My docs got dropped in the Stratfor leak

http://kyleisom.net/blog/2011/12/37-stratfor/

by kisom • 15 years ago

27 19 15 years ago

sp332• 15 years ago

Have any of these sites been brought to court for criminal negligence? If CC# are getting dumped, they probably broke a bunch of PCI rules too.

kisom4• 15 years ago

Like I said, I've love to see legislative effort aimed at making this sort of negligence criminal; I have absolutely no legal background so I have no idea if there's current legal ground to pursue on.

They did store CVVs and expiration dates in addition to credit card numbers, so I'd imagine there's some sort of PCI violation going on.

rbanffy• 15 years ago

IIRC and IANAL, but someone mentioned a Texas law that requires companies to properly protect customer data. Stratfor is based in Austin.

I wouldn't want to be in their shoes.

gcb• 15 years ago

Last time i checked, it was against visa's agreement to store all that.

But i was in another country then

gyardley• 15 years ago

Yes, the security of Stratfor was unacceptably lax, and yes, getting mad is generally a waste of energy, but you can't legitimately compare the criminals who broke into Stratfor and committed credit-card fraud to a five-year-old who's gotten into the cookie jar. They are old enough to take responsibility for and be held accountable for their actions; a five-year-old is not.

kisom4• 15 years ago

Interesting, I hadn't thought along those lines when I wrote that because I was focused on how lax the security was, and not thinking about culpability. I updated the post with a note about that.

hack_edu• 15 years ago

And, unlike a five year-old, they have the aptitude to pick specific targets and continue to do so. Tactics of a hack are secondary. Intrusion is intrusion, and whether or not they sneak in like a spy in a James Bond movie or just walk in the back door is far, far down their list of their goals.

Can we get past relating them to children now? Many of them are professionals, and if we're lucky, will soon enough be ones who are running next Stratfor. Afterall, folks like these guys founded the infosec industry.

steve8918• 15 years ago

Me too. I'm actually pretty pissed at Stratfor because it's a huge inconvenience.

Unfortunately, I used an email address that I use on other sites, so now I have to decide whether or not to create a new email account for everywhere else, which is extremely, extremely annoying. Luckily, I used a separate password for Stratfor (12+ characters).

Also, unfortunately, the cc was my main cc number, so that means I have to change EVERYTHING, which is a huge hassle.

I guess this means I just have to keep creating throwaway email addresses for every new service that I sign up for, which is turning into a management nightmare.

JoshTriplett• 15 years ago

Why would you need to change your email account? As long as you don't have a compromised password, you shouldn't need to worry about it. The credit card number seems like your primary concern.

Or have people started spamming that list of emails (more so than every email address in existence gets spammed)?

mrzerga• 15 years ago

flagged. blurbs like this are pointless waste of my time, so your email has been revealed, WHO CARES? dont post garbage like this on HN.

loeg• 15 years ago

Better than "how to XXX your start-up" and "business blah blah".

drivebyacct25• 15 years ago

Why should Lulzsec be held accountable and not the ignorant/arrogant developers of the Stratfor/Mtgox/PS3 sites?

Everyone, EVERYONE, should be using something like LastPass, it makes me like MORE convenient than when I used the same password for everything and it's more secure because I have unique passwords everywhere.

As for credit card data, my understanding is that there are legal recourses for sites that store that data insecurely. Sadly, no one has taken my idea of an oauth style payments system where stealing a "credit card number" would be entirely meaningless.

kisom4• 15 years ago

For passwords, I typically use a Mandylion (http://mandylionlabs.com/products/token.htm). It has helped out quite a bit, the downside being I have to run a Windows VM for the token software.

drivebyacct25• 15 years ago

All I'm getting is jargo overload from that page. I don't understand what that offers me over regular password generation/storage, besides having to use a VM would pretty much mean no deal unless I'm missing out on some killer feature.

Stores 50 passwords at a max of 14 characters? I have many passwords over 20 characters and have well over 200 passwords stored in LastPass. LastPass also supports two-factor auth via Google Authenticator now as well.

I really feel like I must be missing something. Its a glorified notepad? With the ability to XOR the passwords with another string for additional "protection"?

jeronimo4• 15 years ago

who cares, waste of my time to read stuff like this on HN

My docs got dropped in the Stratfor leak

Related Stories