Hacker News Reader

I've got another anecdote about exposed information. Saw a car's 'Instagram handle' while next to them (was passenger) and got curious. Sure enough, their car's Instagram handle was public-facing and had links to the presumable owner's instagram handle (public facing) and his wife's handle (also public). Within five minutes of horrified clicking, I found both parents' birthdays, occupations (and photos of locations where they worked at) full legal names and birthdays of their parents, sisters, brothers (they had posted birthday celebrations and funeral announcements with names and dates), their wedding date (and all subsequent vacations they took), residence (posted about buying a new house), their children's full legal names and where they went to school (posted dropping them off at school), and the makes and models of all their cars (posted about buying new cars) over the last 5-6 years. It was a little scary to see how open they were.

What potential dangers do you see from getting this information?

That's likely enough to pull off an identity theft on some level.

Extortion, blackmail, stalking, credible threats of kidnapping or robbery due to pattern of life exposure, et c.

That reminds me when I was still in high school and got to school by bus.

I was around 16 and used to carry a binder with my full name on its back in my hand because it was a bit too large for my backpack.

One day, I got a letter by a guy whose name I didn’t know. He saw me on the bus and thought I was cute, so he decided to look me up and somehow found out my current address. He couldn’t have used the phone boom because my family wasn’t listed, so he must’ve googled me. Luckily, the guy didn’t have any bad intentions but it was very scary nevertheless.

That sounds very scary- I'm glad he didn't have any overtly malicious reason for it. What did the letter say? Was it a "hi date me" type of thing?

Yeah, me too.

Yes, it was essentially a love letter ending with “please call me“.

I actually did text him - since he included his phone number and I wanted to know who he was - but I “ghosted“ him after some months when he kept asking me to come to his home (he was twentysomething so several years older than me).

Afterward, I received one more postcard from him telling me how much he misses me and how he wished I was there with him (he was travelling at that time) but then it stopped.

Wow, that's very weird and very inappropriate of him, hopefully he got in trouble / didn't do that to anyone else. I'd be very anxious if someone had my home address and was harassing me, I'm sorry you had to deal with that.

If they're still on Facebook, their parents are likely there too. Find an uncle and you may have their mother's maiden name.

Facebook still allows non-friends to see the friends list of private accounts through URL tweaking AFAIK.

Don't think I found anyone on facebook when I searched- just an instagram. If that's true, though, that's... par for Facebook I guess? I wish any other better site took off with people (especially teenagers) than something Facebook has their tendrils in.

If you submit the URL thing through the bug bounty, FB will pay out.

That "spam distraction" tactic is scary - no doubt it's being used in the wild!

Surely so!

I just spent a few hours signing up for newsletters I had saved previously and gathering submit POST requests, concatenating it into one script, etc. I honestly can't think of any white hat use for it (besides what I did). I haven't open sourced it, because it will probably be used for malicious purposes by script kiddies 99% of the time, and I don't really want that associated with me.

It was, a few years ago Mailchimp and a few other ESP's were subject to major listbombing attacks.

https://wordtothewise.com/2016/08/subscription-bombing-esps-...

Unfortunately nearly every mailing list sends a confirmation email. that's good enough for an initial flood...

A better solution would be "send an email to newsletter@domain.com"! Very surprised this hasn't been implemented

Ah, but then fewer people would "sign up for the newsletter" by failing to toggle the box on the checkout page. Then your list membership growth rate would go down! Can't risk that, no wonder it hasn't been implemented.

Mailchimp turned off double opt-in as the default list behaviour, presumably as a result of this listbombing taking place.

It eliminates the immediate flood from the listbomb attack but does mean the email address now has to opt-out from every list they've been susbcribed to.

https://wordtothewise.com/2017/10/mailchimp-changes-signup-p...

This is an area of sec research I'm very interested in: classic attacks with a major IRL impact.

It's similar to social engineering but that's not a correct comparison. More like an attack that hops the cyber<>physical barrier but uses standard TTPs from pure-cyber.

There are proof of concepts like this out there, to start. It's like you DDoS'd someones real life - that's intense.

> It's like you DDoS'd someones real life

No... It's called "doxxing".

DDoS is completely different.

No, it's called DDoS'ing, at least for threat model that I'm referring to.

The user just near about doxx'd themselves by all the OSINT that was available. That's not particularly interesting. Trolling with IRL effects is a the better peer as well, in that case. It's also similar to malicious pop-ups in a browser, but a browser never had the life-governance abilities that a smart phone has now.

What is interesting, from an exploit dev standpoint, is that in a sense you can DDoS someone's life by overwhelming their human data intake systems of notification-based services, which they use to govern their own behaviors.

Think of this in terms of a notification == a connection, and human == router.

* Baseline: 5 notifications per hour -> parseable by a human with 1 brain and a single iphone to triage them. No discernable effect on ability to rely on other key notifications (calendar alerts, banking messages, so on).

* Elevated from baseline: 5 notifications per 10 mins: odd, but still parseable, maybe calendar alerts and watching for an important email take a back seat.

* Malicious DDoS: 5 notifications per minute, on repeat: you don't know what's going on, it is overwhelming, you can't particularly turn off a phone because you still need the calendar app, and so on.

When the notification system, taken in aggregate, is providing some key service to how a person runs their life, overwhelming that system is a DDoS.

Another vector: many calendars such as Gcal and especially with recreational users, allow appointments to be dropped onto the calendar. This is a common sales tactic too. Generate N appointments, overwhelm a calendar, and it's up to the user to remove malicious appointments manually vs. a very bulk, automated appointment attack. DDoS as well.

I think they meant DDos'ing as in the person gets overwhelmed with notifications and can't actually see the notification about the password change. (i.e. the person's attention is the service)

You got it!

Like I sort of referenced in my OP, it's part of a group of exploits which still lacks firm industry terminology, but definitely are out there.

The only firm things I can ID so far in this cyber<>physical attack space is:

- cyber<>cyber TTPs definitely apply in a certain way

- Vulns->exploits can start with CIA-like threat modeling (so ID'd starting point)

- the indicators of compromise show up both in the cyber domain, and physical domain, as part of a single attack

- it's a greenfield on defining what an IOC in the physical domain part of this attack is. If you attack plant watering system, is there anything unique on the outcome of plants that indicate it's definitely cyber?

- The physics of the real world play a large role in governing how the physical aspect of the attack occurs(my human ability to read, process notifications at certain scales of notification receipt)

Another example is "AI/ML" can generate financial reports that are believable. If you consider the behavior that a lot of folks trade purely on Twitter news, you can model exploits via thinking how you could compromise the integrity and availability of financial reports that people trade off of (I and A in CIA) by:

- Integrity: if you can get the fake report to get uptake on Twitter on key nodes, "the truth" of a company's finances can be replaced via this false report, as you have a legion of twitter traders following a much smaller legion of key accounts for trading views

- Availability: if you generate enough volume of this fake report vs. the real report, a metric humans use to eval the truth of things is "is it in every newspaper," so you can reduce the availability of the real report as it is drowned out.

And so on... there's definitely real attacks here, but they exist a bit outside of current security models. Very cool area.

Oh, I see. Sure I guess. But it's not a DDoS either. It would just be a DoS.

Nope, it's a DDoS:

"A DoS attack is a denial of service attack where a computer is used to flood a server with TCP and UDP packets. A DDoS attack is where multiple systems target a single system with a DoS attack. The targeted network is then bombarded with packets from multiple locations."

Multiple apps engaged to notify 1 human, multiple systems attack -> single system.... DDoS.

> Found their (current!) password for email, social media, etc (but not bank) from a breach from 2016 (!!!)

When a friend of mine asked me to do a similar challenge, I actually forgot to check password dumps.

Then again, I also didn't bother spending the $10 for ancestry information which probably would have yielded yet more info (mother's maiden name, etc). But I kind of lost interest after reading several dozen pages of their Twitter feed.