Slashdot Mirror
Over 800 Million Emails Leaked Online By Email Verification Service (securitydiscovery.com)
Security researchers Bob Diachenko and Vinny Troia discovered an unprotected MongoDB database containing 150GB of detailed, plaintext marketing data -- including hundreds of millions of unique email addresses. An anonymous Slashdot reader shares Diachenko's findings, which were made public today: On February 25th, 2019, I discovered a non-password protected 150GB-sized MongoDB instance. This is perhaps the biggest and most comprehensive email database I have ever reported. Upon verification I was shocked at the massive number of emails that were publicly accessible for anyone with an internet connection. Some of data was much more detailed than just the email address and included personally identifiable information (PII). This database contained four separate collections of data and combined was an astounding 808,539,939 records. As part of the verification process I cross-checked a random selection of records with Troy Hunt's HaveIBeenPwned database. Based on the results, I came to conclusion that this is not just another "Collection" of previously leaked sources but a completely unique set of data. Although, not all records contained the detailed profile information about the email owner, a large amount of records were very detailed. We are still talking about millions of records.
In addition to the email databases, this unprotected Mongo instance also uncovered details on the possible owner of the database -- a company named "Verifications.io" -- which offered the services of "Enterprise Email Validation." Unfortunately, it appears that once emails were uploaded for verification they were also stored in plain text. Once I reported my discovery to Verifications.io the site was taken offline and is currently down at the time of this publication.
In addition to the email databases, this unprotected Mongo instance also uncovered details on the possible owner of the database -- a company named "Verifications.io" -- which offered the services of "Enterprise Email Validation." Unfortunately, it appears that once emails were uploaded for verification they were also stored in plain text. Once I reported my discovery to Verifications.io the site was taken offline and is currently down at the time of this publication.
There is a lot of stupid things about MongoDB. On the top of the list is actually a lack of an Official Open Source Good quality GUI tool to manage it.
Sure it sounds silly and not a big deal, as anyone who knows MognoDB can run it from the command line... However the problem is most implementations of software is not from experts of the product, but from people using it for the first time.
Here is how it goes.
I have a project, I gather the specs, I find that a NoSQL database engine is a good fit. Now I try to do research on a NoSQL I see that MongoDB is the popular choice, figuring if the product grows, I can then find other resources who have experience in the engine later.
So then I start the project... I have no prior experience with MongoDB, Now, I am not stupid, I follow the documentation to get it going, and I get it to a point where I can attach my code to it. However I am Naive my lack of experience makes me blind on what is happening, with this new tool. There are features I don't know about, security defaults which may be different from what I am use to, so even as a in general experienced developer, I make a lot of mistakes.
Now tools like SQL Server Management Studio, pgadmin... gives me options to see what the product is doing, look at the setup and see what else I can be doing.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
that sounds oddly specific.
Almost universally, they're bottom feeders in the spam world. They purport to take email lists from customers and filter out the defunct ones, which they basically do by a combination of looking for accepted RCPT TOs when connecting to a mail server, or actually sending an email and seeing which addresses get bounced. This is something that any legit operation with a proper sign up process and using legimate mail service providers should be easily capable of handling automatically because they'd know every email on the list was valid from a confirmed opt-in and could remove any that repeatedly give an SMTP 5xx (hard fail) on delivery attempts (with some wiggle room for misconfigured servers/full mailboxes giving 5xx hard fails instead of 4xx transient fails). It's also a neat email address harvesting method for spammers; set up a verification service, wait for people (mostly other spammers) to send you their mailing lists for list washing, add them to your own lists, and then spam away and/or re-sell them on the dark web to other spammers.
As an aside, I have quite a number of these services hard-coded to 5xx regardless of the validity of the email they are testing in my mail server config. So far I've not noticed any legit mailing list I've actually signed up to stop working as a result, but I have noticed a fairly significant drop in the amount of spam I'm getting, which seems like a pretty good indication of who their primary customers are as well.
UNIX? They're not even circumcised! Savages!