Salma Typhii
A
I get that a breach is never good just like breaks in infection control are never good, but how much, realistically, can someone do with what data Spoutible has of mine? Yay, you found my throw-down email and phone number 🤷🏻‍♀️
Isa-Lee Wolf @IsaLeeWolf
So I was on the bad site for a second, and found this.

And now I am torn between pointing out that Christopher didn't write it, I did, and not stepping my toe in the fetid waters of twitter.
10:41 AM - Feb 06, 2024
10:51 AM - Feb 06, 2024
Avatar Avatar Avatar
0
45
13
Isa-Lee Wolf
A
In response to Salma Typhii.
EXACTLY!!

And I don't think anyone was actually hacked, I haven't seen anything confirming it.
11:06 AM - Feb 06, 2024
2
11
Salma Typhii
A
In response to Isa-Lee Wolf.
As far as I could tell it was more of a proactive, white hat, hack where a security expert found a flaw, alerted the Spoutible team, who then alerted us? You know, the way computer security should work
11:10 AM - Feb 06, 2024
1
12
Dan Nguyen
A
In response to Salma Typhii.
I don’t think that’s the case. Someone contacted Troy Hunt alerting him to the existence of the file of 207k records. It’s likely they saw the data being sold on the black market and told Hunt about it. Why would a white hat researcher scrape all 200k records before notifying security experts?
11:55 AM - Feb 06, 2024
2
3
Isa-Lee Wolf
A
In response to Dan Nguyen.
Where did you get the data being sold on the dark web from that excerpt?

It very clearly says that the person who "found" the vulnerability reached out to Hunt.

Not the data.

The vulnerability.
12:11 PM - Feb 06, 2024
1
1
Dan Nguyen
A
In response to Isa-Lee Wolf.
"Where did you get the data being sold on the dark web from that excerpt?"

To get 207k user records (i.e. the entire active userbase), you would have to scrape the API 207k times. This isn't hard, but it also isn't "white hat" behavior — hitting the API just ONCE would prove the vulnerability
12:14 PM - Feb 06, 2024
1
5
Isa-Lee Wolf
A
In response to Dan Nguyen.
So from nowhere in the article. You just made it up based on how you think they may have come to that number.
12:15 PM - Feb 06, 2024
1
2
Dan Nguyen
A
In response to Isa-Lee Wolf.
The notifier sent Hunt "a file with 207k scraped records". You're right, it's possible someone did all that work (which would risk exposing them to criminal investigation) and told Troy about it, out of the goodness of their heart.

The more likely case is this person found the file, then told Hunt
12:19 PM - Feb 06, 2024
1
0
Isa-Lee Wolf
A
In response to Dan Nguyen.
Ridiculous. And may I remind you, five seconds ago it was a "leak," and now you're saying yes, it was a scrape.

The reality is you have no idea how they got to that number, They may have simply estimated the number of users on the site,

Unless you have proof, that's quite an allegation.
12:25 PM - Feb 06, 2024
1
1
Dan Nguyen
A
In response to Isa-Lee Wolf.
Sorry do you think "leak" and "scrape" are 2 different things? Yes, it was a "leak": the API was accidentally misconfigured to return more data than intended. And someone was able to repeatedly hit up the API (i.e. scrape it) for 207k user records.
12:42 PM - Feb 06, 2024
2
4
Isa-Lee Wolf
A
In response to Dan Nguyen.
Just want to be clear about your claim to fame, Dan, are you a security expert?

Do you not realize there is a difference between leaks and scrapes?

Did you get this worked up about the leaks/scrapes in this article?
12:49 PM - Feb 06, 2024
1
1
Dan Nguyen
A
In response to Isa-Lee Wolf.
I wouldn't label myself a "security expert" but I've had a career in scraping publicly-facing corporate data for investigative projects, so I know the lingo and surrounding law.

In this context, the API *leaked* data. And someone "scraped" it, I'm not sure why this is a contentious point for you?
12:55 PM - Feb 06, 2024
3
0
Dan Nguyen
A
"Did you get this worked up about the leaks/scrapes in this article?"

I mean, yes? But none of those leaks exposed password reset tokens. It's one thing to have to change your password, it's another to leak data that allows an attacker to silently access ANY account.

Again, from Hunt:
In response to Dan Nguyen.
01:00 PM - Feb 06, 2024
0
0

 

{{ notificationModalContent }} {{ promptModalMessage }}