Comment by nonrandomstring | Hacker News Reader

Comment by nonrandomstring | Hacker News Reader

Parent Full thread

nonrandomstring

> What do we do now?

I was thinking - if I had this, what could I do with the personal records of a billion Chinese people?

And I must conclude - absolutely nothing. It's of no interest to me.

Now, I probably lack sufficient criminal imagination, but the point is stuff like this is hard to fence because there's a very small market of buyers. In an article I wrote for Routledge about the markets for stolen digital data (specifically movie and album releases) I suggested that the underlying problem is there's symbiosis between leakers and buyers.

If you want to do anything, target the buyers. There's less of them. Don't try to secure inherently insecure massively centralised systems (Blotto + Dolev Yeo problem) . Or chase leakers. Or blame users. Or fire the CIO. Find out who wants this stuff and take down the show from the demand-side.

But hold on! Guess who the buyers are. And guess what sincere will exists within "law enforcement" to tackle this sort of "cybercrime".

This type of information is used all of the time to discover and compromise web accounts of the victims in bulk. There are scripts that take in this data as input and will do a lot of the work for you to take over their accounts (or at least find their active accounts across web). Any additional data you are able to trawl can be sold itself, leaving the next steps to more advanced or motivated threat actors.

It’s also useful for more targeted social engineering attacks.

I suppose you could go the other direction. You could be an international human rights organization, and treat the database like a billion claim checks.

Having a definitive record of people's existence would make it more difficult for the authorities to skimp on natural disaster rescue efforts then lie about casualty numbers, treat citizens as canon fodder for military purposes, or simply wipe out individuals who have grievances with the government or powerful functionaries.

After my data was leaked, now scammers periodically call my phone to let me know that "I'm from bank security and someone's recently tried to change phone number for your bank account" or "I'm from police and we're opening a criminal case against you". It was fun first few times, but now I'm considering changing my phone number because I could miss an actual bank security call.

And I'm sure that plenty of gullible people were scammed and lost their money because of those leaks. When someone calls you, knows your full name and talks with enough confidence, it causes some trust.

My voicemail now indicates that I am no longer answering unknown numbers and to please leave a message or text me if you can.

It’s a little lengthy, but it’s cut down on the number of spam calls I actually answer specifically and I’m reasonably sure that anyone who actually needs to get a hold of me has an easy path to do so.

Don't verify anything. Just call the bank back using a phone number you can verify with 100% certainty.

Banks themselves go out of their way to say that they will never, ever proactively call you for something like that. At least in the US.

You have email addresses I believe. You could spam billions of chinese people with some scheme. It doesn't have to be believable, but you can bet out of billions of people you will capture some naive or mentally ill people who will fall for your scam and potentially allow you to clear them out of everything they have.

> what could I do with the personal records of a billion Chinese people?

you use personal details to tailor phishing scams to the victim

If I know you have a grandson that lives in XinJiang I can cold call you and say i'm from the xinjiang police and we have your grandson here under arrest and then extort money from there

Reply on news.ycombinator.com