{ "version": "https://jsonfeed.org/version/1", "title": "Leaks and hacks on The Braindump Blog", "icon": "https://www.gravatar.com/avatar/2cd1cf37f23381b39225041fc80e9595?s=96&d=https%3A%2F%2Fmicro.blog%2Fimages%2Fblank_avatar.png", "home_page_url": "https://thebraindumpblog.com/", "feed_url": "https://thebraindumpblog.com/feed.json", "items": [ { "id": "http://adammedcalf.micro.blog/2026/03/22/the-osint-techniques-book-is.html", "title": "The 'OSINT Techniques' book is surely the bible for all things Open Source Intelligence", "content_html": "

📚 Finished reading OSINT Techniques: Resources for Uncovering Online Information by Michael Bazzell and Jason Edison.

\n

This is surely the absolute bible of approaches and methods for anyone interested in pursuing the art and science of Open Source Intelligence, aka OSINT, as a hobby or a career, written by a true expert in the field. Note that it’s very much a “how to do” rather than “interesting stories about” type of manual, although a few short case summarise are presented as examples.

\n

I think I read somewhere that some university courses on the topic use it as a textbook, and I can see why. It’s not necessarily the cheapest book to purchase but if you’ve an interest in the topic then reading its nearly 600 pages has got to be worth it.

\n

Part of the book is all about setting your computer environment as a virtual environment perfect for safe and effective OSINT work. This involves running a virtual Linux machine.

\n

Once you’ve got that up and running, there are countless OSINT-adjacent tools he advises how to install and use. It must be said that, if you want to follow this section, a certain amount of nerd computer skill (or willingness to learn) is going to be useful. The author advises against blindly copying and pasting the commands he suggests - which is anyway necessary, because so many of these tools are updated, changed, or deleted every day, as do the information sources some of them rely on. Even with some experience of the technologies involved it took me some time to figure out what to change to get everything installed.

\n

But it was all perfectly doable. And once you’ve done that, well, you presumably have a good amount of the preparation you need to succeed done - and possibly improved your computer skills in general. Which is important because tomorrow new tools will appear, old tools will stop working, new data will surface, old data will become more restricted. It is an ever-evolving field to say the least

\n

Some of the data sources it mentions are a bit US focussed, especially perhaps the people search sites. I’m guessing that’s a mix of that’s where the author lives mixed with the fact the USA has fewer data protections than my own country, so there’s more supposedly “legitimate” data floating about breaching each citizen’s privacy. But we live in a global online world - after all, we all use the same social networks for better or worse - so there’s more than enough to get on with no matter where you live or where you’re investigating.

\n

And besides, part of the point of the book is to make you self-sufficient, to teach you the flexible skills you need to work with tools and data far beyond the many presented directly in the book.

\n

It also became quickly apparent to me that even performing a pale imitation of the sort of rigorous investigations the author’s company conducts is at least a full-time job. But even for those of us that who are not in a position to follow that route there’s a lot of good stuff to learn here. In terms of how to approach the more minor investigations that you might like to pursue (or even how much interest you have in the field itself). And also, conversely, how much data there probably is floating around about you - unless you have gone extremely out of your way to protect yourself (he also sells a book about “extreme privacy").

\n

In fact, why not use yourself as a consenting first OSINT test subject? The results may not please you.

\n

Buying the book also gives you access to some special tools and scripts he developed to make your life easier. The author’s website actually has a ton of great content and tools available for free that you can use directly for your investigations or at least take a look at to get to see if this book feels right for you. I can’t imagine a better intro to the actual practice of the topic than this book though - as long as its length and detail doesn’t prove too intimidating to you. But “detail” is surely the name of the game in OSINT work.

\n

Glancing over the section names included in the book might provide some insight as to what’s included:

\n\n

100% recommended for anyone interested in the practical side of the OSINT field.

\n\"A\n", "date_published": "2026-03-22T12:49:53+00:00", "url": "https://thebraindumpblog.com/2026/03/22/the-osint-techniques-book-is.html", "tags": ["Media diet","Computing","Books","Social media","Technology","Leaks and hacks","Useful software","Privacy"] }, { "id": "http://adammedcalf.micro.blog/2025/07/16/two-years-ago-a-data.html", "title": "Two years ago a data leak revealed the personal details of the thousands of Afghans who secretly helped the UK's armed forces in the decades long war", "content_html": "

Potentially the worst data leak I’ve ever heard of has just come to light, two years after it actually took place, seemingly after a substantial effort to cover it up by the British government.

\n

In summary, after the catastrophic “betrayal” that was the withdrawal of UK (and US) troops from Afghanistan after twenty years of conflict in 2021 took place, the UK set up a scheme - the Afghan Relocations and Assistance Policy or “ARAP” - where Afghan locals who had helped out with the UK military effort over there could apply to seek safe haven in the UK. This was on the basis that the fact that they worked with us against the Taliban would obviously make them key targets for the Taliban’s cruelty.

\n

A list was assembled of the thousands Afghan folks that had applied for the scheme and their families. Predictably, most of them received no help from the UK at all, so remained in Afghanistan, facing the substantial afore-mentioned risks.

\n

In an extra layer of horror, what has just come to light is that the list of applications - i.e. the list of people who had worked against the Taliban to further British efforts - was leaked. Two years ago.

\n

It seems that we don’t know by whom or why. But we do know that the Ministry of Defence found out about it in 2023 after the data had been posted to, wait for it, a Facebook group.

\n
\n

…it contained 33,000 records among which was “personal information associated to 18,714 Afghans who had applied either to the ex gratia or the Arap [Afghan relocations and assistance policy] scheme on or before 7 January 2022.

\n
\n

As well as:

\n
\n

…details of MPs, senior military officers and government officials linked to individual claims.

\n
\n

The parts of the Conservative UK government who know about this list rightly feared that were the Taliban to become aware of this list then the people on it might be in great danger if seen as “collaborators” by the new Afghani regime and their hangers on.

\n

However, defence secretary Ben Wallace took out a super-injunction such that no-one was allowed to acknowledge the existence of this list outside of the few people that already knew. Various defence secretaries of both major political parties in the UK have kept the injunction going since then.

\n

Journalists started hearing about it but were legally unable to report on it. The vulnerable people who featured on the list were not allowed to be told about it, or even asked to take special precautions, just in case it raised questions. Those most at risk would have no way of knowing that their data was out there in the public domain.

\n

Most British government ministers remained in the dark.

\n

All in all, it was subject to a fairly unique amount of secrecy, until earlier this week - 2 years later - when the super injunction was finally lifted. Just as, it seems, the Afghan Response Route scheme which had been put in place to help the people unknowingly on the list to come to relative safety in the UK was pre-emptively closed, seemingly on the basis that it cost a bit too much money to help save the lives of the people that had risked life and limb to help our failure of a war effort.

\n

This, cruelly, leaves not far off 10,000 people stuck in Afghanistan who I suppose, now at least know they face an enhanced level of risk - but have very few options in terms of mitigating it.

\n

Says a lawyer with a firm who is representing some of the people affected:

\n
\n

This is essentially a database for anyone who wants to know who assisted the armed forces in Afghanistan. If you’re someone whose family member or friend was killed by these individuals I’m sure you will want to take vengeance.

\n
\n

One of the reporters who learned what was going on very early on is a host on the podcast The News Agents. This episode from a couple of days ago, when one of the hosts, Lewis, could finally tell the story that he’d been forced to conceal for the past two years, is quite illuminating on the frustration and possible dangers of exactly what went on.

\n

We should be ashamed. Again.

\n", "date_published": "2025-07-16T17:35:04+00:00", "url": "https://thebraindumpblog.com/2025/07/16/two-years-ago-a-data.html", "tags": ["Politics","Leaks and hacks"] }, { "id": "http://adammedcalf.micro.blog/2025/04/26/a-week-after-a-major.html", "content_html": "

A week after a major hack brought down 4chan and doxxed all its users, it seems like it may be dead for good

\n", "date_published": "2025-04-26T22:34:09+00:00", "url": "https://thebraindumpblog.com/2025/04/26/a-week-after-a-major.html", "tags": ["Technology","Leaks and hacks","Linklog"] }, { "id": "http://adammedcalf.micro.blog/2025/04/16/suspected-chan-hack-could-expose.html", "content_html": "

Suspected 4chan Hack Could Expose Longtime, Anonymous Admins: People might regret using their actual email addresses.

\n", "date_published": "2025-04-16T22:16:51+00:00", "url": "https://thebraindumpblog.com/2025/04/16/suspected-chan-hack-could-expose.html", "tags": ["Leaks and hacks","Linklog"] }, { "id": "http://adammedcalf.micro.blog/2025/03/27/days-after-the-signal-leak.html", "content_html": "

Days after the Signal leak, the Pentagon warned the app was the target of hackers: Via tricking people into using the linked devices feature to devices they don’t own.

\n", "date_published": "2025-03-27T08:15:37+00:00", "url": "https://thebraindumpblog.com/2025/03/27/days-after-the-signal-leak.html", "tags": ["Computing","Crime","Technology","Leaks and hacks","Linklog"] }, { "id": "http://adammedcalf.micro.blog/2025/03/24/the-trump-administration-accidentally-texted.html", "content_html": "

The Trump Administration Accidentally Texted Me Its War Plans: The top US national security brass, VP and all, inadvertently included a journalist in their military ops groupchat.

\n", "date_published": "2025-03-24T23:31:42+00:00", "url": "https://thebraindumpblog.com/2025/03/24/the-trump-administration-accidentally-texted.html", "tags": ["Politics","Leaks and hacks","Linklog"] }, { "id": "http://adammedcalf.micro.blog/2025/03/02/the-winterbreak-exploit-lets-everyone.html", "title": "The Winterbreak exploit lets everyone jailbreak their Kindle", "content_html": "

Here’s something I hadn’t thought about until recently: jailbreaking my Kindle. I came across advocates of this looking into the best way to download my Kindle book collection to my PC before they disabled some of the direct-download functionality I used.

\n

Anyway, at the start of 2025, the “Winterbreak” exploit was released by “HackerDude” which lets you free any model of Kindle from the shackles of its Amazon overlords.

\n

It does this in a way that doesn’t impact your Kindle’s standard features so you can still play just fine in the Kindle ecosystem. But, as ever with this stuff, I’m sure there are no guarantees and warranties are unlikely to be honoured if problems occur. Can’t say that I’ve heard of many permanent problems though.

\n

Why would I want to do this? Well, apart from the whole ‘because I can’ and “to reduce Amazon’s surveillance of my habits and preferences” type stuff, my main functional motivation would be around the highlighting feature, which I use a lot.

\n

Amazon offers that feature already, but with limitations. Right now, if you sideload a book - i.e. use a book you bought anywhere except the Amazon Kindle store, then any highlights and notes you make in it are largely stuck on the devices you use to read them on. Those highlights and notes don’t appear in your Amazon web notebook, which means that tools like Readwise can’t see them. There are workarounds, but they’re all a bit annoying.

\n

Jailbreaking the Kindle would allow me to install non-Amazon reading software that doesn’t have that limitation - KO Reader seems to be what everyone in that world uses - which might be enough to make me do it.

\n

Here’s a screenshot of KO Reader from its official website.

\n\"Screenshot\n

Amazon also has a weird feature where if you highlight “too much” of a book - the threshold can vary - then your highlights are truncated. Instead of full sentences you can end up with half a sentence followed by a “…”. I would guess this is some extremely lame anti-piracy thing? And I probably highlight too much, but still, I don’t like it. I bought the book. Let me highlight what I want. Using a non-Amazon reader software might be the way to never feel that pain again.

\n

My only slight frustration will be the lack of a KO Reader iOS client for syncing reading positions. But when I think about it, I very rarely read the kind to book I want to take extensive notes or highlights from on any other devices anyway.

\n", "date_published": "2025-03-02T16:24:09+00:00", "url": "https://thebraindumpblog.com/2025/03/02/the-winterbreak-exploit-lets-everyone.html", "tags": ["Computing","Books","Technology","Leaks and hacks"] }, { "id": "http://adammedcalf.micro.blog/2025/01/14/lawsuit-allstate-used-gasbuddy-and.html", "content_html": "

Lawsuit: Allstate used GasBuddy and other apps to quietly track driving behavior: Allstate taken to court for covertly using data from apps to track drivers and adjust or cancel their car insurance.

\n", "date_published": "2025-01-14T23:32:07+00:00", "url": "https://thebraindumpblog.com/2025/01/14/lawsuit-allstate-used-gasbuddy-and.html", "tags": ["Bad tech","Technology","Leaks and hacks","Linklog"] }, { "id": "http://adammedcalf.micro.blog/2024/12/05/cybersecurity-has-gotten.html", "title": "Cybersecurity has gotten so bad that even the US government is imploring us to encrypt our communications", "content_html": "

It feels like a topsy-turvy world we’re living in when it’s the US state authorities that are telling us to use end-to-end encrypted messenger services. Back in my youth their government tended to exude rather anti-encryption vibes, or at least anti any encryption that didn’t have a state-sponsored backdoor in it. A backdoor for the FBI is of course a backdoor for everyone who finds it, rendering the whole enterprise a bit pointless.

\n

Which unfortunately has ended up with them (well, us) somewhat reaping what they sowed

\n

Now the US FBI and CISA (“Cybersecurity and Infrastructure Security Agency”) are warning Americans to use encryption for their messages and phone calls. This appears to have been prompted by the discovery of a hack on their communications networks by Chinese hackers - probably the “Salt Typhoon” gang - which is “ongoing and likely larger in scale than previously understood”. Apparently it might take years to figure out exactly where they are and what they did - but at the very least:

\n
\n

“Specifically, we have identified that [Chinese government]-affiliated actors have compromised networks at multiple telecommunications companies to enable the theft of customer call records data, the compromise of private communications of a limited number of individuals who are primarily involved in government or political activity, and the copying of certain information that was subject to U.S. law enforcement requests pursuant to court orders,” the FBI said in a statement issued with the Cybersecurity and Infrastructure Security Agency earlier this month.

\n

So far, the hack is known to have affected major U.S. firms such as AT&T, Verizon and T-Mobile, U.S. and industry officials said.

\n
\n

Or, in a bit more detail:

\n
\n

The hackers generally accessed three types of information, the FBI official said.

\n

One type has been call records, or metadata, showing the numbers that phones called and when. The hackers focused on records around the Washington, D.C., area, and the FBI does not plan to alert people whose phone metadata was accessed.

\n

The second type has been live phone calls of some specific targets. The FBI official declined to say how many alerts it had sent out to targets of that campaign; the presidential campaigns of Donald Trump and Kamala Harris, as well as the office of Senate Majority Leader Chuck Schumer, D-N.Y., told NBC News in October that the FBI had informed that they had been targeted.

\n

The third has been systems that telecommunications companies use in compliance with the Commission on Accreditation for Law Enforcement Agencies (CALEA), which allows law enforcement and intelligence agencies with court orders to track people’s communications. CALEA systems can include classified court orders from the Foreign Intelligence Surveillance Court, which processes some U.S. intelligence court orders. The FBI official declined to say whether any classified material was accessed.

\n
\n

Basically, it seem that they don’t know how deep the Chinese state (not to cast aspersions, but…) has gotten into the system. But if you’re using proper encryption then, to an extent, it might not matter quite so much. They might still see you’re sending messages depending on how exactly the service works, but not what they were.

\n
\n

“Our suggestion, what we have told folks internally, is not new here: Encryption is your friend, whether it’s on text messaging or if you have the capacity to use encrypted voice communication. Even if the adversary is able to intercept the data, if it is encrypted, it will make it impossible,” Greene said.

\n
\n

So, for folk less pre-existingly digitally tin-foil hatted than myself, what is the practical upshot? Probably that you want to message people, and preferably call them, via end-to-end encrypted apps. That’s the recommendation from the US authorities.

\n

Signal is the exemplar of this technology, being free, open-source, and very highly recommended by all manner of experts. But it’s also a network that relatively few people are all that engaged on - so WhatsApp is probably a more realistic option for most folk that also uses encryption by default. Both of those apps can handle text messages, photos and video calls in a securely encrypted manner.

\n

If you’re an Android user messaging Android users, or an iOS user messaging iOS users then you’re probably also safe on the texting front from the point of view of encryption if using the default messages app. But as soon as you cross operating systems they revert to standard text messages which are absolutely not encrypted. So, much as it pains me to promote a Meta product, WhatsApp is probably a good bet for most as an encrypted app that appears to work on almost everything and almost everyone has heard of.

\n

Lest us Britons somehow delude ourselves into thinking we’re safe, folks from our National Cyber Security Centre have also recently provided us some stark warnings.

\n
\n

In a speech at the NCSC’s London HQ, Horne, who took on the role in October, will point to “the aggression and recklessness of cyber-activity we see coming from Russia” and how “China remains a highly sophisticated cyber-actor, with increasing ambition to project its influence beyond its borders”.

\n

“And yet, despite all this, we believe the severity of the risk facing the UK is being widely underestimated,” he will say.

\n
\n

It’s not only China raising the alert - but Russia as well. Earlier this year the NSCS and its allies uncovered a Russian military unit who had been “carrying out cyber attacks and digital sabotage” for at least a few years.

\n

Only last month was one of our cabinet ministers warning that:

\n
\n

There is a danger that artificial intelligence “could be weaponised against us,” McFadden will warn, arguing that the UK is already engaged in the “daily reality” of a “cyberwar,” with hacking efforts coming in particular from Russia.

\n

…

\n

McFadden is expected to say that “Russia has targeted our media, our telecoms, our political and democratic institutions and our energy infrastructure,” and warn that “with a cyber-attack, Russia can turn the lights off for millions of people. It can shut down the power grids”.

\n
\n

The UK Government’s official “prepare for cyber-emergency advice” has the following suggested steps for us to take:

\n\n", "date_published": "2024-12-05T18:09:24+00:00", "url": "https://thebraindumpblog.com/2024/12/05/cybersecurity-has-gotten.html", "tags": ["Computing","Technology","Leaks and hacks"] }, { "id": "http://adammedcalf.micro.blog/2024/12/04/us-officials-urge.html", "content_html": "

U.S. officials urge Americans to use encrypted apps amid cyberattack: Chinese hackers have gotten into key telecommunications infrastructure.

\n", "date_published": "2024-12-04T09:57:44+00:00", "url": "https://thebraindumpblog.com/2024/12/04/us-officials-urge.html", "tags": ["Leaks and hacks","Linklog"] }, { "id": "http://adammedcalf.micro.blog/2024/12/04/hackers-breach-andrew.html", "content_html": "

Hackers breach Andrew Tate’s online university - obtain chat logs and leak data on 800,000 users: Imagine the levels of dystopia those chats probably complain whilst funding the reprehensible life of Tate

\n", "date_published": "2024-12-04T09:56:37+00:00", "url": "https://thebraindumpblog.com/2024/12/04/hackers-breach-andrew.html", "tags": ["Leaks and hacks","Linklog"] }, { "id": "http://adammedcalf.micro.blog/2024/12/03/hackers-leak-data.html", "title": "Hackers leak data from Andrew Tate's 'university' of 'money making'", "content_html": "

“The Real World” - Andrew Tate’s presumably vomitous $50-a-month “learning platform” which promises to teach you how to master the skill of “money making” - has been hacked. Yes, the institution formerly known as “Hustler’s University” has been exposed.

\n

Well, OK, Tate says it hasn’t. But nonetheless data on around 800k usernames, 300k email addresses and a ton of messages that were extracted from their various servers was acquired by a group of anti-Tate hacktivists who shared it with various media publications, and indeed the internet at large via Distributed Denial of Secrets.

\n

The hackers later went on to disrupt one of Tate’s streaming shows via “flooding it with emojis and symbols associated with feminist and LGBTQ+ communities”.

\n

I can’t imagine many things less wholesome than reading the chat logs of Andrew Tate’s subscription-only online course, but there we go, they’re now available to all.

\n
\n

The logs are taken from the platform’s 221 public and 395 private chat servers, which are spread across a dozen “campuses.” According to the site’s metrics, it generates approximately $5,650,000 monthly. The data also includes 324,382 unique email addresses that appear to belong to users who were removed from the main database after they stopped paying their subscriptions.

\n
\n

They later also managed to get their hands on chats from staff servers, where it appears those in power were mostly complaining about grifters and engagement farmers. Who’d have thought those sort of characters would turn up in the Tate-o-sphere?

\n
\n

The chat logs include details about the inner workings of the organization; Tate’s conversations with site moderators; user concerns about widespread site abuse; members farming engagement; and lack of action on content moderation.

\n
\n

The email addresses have been added to have i been pwned so if you’re one of the unlucky ex-subscribers then you can find out if your personal details were leaked at the email level at least.

\n

This isn’t the first evidence of a hack on his place of “learning”. In July, Cybernews reported finding a ton of publicly exposed data including nearly a million user accounts, email addresses and millions of messages. I’m not sure chancing upon a appallingly configured database is exactly hacking to be fair, but it has the same net effect. Despite Tate’s vehement and yet entirely untrue denials, time to re-add The Real World to the list of dubious institutions failing to take any care of the basic privacy and security of its users, as unsympathetic crowd as they may be to some.

\n

As a reminder, Andrew Tate is a self-proclaimed misogynist who is currently on trial for several crimes including “rape, human trafficking and forming an organised crime group to sexually exploit women.”

\n

His “university” is also the only one I’ve seen where the first FAQ is “Is this program suitable for women?”. Despite the answer - which a cynic might claim has strong vibes of “YeS of Course! soMeOf my best friEnds aRe Women!?” - I can’t imagine it’s actually suitable for anyone.

\n", "date_published": "2024-12-03T19:20:14+00:00", "url": "https://thebraindumpblog.com/2024/12/03/hackers-leak-data.html", "tags": ["Leaks and hacks"] }, { "id": "http://adammedcalf.micro.blog/2024/11/30/why-you-should.html", "content_html": "

Why you should use a different email address for every site: The list of things you might want to do in order to maintain some semblance of privacy/safety on the internet these days grows ever longer.

\n", "date_published": "2024-11-30T23:13:09+00:00", "url": "https://thebraindumpblog.com/2024/11/30/why-you-should.html", "tags": ["Computing","Technology","Leaks and hacks","Linklog"] }, { "id": "http://adammedcalf.micro.blog/2024/11/26/helpline-for-yakuza.html", "content_html": "

Helpline for Yakuza victims fears it leaked their personal info: A Japanese government agency was phished.

\n", "date_published": "2024-11-26T11:47:49+00:00", "url": "https://thebraindumpblog.com/2024/11/26/helpline-for-yakuza.html", "tags": ["Computing","Bad tech","Crime","Technology","Leaks and hacks","Linklog"] }, { "id": "http://adammedcalf.micro.blog/2024/11/26/from-the-register.html", "content_html": "

From The Register:

\n
\n

A local Japanese government agency dedicated to preventing organized crime has apologized after experiencing an incident it fears may have led to a leak of personal information describing 2,500 people who reached out to it for consultation.

\n
\n

This is a particularly unfortunate hack given that organised crime gangs have something of a reputation for seeking revenge on anyone whom they might regard as disloyal or a threat to their impunity.

\n

It happened as the result of one of the classic phishing exercises:

\n
\n

A staff member was using his work computer when he received a popup warning him his computer had been disabled and to call a number for support. He did so, followed the instructions, and unintentionally gave criminals remote access

\n
\n", "date_published": "2024-11-26T11:46:17+00:00", "url": "https://thebraindumpblog.com/2024/11/26/from-the-register.html", "tags": ["Computing","Bad tech","Crime","Technology","Leaks and hacks"] }, { "id": "http://adammedcalf.micro.blog/2024/11/18/ukrainian-hackers-breach.html", "content_html": "

Ukrainian hackers breach former Russian commander’s computer: Romanchuk turns out to be more a chronically idle office slacker than a heroic warrior no matter whose side you’re on.

\n", "date_published": "2024-11-18T22:33:13+00:00", "url": "https://thebraindumpblog.com/2024/11/18/ukrainian-hackers-breach.html", "tags": ["Leaks and hacks","Linklog"] }, { "id": "http://adammedcalf.micro.blog/2024/10/21/governments-spying-on.html", "content_html": "

Governments spying on Apple, Google users through push notifications - US senator: Inevitably the centralisation and lack of encryption around push notifications makes them a useful source of surveillance material.

\n", "date_published": "2024-10-21T10:18:53+00:00", "url": "https://thebraindumpblog.com/2024/10/21/governments-spying-on.html", "tags": ["Bad tech","Technology","Leaks and hacks","Privacy","Linklog"] }, { "id": "http://adammedcalf.micro.blog/2024/10/21/governments-are-using.html", "content_html": "

Governments Are Using Spyware on Citizens. Can They Be Stopped?: Companies like the NSO Group are happy to sell commercial spyware to governments who will predictably use it for bad things.

\n", "date_published": "2024-10-21T10:16:24+00:00", "url": "https://thebraindumpblog.com/2024/10/21/governments-are-using.html", "tags": ["Bad tech","Technology","Leaks and hacks","Privacy","Linklog"] }, { "id": "http://adammedcalf.micro.blog/2024/10/04/thousands-of-linux.html", "content_html": "

Thousands of Linux systems infected by stealthy malware since 2021: Researchers discover ‘perfCtl’ - computer malware that, unusually, targets Linux and does all sorts of nasty things.

\n", "date_published": "2024-10-04T22:47:29+00:00", "url": "https://thebraindumpblog.com/2024/10/04/thousands-of-linux.html", "tags": ["Bad tech","Technology","Leaks and hacks","Linklog"] }, { "id": "http://adammedcalf.micro.blog/2024/10/02/exposing-the-flaw.html", "content_html": "

Exposing The Flaw In Our Phone System: Mildly terrifying episode of Veritasium showing how easy it is to hack almost any phone via exploiting the SS7 system.

\n", "date_published": "2024-10-02T22:34:45+00:00", "url": "https://thebraindumpblog.com/2024/10/02/exposing-the-flaw.html", "tags": ["Computing","Bad tech","Technology","Leaks and hacks","Linklog"] }, { "id": "http://adammedcalf.micro.blog/2024/10/02/spy-companies-using.html", "content_html": "

Spy companies using Channel Islands to track phones around the world: The Channel Islands are a hotspot for the SS7 attacks that may allow hackers to track almost any phone’s location as well as intercepting calls and SMS.

\n", "date_published": "2024-10-02T10:22:55+00:00", "url": "https://thebraindumpblog.com/2024/10/02/spy-companies-using.html", "tags": ["Bad tech","Technology","Leaks and hacks","Privacy","Linklog"] }, { "id": "http://adammedcalf.micro.blog/2024/07/02/last-month-ticketmaster.html", "content_html": "

Last month Ticketmaster got hacked by a group known as ShinyHunters, the same group that previously stole data containing details of 70 million AT&T customers.

\n

They got their hands on the personal details of 560 million Ticketmaster customers, with the intention of selling the purloined data onwards for half a million dollars. Apparently the information included at least partial credit card numbers and ticket sales.

\n

No-one, nothing, is safe out there. I guess we all have to operate on the basis of if we enter our data anywhere online then there’s a non-zero chance it’ll be expropriated by bad actors at some point.

\n", "date_published": "2024-07-02T07:02:26+00:00", "url": "https://thebraindumpblog.com/2024/07/02/last-month-ticketmaster.html", "tags": ["Computing","Bad tech","Crime","Leaks and hacks"] }, { "id": "http://adammedcalf.micro.blog/2024/06/30/microsoft-accidentally-leaks.html", "content_html": "

Microsoft accidentally leaks some of the source code behind their PlayReady DRM software.

\n

The technicalities are beyond me, but let’s hope this helps some tech wizard figure out how to remove this particular example of the software scourge known as Digital Rights Management, so that we can permanently store and play any digital content we purchased where and when we want to without so much risk it’ll all vanish some day.

\n", "date_published": "2024-06-30T09:59:54+00:00", "url": "https://thebraindumpblog.com/2024/06/30/microsoft-accidentally-leaks.html", "tags": ["Computing","Bad tech","Leaks and hacks"] }, { "id": "http://adammedcalf.micro.blog/2024/06/24/another-huge-nhs.html", "title": "Another huge NHS data leak following a ransomware attack", "content_html": "
\n

Stolen test data and NHS numbers published by hospital hackers

\n
\n

(From The BBC)

\n

A group called Qilin has shared 400GB of private NHS data on the Darknet, thought to include patient identifiers and blood test results. This seems to be the result of an unpaid ransomware demand, allegedly for $50 million. The action also caused potentially dangerous disruption to thousands of medical appointments.

\n

Qilin is a ransomware group that popped up in 2022 and is thought by many to work from Russia.

\n

The data was not stolen directly from NHS systems but rather from an organisation called Synnovis who provides pathology services for the NHS. Again this shows that it’s really only the weakest link that matters. Hackers only have to be successful once.

\n

It’s far from the first healthcare organisation to be attacked. Just a couple of years ago the NHS once again saw one of the organisations who provides it with IT services attacked. Last year saw 70TB worth of sensitive data from Barts Health NHS Trust held to ransom as well as details of over 1 million patients threatened by an attack against the University of Manchester.

\n

Elsewhere, earlier this year United Healthcare decided to actually pay the ransom, suggested to represent $22 million worth of Bitcoins, when their subsidiary, Change Healthcare was attacked.

\n

It’s all rather terrifying. At least whilst it feels like there’s little indication we really know how to stop it happening.

\n", "date_published": "2024-06-24T11:10:07+00:00", "url": "https://thebraindumpblog.com/2024/06/24/another-huge-nhs.html", "tags": ["Bad tech","Health","Crime","Leaks and hacks"] }, { "id": "http://adammedcalf.micro.blog/2024/04/14/the-mother-of.html", "title": "The 'mother of all breaches' saw billions of confidential data records leaked earlier this year ", "content_html": "

January 2024 saw the probably the biggest known leak of personal data yet known. An astonishing 26 billion records from various sources was found by researchers to available via open resources.

\n
\n

“The dataset is extremely dangerous as threat actors could leverage the aggregated data for a wide range of attacks, including identity theft, sophisticated phishing schemes, targeted cyberattacks, and unauthorized access to personal and sensitive accounts,” the researchers said.

\n
\n

Rather than newly hacked data, it seems to at least mostly be a collection of historical data breaches all handily available in one download. Which makes sense when one realises who the leaker was, outlined below.

\n

Cybernews reports on some of the sites whose data was in the haul - site name and number of records:

\n
\n\n
\n

They set up a site where you can see if your data has been leaked which includes the above collection.

\n

It seems like it was actually a site that offers the service of checking whether your personal data got leaked that was the inadvertent offender in this case. Whoops.

\n
\n

Leak-Lookup, a data breach search engine, said it was the holder of the leaked dataset. The platform posted a message on X, saying the problem behind the leak was a “firewall misconfiguration,” which was fixed.

\n
\n", "date_published": "2024-04-14T08:02:56+00:00", "url": "https://thebraindumpblog.com/2024/04/14/the-mother-of.html", "tags": ["Computing","Bad tech","Leaks and hacks"] }, { "id": "http://adammedcalf.micro.blog/2023/09/05/more-data-leaks.html", "title": "More data leaks", "content_html": "

Another day, another mass data-leak. The one that caught my attention most recently was that the details of 2.6 million Duolingo users were for sale on hacking forums. To be fair, it looks to be less “hacked” and more a product of misusing the DuoLingo API in order to collect data that could include people’s real name, email address and some DuoLingo specifics such as what language the user was learning, as well as some profile settings.

\n

Much of this except email address was technically “public” in that you could see it on a user’s profile or at least access it via the API. But by feeding the API a big list of email addresses, probably obtained from some other leak, one could confirm their association with a DuoLingo account. This join to email gives an obvious opening for scammers to send accurately personalised spams or phishes - “Hey, to continue your French lessons we need you to re-enter your credit card details here” type stuff.

\n

As it happens I wrote about one way to programmatically access your data from DuoLingo the past. But there I promise that I was more interested in the data of my on progress rather getting everyone’s data to sell.

\n

It’s only because I’ve used DuoLingo that this stood out to me I guess. It’s far from the worst leak in recent times. Just this month we’ve seen details of 40 million UK folk leak from the UK Electoral Commission, details of 760000 Discord.io users released (enough to shut the site down for now) and 10 million French residents exposed via a leak from their government’s unemployment registration agency.

\n

Basically, it’s feeling ever more like if anything related to you is on any computer connected to the internet anywhere in some form other than heavily encrypted then you might consider it could potentially become public one day. In some cases even if you explicitly deleted it years ago.

\n", "date_published": "2023-09-05T08:45:00+00:00", "url": "https://thebraindumpblog.com/2023/09/05/more-data-leaks.html", "tags": ["Bad tech","Leaks and hacks"] }, { "id": "http://adammedcalf.micro.blog/2023/03/25/there-was-a.html", "content_html": "

There was a moment where chatGPT was accidentally leaking the title of people’s chats to other users. Only the title, not the full conversation in this case, but it’s perhaps only a matter of time before someone’s bot is hacked or malfunctions enough to share more.

\n

It’s a scary thought when already some people are effectively using them as therapists. It wouldn’t surprise me if the more human-like style of conversation they produce and the ‘texting a friend’ like interface that many of them have is conducive to users sharing a whole lot more personal information than they typically would with other online services.

\n", "date_published": "2023-03-25T08:42:41+00:00", "url": "https://thebraindumpblog.com/2023/03/25/there-was-a.html", "tags": ["Artificial Intelligence","Leaks and hacks"] }, { "id": "http://adammedcalf.micro.blog/2022/07/11/080642.html", "content_html": "

A leak of Uber’s internal files reveals that they knowingly broke the law, put their drivers in danger, lied to and hid information from law enforcement and manipulated politicians and researchers.

\n

Falls in the category of ‘not surprising but somehow still a little shocking’.

\n", "date_published": "2022-07-11T07:06:42+00:00", "url": "https://thebraindumpblog.com/2022/07/11/080642.html", "tags": ["Leaks and hacks"] } ] }