Slashdot Mirror
HIV Dating Company Accuses Researchers of Hacking Database (csoonline.com)
itwbennett writes: Slashdot readers will recall the story posted last week about the misconfiguration of the MongoDB database that powers Hzone, a dating app for the HIV-positive, and the ensuing threat of HIV infection the company hurled at DataBreaches.net, who sent the notification. (Hzone later apologized.) But that's not the end of the story. Among other twists and turns that point to a CEO who was in way over his head, in several emails to Dissent, the admin of DataBreaches.net, Hzone CEO Justin Robert accused Dissent of changing the Hzone user database. But follow-up emails suggest that the company couldn't tell what was accessed or when, as Robert says Hzone doesn't have 'a strong tech team to maintain the site.'
I know this warning is unnecessary here, but do not follow the second link in the summary (same as the one under the title). This is the first time a /. summary has been better written than the source article.
What content there was to be found between the typos and grammar errors indicated that the immunocompromised dating site owners are incompetent, sue happy, and really bad liars. (A fairly common combination, so nothing unusual there.)
"...point to a CEO who was in way over his head,"
Aren't they all, these days?
But, but, I have plenty of requests hitting my web server that have user agent strings matching "*research*", same for some abuse contact addresses for the IP (whois lookup) and they don't even set the evil bit so I thought it was OK to let them through.
Do you mean I should block those requests?
Everything I write is lies, read between the lines.
The Hypocrisy of it all is sickening
While I am incline toward agreement with you where exactly is the hypocrisy? Researches in other fields have a long history of being caught doing things that were illegal or determined to be unethical we can and do call them criminals, I am not sure we stop calling them scientists and researches. Its seems very possible to me to be both a criminal and researcher.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
I performed a reverse on the domains when the original controversy set out. This guy isn't HIV positive, he's just a guy in China trying to make a buck off others. He also has an app called SugarD and there are many other domains he has registered in an attempt to have a successful business. The company is pretty much run by him and whatever support he may have hired, which is the reason hzoneapp doesn't have a solid technical team. Check out the self published prweb for hzone, he calls himself "Justin M, CEO." Looks like you made a slip up there with keeping your name consistent Mr. JianQiang.
One way or another, hacker's exploits and malware share attack vectors.
Perhaps they're infectious...
Just to give everyone the FYI, Mr. JianQiang also has the following domains: tophivdatingsites lesbiandatingonline singleparentdatingonline singleparentfish pozty - alas to hzoneapp ubaliaoyn - some chinese site xoiiixaab - some chinesesite He stopped the other site projects when he scored with hzone. He's not a single parent, he's not lesbian(well he may like women) and he's certainly not POZ. He's just a Chinese man screwing everyone over with this charade. So Mr. JianQiang, drop the act.
And what if there's a clearly open port that provides unfettered access?
Say port 80 brigs up phpMyAdmin and is configured to allow access without a password?
Is this criminal or just browsing their website?
Failure to properly and fully secure your externally facing computers is your fault and anyone accessing it has every right to. It is NOT synonymous to leaving your door unlocked.
There are two types of people in the world: Those who crave closure
There's no reason they'd be subject to HIPAA nor be fined under it. They're not medical providers. Users of their system willingly disclosed their status to a third party, non-medical provider with the explicit purpose of being placed in contact with other people who had also disclosed their status and the understanding that their status would be disclosed to those other people in the process.
Whether there are any fines related to general personal information breach, I don't know; but I kind of doubt it. Describing those laws as "a bit loose" would be charitable.
http://www.databreaches.net/mi...
I hadn't realized it the first time around but this was also a MongoDB database. Not that it really matters, the CEO makes them all sound incompetent.
Chance favors the prepared mind.
Perfect is the enemy of good.
Isn't that a crime? If so is one bound to report it? I mean, if you know there's going to be a serious breach, especially if the governor is on the list, holy crap man.
Chance favors the prepared mind.
Perfect is the enemy of good.
No it is not a crime not to report violations, not yet anyway. However the fact that the OP failed to report the violations is also part of the problem.
You are a researcher if you buy the software, install it, and then see what you can do. If you try to get into a system belonging to someone else, you are a fucking criminal.
You are aware the researcher simply saw a "HIV dating site database dump.zip" up on bittorrent and decided to inform the site owner that he may want to check that shit out to see if it is theirs and if so maybe fix their site up, right?
If I found something of yours across town in the middle of the street, that you put your own name and address on, why am I a criminal for returning it to you or informing you where I found it, if I am not the one that took it and put it there?
No, it's more like a business or storefront leaving the lights on and the doors unlocked without any staff present and without any sort of door chime or camera. While it's not right for patrons to start looking through the drawers or the paperwork or the receipts, let alone steal any merchandise, it should be expected that some people will do this and it's the obligation of the entity to take steps to prevent it.
Those that do not understand at least the basics of security and do not take steps to learn the specifics or to hire-out for them have no business operating on the Internet. They deserve whatever civil legal repercussions are brought down upon them. It doesn't matter if they too are victims when they have a responsibility to protect themselves and their users from a world that is understood to be unkind.
Do not look into laser with remaining eye.
I don't know. How long will morons keep pretending that if we shun and punish those who disclose vulnerabilities, the vulnerabilities won't be exploited by malicious actors?
What are the ratio between (a) criminals using 0-day exploits they've found out through own research or obtaining them from other criminals, and (b) criminals using N-day expoits they have been made aware of by public disclosure?
As a sysadmin, I would have to say the (b) is by far what hammers the systems the most these days, and costs my company quite a lot of work and resources. I'm not saying that is work that shouldn't be done, but that the cumulative cost of disclosure for the sake of disclosure can be higher to society than the cumulative cost of 0-day attacks.
Assuming OP is in the US who would OP report it to? Perhaps it's not too late.
Chance favors the prepared mind.
Perfect is the enemy of good.
No, it's like moving your house to the middle of the road, taking the front door off the hinge & expecting no one to walk in.
There are two types of people in the world: Those who crave closure
If it's in the middle of the road (internet), those are the rules.
There are two types of people in the world: Those who crave closure
Clueless idiot threatens people anonymously online.
No one runs away scared.
There are two types of people in the world: Those who crave closure
So web browsing isn't allowed?
Or just maybe it's not the same principal as a house.
There are two types of people in the world: Those who crave closure
And furthering this analogy, this reaction is like trying to crucify the one guy who goes through shit to find a number to call to let someone know "hey, your shit's unlocked."
it should be expected that some people will do this
Not relevant to the questions of whether it's moral or legal.
What do you think listening for connection requestion on port 80 mean?
Serving stuff on a internet facing server without password is EXACTLY like holding a sign that invite everyone to come in. Deal with it fucktard. The Internet is no "safe space" for over sensitive millennial.
This is like forcing a Mom and Pop candy shop to have armed guards on the payroll just in case someone breaks in and steals the candy, and exposes all the candy customers in the store. As to shame them for being the cause of obesity in the world.
Except the whole things happens in world with Star-Trek like teleporters and replicators. So the case of "some breaks in" are happening on massive scale.
It's not merely one guy deciding to go berserk, and then needs to walk to the (only) nearest Mom and Pop candy shop.
It's a guy deciding to go beserk, and then instantly teleport in front of all Pop and Mom shop of his country and breaking in all of them. Every single one. All in the same hour.
That's the power of Internet.
And amidst all this he also happens to also break the window to the bed room of little Shirley, because she happens to have be eating the same candy as the one in all Mom and Pop shop.
Also, the guy don't beam himself in front of all these windows. He beams some random chinese guys to break the windows for him.
In fact it's not the chinese guys who get beamed. It's their roombas/neatos/whatever robot they have at home. The chinese guys owning the robots don't even notice their little escapade and meanwhile the berserk guy has a standing army of robots systematically breaking all the Mom and Pop shops of the country.
And even if the robots are all chinese, the berserker doesn't really need to speak chinese, he only needs to point his finger in the correct direction, other have developped "finger-to-chinese" dictionnaries for him.
That's the power of large scale automatic script-kiddie attacks on the Internet.
Also the government has modified the building code and has mandated that every single shop or house has an extra separate door that can't be locked. (Just in case that the police need to be able to quickly come inside). But they have painted the door the same colour as the wall so they hope that nobody will notice.
In other words: the current state of world-wide computer security is abyssimal, and our brains accustomed to the physical world (where everything necessitate slow travelling around) are poorly equipped to grasp the menace cause by the systematic and quick access offered by modern means of communication.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Immoral and illegal things happen all of the time. You are obligated to prevent them from happening to you. We have attempted to build a society that reduces the number of immoral and illegal things that happen and reduces the number of people victimized, but ultimately the individual is the final line of defense against becoming a victim.
Do not look into laser with remaining eye.
Guess what open ports say?
'Come on in'.
There are two types of people in the world: Those who crave closure
open ports = open doors
On the internet = with an invitation to come in.
Deal with it.
There are two types of people in the world: Those who crave closure
Worldwide, more straight people have HIV than gay people, by a huge margin. You probably mean the U.S. though, in which case:
"MSM accounted for 54% of all people living with HIV infection in 2011, the most recent year these data are available."
So, straight people would appear to be 46%, hardly a "tiny fraction of a percent".
http://www.cdc.gov/hiv/statistics/overview/ataglance.html
The right to protest the State is more sacred than the State.