Schneier on Security

JonKnowsNothing • July 23, 2021 9:45 AM

@All

What is curious, is how the person was targeted in the first place?

• Either the person was SPOTTED at a known venue and then someone did parallel constructed for proof

or

• Someone was just doing a whole lot of cross table matching with a whole lot of CPU cycles on huge data sets

Per the reports, it appears the Data Brokers were not aware of the true purpose or intended use for the data. Likely they don’t care much what you do with the data just as long as you pay for it.

But someone went to a lot of trouble and expense just the same. There are organizations that do target all kinds of persons, the “bounty hunter or entrapment” groups and some of them are well funded either privately or by LEAs.

Somebody had “An Axe To Grind”.

JonKnowsNothing • July 23, 2021 9:59 AM

re: re-identifying anonymized data

iirc(badly)

Not too long back, the UK sold a hunk of their Health Services Data to Google, the reason given was that Googles Systems could help improve some part of their NHS system.

They were given just 3 parts of the UK zip-code system, so that no information could be re-identified or linked to a specific patient. That was a no-no.

Took a day or two but even though they agreed Not To Do That, They Did It. And now millions of UK health records are linked to the real person, in real time.

The UK is so desperate for funding, they are planning on selling off another batch of data. They have already mined the hospital records and part of their PCP/GP offices (where the data hookers went in with scanners). There is still something left for the UK government to sell.

In the USA, Doctor – Client private chats only last until the Doctor logs into the main system and begins to fill in all the tick boxes.

For some Health Care Systems this data is then forwarded to their Research Divisions. The data held there is worth a lot of zeros – some of these systems hold lifetime – cradle to grave data.

It’s all done in the name of research, the patents are just a side issue of course.

JonKnowsNothing • July 24, 2021 4:53 PM

While schadenfreude runs rampant about the accusations and doxing using supposedly “just found” geolocation data in a questionable situation of “a random surprise finding” of the relevant information rather than a “targeted doxing”, BKrebs has an article about a criminal group doing something similar.

The articles goes into length about the lengths people will go to for something as simple as a desirable internet handle and their increasingly violent attempts to extract the handle from the holder. Some of these include creating fake accounts with those handles in salacious groups or targeted policing databases and other forms of getting someone On A List and getting the cops to arrive with guns drawn and ready to shoot (SWATTING).

Being mindful that such activities are common on the internet and very few of us have any ability to prevent them. LEAs cannot prevent it, Internet providers cannot prevent it, Services of all types cannot prevent it, Governments cannot prevent it either.

It’s another source of kompromat.

It doesn’t have to be true to be of value. If true, it’s of greater value.

===

ht tps://krebsonsecurity.com/2021/07/serial-swatter-who-caused-death-gets-five-years-in-prison/

Serial Swatter Who Caused Death Gets Five Years in Prison 07 21 2021

ht tps://en.wikipedia.org/wiki/Schadenfreude

• Schadenfreude is a complex emotion where, rather than feeling sympathy, one takes pleasure from watching someone’s misfortune, one takes pleasure from blaming, pin pointing, or hurting someone.

ht tps://en.wikipedia.org/wiki/Doxing

• Doxing or doxxing is the act of publicly revealing previously private personal information about an individual or organization, usually through the Internet.[1][2][3][4][5][6] Methods employed to acquire such information include searching publicly available databases and social media websites (like Facebook), hacking, and social engineering. Doxing may be carried out for various reasons, including online shaming, extortion, and vigilante aid to law enforcement.[7][8] It also may be associated with hacktivism.

ht tps://en.wikipedia.org/wiki/Kompromat

• damaging information about a politician, a businessperson, or other public figure, which may be used to create negative publicity, as well as for blackmail, often to exert influence rather than monetary gain, and extortion. Kompromat may be acquired from various security services, or outright forged, and then publicized by use of a public relations official

(url fractured to prevent autorun)