in there?

teddyh• 7 years ago

Context: https://en.wikipedia.org/wiki/Zimmermann_Telegram

adolph• 7 years ago

My child and I recently read “Treaties, Trenches, Mud, and Blood” and found it a very accessible telling of WWI.

https://www.goodreads.com/book/show/18405492-treaties-trench...

lostlogin• 7 years ago

The reading of German communications by the US is more direct these days. https://www.google.co.nz/amp/s/amp.theguardian.com/us-news/2...

tomatotomato37• 7 years ago

To clarify, this is the Mexican embassy in Guatemala. I doubt there's anything interesting in there beyond the usual political maneuvering of border countries

downrightmike• 7 years ago

I wonder what is going on between Mexico and Guatemala, given the large amount of Guatemalans going through Mexico to reach the US.

nyolfen• 7 years ago

you are in a marvelous position to find out

daRealDodo• 7 years ago

So normally he's a white hat that gets paid for bounties, but once he misses a single reply he dumps everything to the public? This barely earns him anything and puts government workers in unnecessary risk.

drivingmenuts• 7 years ago

Sounds like blackmail “Pay me or else.”

ggggtez2• 7 years ago

"Normally" is a strong word, when it seems pretty clear his "bounties" are more like blackmail payments.

White hat hackers release bugs to get them fixed. This is clearly just a case of extortion. You release a bug, you don't steal documents yourself.

Waterluvian• 7 years ago

Done properly you'd discover that you could copy sensitive files. You don't actually copy them.

DyslexicAtheist3• 7 years ago

... are more like blackmail payments.

nothing in this article concludes that he asked for payment.

droithomme• 7 years ago

once he misses a single reply he dumps everything to the public

Also known as "black hat", aka criminal.

Seems this is just all mundane info about ordinary people, no scandals, no war crimes, no improprieties. He's massively violated their privacy and subjected them to identity theft. Hope justice finds this bad dude.

DyslexicAtheist3• 7 years ago

fair game:

[...] In previous correspondence with the hacker, he said he tries to report problems and has received bounty payouts for his discoveries. “But when I don’t get a reply, then it’s going public,” he said. [...]

Before we speak about responsible disclosure and call people "hackers" in a negative context, we have to talk about irresponsible QA processes. this is true for both tech companies or anyone utilizing technology for whatever means.

it's similar to saying: "yes I left a loaded gun there, but let's blame the evil criminal who picked it up and did a bad thing", ...

... I'm not defending him. My point is responsibility has to be on both sides. Today companies rather participate in PR circle jerks (and mistake bug bounties for real audits) instead of cleaning up their own actual security problems.

Edit: in a similar thread this week we had WIPRO breached which then claimed that they did everything

“Wipro has a multilayer security system,” the company wrote. “The company has robust internal processes and a system of advanced security technology in place to detect phishing attempts and protect itself from such attacks. We constantly monitor our entire infrastructure at heightened level of alertness to deal with any potential cyber threat.”

if they'd really be using industry best practices against phishing they'd have used U2F. Nobody is using it at Wipro though. CISO's today rather point to how well they've outsourced the problem (at least the damage control part) by pointing at their insurance policies (which often won't even cover a breach, and which does nothing to protect the user/data and only protects the company bottom line). Talk is cheap, fuck them all.

ggggtez2• 7 years ago

I mean, it's not fair game though.

You can release a bug, tell other people how it works, publicly shame the government into having better security. But stealing the documents and holding the stolen documents for ransom?

Why should they pay him? He's clearly acting like a criminal, not someone trying to just make a living by making society safer. He's making it worse on purpose because he didn't get his way.

DyslexicAtheist3• 7 years ago

I wasn't saying they should pay him. I don't think they should. But having been on the receiving end of this behavior for far too long my point is that he should be listened to and not ignored like this. It would be OK if it's just ignoring, I've seen companies very eager to use legal threats too especially if the researcher is an isolated individual and not company.

It's not too much to ask to have a security@ mailbox and actually pay attention to it. If you don't have a disclosure process in 2019 then there is no reason you should have your systems exposed (whether that's a gov site or company doesn't make a difference) IMHO

The moment you answered I was still editing my post trying to point out that I'm not defending him. Sorry if there was an overlap here.

Simulacra• 7 years ago

Did anyone else read the headline and think we were about to see a WikiLeaks style dump?

techntoke• 7 years ago

The Hacker apparently had never heard of sharing the documents via Torrent or posting a link to them on the dark web.

Hacker dumps thousands of sensitive Mexican embassy documents online

Related Stories