Slashdot Mirror
MongoDB Config Error Exposed 93M Mexican Voter Records (csoonline.com)
An anonymous reader cites an article on CSOOnline: A 132 GB database, containing the personal information on 93.4 million Mexican voters has finally been taken offline. The database sat exposed to the public for at least eight days after its discovery by researcher Chris Vickery, but originally went public in September 2015. Vickery, who works as a security researcher at Kromtech, discovered the MongoDB instance on April 14, but had difficulty tracking down the person or company responsible for placing the voter data on Amazon's AWS. He first reached out to the U.S. State Department, as well as the Mexican Embassy, but had little success. The database contains all of the information that Mexican citizens need for their government-issued photo IDs that enable them to vote. Along with their municipality, and district information, the database records include the voter's name, address, voter ID number, date of birth, the names of their parents, occupation, and more. [...] Given that the database has been online since September 2015, it isn't clear how many people have accessed the records. Additionally, the actual owner of the account hosting the data remains unknown.
Look at all this fail they've enabled with their shitty defaults.
Even mysql demands that I configure a root password when I install it.
It's happened with Turkey and now Mexico (although with Turkey that was more malicious).
We haven't had this sense of digital identity that we have today. In the US, our tax numbers are secrete (SSN numbers) but in many other countries, tax ID numbers are considered public or non-identifying (Australian's TFNs and NZ's IRD # come to mind).
Go back 100 years and you didn't have passports or work visas. If you could speak the language in your destination, you could go and attempt to work and survive (and if you failed there was a good chance you'd end up a slave; either by selling yourself or being sold).
Today you are attached to a digital identity. It is you, and a you that you cannot escape. Your crimes will always follow you. You cannot live or work anywhere without that digital identity of you being allowed to.
This just needs to happen in the US. The release of everyone's names, addresses, SSNs and SSN questions/histories would be almost a Fight Club like reset.
unit file is more secure! MongoDB won't even start, much less expose data!
Less than a month ago http://www.theregister.co.uk/2...
Florida's voter rolls were uhhhh Hacked! http://flvoters.com/by_name/in...
I have been trying to get a job as a brick layer for the last 2 years. However, because my name is not Hernandez, I am summarily disqualified. Now my name can be Hernandez. Finally I will be able to get a job in the country of my birth.
Illegal immigration: "It worked for the Native Americans. It worked for the Romans. It can work for the USA too".
-Senator Bernie Sanders.
I expect this to be fixed promptly because the Mexican government, unlike the USAian govt. cares about it's citizens.
https://www.youtube.com/watch?...
Webscale!
... and start treating it as a key-value file system and it all makes sense. Sadly the mongo devs want us to think its a competitor to mySQL or even Oracle. Yeah, right.
Amateur hour DB + amateur hour admins = trouble ahead.
"MongoDB Config Error Exposed..." is the new "Florida Man..."
It's sad to see that "most" things working is now acceptable for Linux. I miss the old days when the quality bar was set much higher.
When you have a group of kids, led by Poettering, working on something as critical as init, you're just going to have problems. They just don't have the experience necessary to understand how important it is to not have bugs and to not, as Linus has ranted about several times, ignore bug reports.
Why would you expect someone that cares about the desktop to care about server or developer problems?
only pawn, in game of life.
This happened in 2003:
U.S. government purchase data on Mexico’s 65 million registered Voters
A probe has been launched into how the Atlanta-based corporation ChoicePoint Inc. was able to purchase data on Mexico’s 65 million registered voters as well as six million licensed drivers in Mexico City.
According to an investigation carried out by the Mexico City newspaper Milenio, ChoicePoint was commissioned by the U.S. government to obtain the data.
...
According to Milenio, low-ranking Mexican government employees routinely sell electronic information to data-gathering groups in a clandestine manner and pocket the proceeds.
ChoicePoint also offers information on 90 percent of large corporations operating in Mexico, disclosing data on names of leading executives, phone numbers, electronic systems and levels of capitalization.
Whatever happened to Choicepoint? Are they still in business?
For ~ 83 million registered voters, that's 1.57KB per voter. It's a lot, but it's not obscene. You can see a sample redacted db record on the article. They have voter ID laws, so they have a bit more info, including maternal/paternal parents.
You can't even store 1 byte per voter on less than 50 floppy disks.
Oh my, 132Gb of tasty, tasty user data. It's like an all-you-can-eat hacker buffet.
Just cruising through this digital world at 33 1/3 rpm...
We'll finally be able to steal our jobs back from Mexico.
Their focus is desktops so the quality isn't a high bar, as you noticed. I miss the old days when every thing was expected to work every time.
I wonder if El Chapo is worried about his personal data being stolen from the last election....
As if those children care.
You should have used a US address on those credit card applications. The Mexican government would probably take notice of their registered voters living in the USA and build Trump's wall after all- whether he is elected or not.
Trump hackers can now vote in Mexican elections using stolen info. Those shadow Mexicans can now vote for their government paying for that wall that Trump wants to build. His plan now seems possible.
sysvinit never worked as expected every time. I'm not saying systemd does either, but don't go and act like sysvinit is the most perfect thing out there.. It blows too.
The DB was hosted on Amazon AWS. By default the port Mongo is using is not open to the world. You'd have to purposely go into the SecurityGroup for your EC2 server and open up the port to all.
Elections are harsh in Mexico, with the PRI (Institutional Revolutionary Party) doing whatever it takes to hold onto power. This might very well be on purpose to extract data on voters to fake votes and inflate ballot boxes. A good bribe to the sysadmin or even a harsh threat (political parties are known to have nexus with organized crime) could have been the reason for this.
Most? As if that is acceptable. It might be in the Windows world, but Open Source should demand better.
48 States of America united to a Union with States of the Several States and U. S. States composed of outlying islands conquerred by navy or armed forces not part of America yet known colloqially as Kingdom of Havaii and Alaska and Puerto Rico.
Fed corp U.S. != America.
U.S. States != 48 united States of America.
Civil war union States of the United != confederation The United States of America.
Learn to Title 18 US Code. Ye parisite!
https://www.youtube.com/watch?v=b2F-DItXtZs
Sound like they should have just saved it on /dev/null
It sure seems that most people who use nosql databases have no clue. No idea about what security is, no idea about data integrity, just no freaking clue at all.
BUT, BUT IT'S WEBSCALE!!!!
Who gives a shit about data integrity, right?