Slashdot Mirror
MongoDB Config Error Exposed 93M Mexican Voter Records (csoonline.com)
An anonymous reader cites an article on CSOOnline: A 132 GB database, containing the personal information on 93.4 million Mexican voters has finally been taken offline. The database sat exposed to the public for at least eight days after its discovery by researcher Chris Vickery, but originally went public in September 2015. Vickery, who works as a security researcher at Kromtech, discovered the MongoDB instance on April 14, but had difficulty tracking down the person or company responsible for placing the voter data on Amazon's AWS. He first reached out to the U.S. State Department, as well as the Mexican Embassy, but had little success. The database contains all of the information that Mexican citizens need for their government-issued photo IDs that enable them to vote. Along with their municipality, and district information, the database records include the voter's name, address, voter ID number, date of birth, the names of their parents, occupation, and more. [...] Given that the database has been online since September 2015, it isn't clear how many people have accessed the records. Additionally, the actual owner of the account hosting the data remains unknown.
Look at all this fail they've enabled with their shitty defaults.
Even mysql demands that I configure a root password when I install it.
It's happened with Turkey and now Mexico (although with Turkey that was more malicious).
We haven't had this sense of digital identity that we have today. In the US, our tax numbers are secrete (SSN numbers) but in many other countries, tax ID numbers are considered public or non-identifying (Australian's TFNs and NZ's IRD # come to mind).
Go back 100 years and you didn't have passports or work visas. If you could speak the language in your destination, you could go and attempt to work and survive (and if you failed there was a good chance you'd end up a slave; either by selling yourself or being sold).
Today you are attached to a digital identity. It is you, and a you that you cannot escape. Your crimes will always follow you. You cannot live or work anywhere without that digital identity of you being allowed to.
This just needs to happen in the US. The release of everyone's names, addresses, SSNs and SSN questions/histories would be almost a Fight Club like reset.
Less than a month ago http://www.theregister.co.uk/2...
Florida's voter rolls were uhhhh Hacked! http://flvoters.com/by_name/in...
https://www.youtube.com/watch?...
Webscale!
systemd is simply a disaster.
... and start treating it as a key-value file system and it all makes sense. Sadly the mongo devs want us to think its a competitor to mySQL or even Oracle. Yeah, right.
Amateur hour DB + amateur hour admins = trouble ahead.
"MongoDB Config Error Exposed..." is the new "Florida Man..."
It's sad to see that "most" things working is now acceptable for Linux. I miss the old days when the quality bar was set much higher.
For ~ 83 million registered voters, that's 1.57KB per voter. It's a lot, but it's not obscene. You can see a sample redacted db record on the article. They have voter ID laws, so they have a bit more info, including maternal/paternal parents.
You can't even store 1 byte per voter on less than 50 floppy disks.
I have been trying to get a job as a brick layer for the last 2 years. However, because my name is not Hernandez, I am summarily disqualified.
That's funny. When I applied for unemployment benefits a few years ago, I discovered that "C RAMOS" was using my Social Security number. With my Social Security number, he got himself a job. Maybe your problem isn't your last name but your Social Security number (or lack thereof). Employers won't hire anyone off the street without a Social Security number.
Oh my, 132Gb of tasty, tasty user data. It's like an all-you-can-eat hacker buffet.
Just cruising through this digital world at 33 1/3 rpm...
We'll finally be able to steal our jobs back from Mexico.
You should have used a US address on those credit card applications. The Mexican government would probably take notice of their registered voters living in the USA and build Trump's wall after all- whether he is elected or not.
I think your problem goes deeper than your name. I would suggest looking into the use of USAian for starters. It probably branches out near there.
Remember, the interview is there to either select or weed out the idiots.
Elections are harsh in Mexico, with the PRI (Institutional Revolutionary Party) doing whatever it takes to hold onto power. This might very well be on purpose to extract data on voters to fake votes and inflate ballot boxes. A good bribe to the sysadmin or even a harsh threat (political parties are known to have nexus with organized crime) could have been the reason for this.
Please explain why the MongoDB binary built for trusty (Ubuntu 14.04LTS) which you choose to use in your example should contain a systemd unit file when systemd wasn't introduced until wily (Ubuntu 15.10)?
Why do you anti systemd trolls keep lying when it's so easy to prove you wrong? All one have to do is look at the File List of the mongodb-server package in Ubuntu 16.04LTS: http://packages.ubuntu.com/xen... and what do we find there:
/lib/systemd/system/mongodb.service
Well I be damned, a systemd unit file, which you now have claimed in several articles does not exist even though it does. Interesting isn't it?
Remind me again how this is Red Hats fault when Red Hat does not provide any MongoDB packages at all? If you want to run MongoDB on Red Hat you have to download a rpm from MongoDB:s third party repository so any unit or script included there is all done by MongoDB and not Red Hat.
What is wrong with USAian? To claim that your are an American when you are really from the USA seems a little non-specific, especially when taken in the context of nationalism (which is what this is about). One might as well just say He is from the Western Hemisphere, or the planet Earth. America is not the USA. The USA is not America. America is two fucking continents and 37 fucking countries.
And those steps download the MongoDB binary built for precise which is even older (Ubuntu 12.04LTS). It's like you are not even trying here.
This has nothing to do with the version of Mongo but with the version of Ubuntu it was built for. Every post that have tried to "reproduce" this step have downloaded Mongo for either 12.04LTS och 14.04LTS, both which is non systemd Ubuntu releases so of course you will not find a systemd unit file in either of them. MongoDB where however included in the official Ubuntu repository as of 16.04LTS and lo and behold it does include a systemd unit file. So you have all been played to anti systemd trolls that know exactly why the unit file is missing from the packages that the point to but still use it as an argument even though the know that it's false. It's like trying to prove that there are no penguins in the North Pole by showing that there are no Penguins in some African country, it's disingenuous.