Hacker News Reader

Comment by dboreham | Hacker News Reader

How do you exfil data on 1.3M users by guessing a few passwords?

Well, it seems they took advantage of a feature that indicates who you may be related to, so they must have guessed Genghis Khan's password.

MONGOLIAN71682@HOTMAIL.com and password "SHADOW_RAIDERZ123" that was easy.

Each valid login+password got the scrapers many many profiles.

23andMe has a feature that lets you see people you're related to and view their profiles. My guess is this feature had few rate limits and allowed you to view the profiles of people very distantly related. So perhaps with a couple thousand valid account logins you could eventually look up the profiles for 1.3M users.

They're not guessing passwords, they have a list of e-mails and passwords from other leaks and are hoping the users are using the same credentials on all their accounts. Since password managers aren't mainstream yet it works.

How do you hide authenticating 1.3+m unique accounts? A distributed system? A mess of VPN's? Or they don't hide it because the auth system is not checking for 1.3 million auth attemps?

The latter. Forget tracking auth attempts:

> The researcher added that he discovered another issue where someone could enter a 23andme profile ID, like the ones included in the leaked data set, into their URL and see someone’s profile.

Ah, so they were able to use a few accounts, then fuzzed the URLS to victory...

Amazingly incompetent.

I recently had to explain to a tech lead that you can "never trust the client," because any dedicated party can just curl around your UI and send whatever HTTP request they want.

I remember when this first occurred to me from me deciding that I didn't want to click download a series of things on some website where this was the intended use. I wrote a small shell script to curl it for me, and somewhere during the process of writing the script, I realized the true "power" of this. Ever since then, GET with search queries were protected against in everything I wrote from that point forward. Luckily, that was in the late 90s, so it's been a minute.

Reply on news.ycombinator.com