Hacker News Reader

Comment by pedrocx486 | Hacker News Reader

Kinda curious how you never find those dumps by a normal search on Google, basically you have no way to know if your data is there if you don't know where to look. I don't use Facebook but I always suspected my data is there due to friends having me in their contacts and using their apps.

View on HN

Google only really does http/https, finding mongodb requires scanning for 27019 and then pointing a client at it. I believe Shodan does this.

It also indexes ftp, but that may unfortunately be coming to an end[1]. Ironically enough, Google's mission statement is still "to organize the world's information and make it universally accessible and useful", which if taken to its logical conclusion would mean such humorously delightful things as scanning for mongos and indexing their contents too...

[1] https://news.ycombinator.com/item?id=20721609

Its almost like people need a tool to tell them not to leave stuff open like that...

Between MongoDB, Jenkins and Elasticsearch, thats a whole ecosystem of pwnability that is probably just starting to be exploited.

> to organize the world's information

..including any private data they can gather on you, via search, maps, analytics, browser..

I wouldn't put it past Google to be already indexing exposed databases (or continue indexing ftp), just not making it publicly available.

Is the background image on the TechCrunch article an UI for monogodb? Or is it just a FB GraphQL query browser UI?

It's MongoDB Compass, a client for Mongo.

You are likely in this database if you added your phone number to your Facebook account. There was a point where if you just typed a phone number into facebook it'd return the person who associated their account with that number.

Even worse. You are likely in this database if even a single one of your contacts uploaded their contacts to Facebook.

The probability of your phone number not being uploaded to Facebook is basically 0.

The article says that each entry has an ID associated with a Facebook account. What leads you to think that there are entries in this dataset for non-users?

It's well known that Facebook collects information on non users as well, frequently called "shadow profiles.", Zuck admitted as much to Congress although he claimed not to know what shadow profile meant. [0]

Whether or not that information was part of this database isn't clear, but it also isn't something the parent comment claimed.

[0] https://slate.com/technology/2018/04/facebook-collects-data-...

That is exactly what the parent comment claimed.

> You are likely in this database if even a single one of your contacts uploaded their contacts to Facebook.

Shadow profiles are old news. The suspect claim is that the parent comment is more informed on this database than the source that published it.

> Whether or not that information was part of this database isn't clear

Yes it is. According to the source this particular public data dump consists only of entries with IDs linked a Facebook account.

> Each record contained a user’s unique Facebook ID and the phone number listed on the account. A user’s Facebook ID is typically a long, unique and public number associated with their account

I don't see why shadow profiles couldn't use the same ID system. why not?

For the parent comment saying they were in the data set: My initial interpretation was they meant if one Facebook user had done so, and you were also a Facebook user, whether or not you had provided your #, it was now associate with you. Your interpretation might be correct though.

Well, I never had an FB account. But I have friends who I know have contact search enabled on their phones, so they probably have my phone and maybe first name.

What would happen if millions of people changed their phone numbers and did not re-register them with new accounts? Does anyone believe a social effort could dissuade the use of phone numbers for tracking people? How much entropy would need to be added to the system before using phone numbers as identifiers became useless?

Security researchers use search engines like Shodan to find these databases, not Google.

Is protocol if you find these things a security researcher not to share the link? I read about these leaks a lot and am always interested in viewing them but never can find them. I assume the links are shared with people carefully because a small number of people will use them maliciously.

Depending on the severity of the breach, yes it's generally considered best practice to notify the service first and give them time to deal with it. Depending on how bad it is, the person reporting it may be compensated for finding it. The company would generally fix the issue, and then the person who found it can make it public (based on their agreement with the company sometimes). The time period is often 90 days, but it could be worked out independently per case.

As with anything like this, consult a lawyer who knows this area of the law of you find yourself in this situation.

It’s never good to disclose PII. Dropping vulns after responsible disclosure is mostly considered ok, not so much with PII - it’s not the victims fault and can be damaging longer term.

If the vendor refuses to fix the issue, providing the media with enough redacted info to have them publish a story will force the vendors hand.

Reply on news.ycombinator.com