Slashdot Mirror
Breach Notification Website LeakedSource Allegedly Raided By Feds (csoonline.com)
Breach notification service LeakedSource may be permanently shut down after the owner of the site was raided earlier this week. "At the start of the new year, LeakedSource indexed more than 3 billion records," reports CSO Online. "Their collection is the result of information sharing between a number of sources, including those who hacked the data themselves. Access to the full archive requires a membership fee." From the report: On the OGFlip forum Thursday, a user posted vague details about the LeakedSource raid, but Salted Hash has been unable to verify the claims. The U.S. Department of Justice will not comment, refusing to confirm or deny any investigations related to LeakedSource. The operators of the notification service itself have been offline for several days, and the LeakedSource website stopped working late Tuesday evening. The message from OGF reads as follows: âoeLeakedsource is down forever and won't be coming back. Owner raided early this morning. Wasn't arrested, but all SSD's got taken, and Leakedsource servers got subpoena'd and placed under federal investigation. If somehow he recovers from this and launches LS again, then I'll be wrong. But I am not wrong. (sic)"
Not surprised they got raided. LeakedSource always seemed to give me a sort of rotten vibe, that something was off. The fact they wanted money upfront and seemed to be double-dealing made me wonder about them. At least Troy Hunt's alternative is both free and seems way more legitimate, if not as comprehensive.
Oh, knock it off.
As for the actual issue, this seems like it's the work of trolls. I may be wrong, but it looks suspicious to me. Here's another link on the topic, with more information: http://www.zdnet.com/article/breach-site-leakedsource-raided-by-feds/
If the owner wasn't arrested, it should be possible to confirm that the site isn't coming back or to make some sort of statement. Also, the note makes me very suspicious. Consider this: if I start a statement by saying, "I'm not racist, but...," it usually means I'm about to make a racist comment. If I include works like "honestly" and "actually" when nobody has questioned my credibility, it's an indication that I'm hiding something and being untruthful. In this case, the note ended by denying it was a troll, which makes me believe it's a troll and consider it less credible than I otherwise would. Until there are more credible details, this is an unverified rumor at best.
So a journalist published an article based on a forum post and pastebin link... that sounds about right... modern-day media... go figure. No wonder the term fake news exists.
The main moral to take from this story is that if you are going to upset people who have legal powers, make sure that your data is held in a way that is beyond their powers to get at. One of the more interesting possibilities lies in the 'Principality of Sealand' - https://en.wikipedia.org/wiki/... whose legal status is... interesting. If your data was there and you upset Uncle Sam enough, would he try to invade - and would the UK let him!!
This "breach notification site" SOLD password caches to third parties - and even cracked the password hashes before selling them. Why doesn't the summary mention this? This site sold people's credentials passwords to spammers, fraudsters and other malicious actors: https://arstechnica.co.uk/secu...