News for hackers. Stuff that matters.

A comment on Thai Database Leaks 8.3B Internet Records. Parent comment

Re:Thai Database Leaks 8.3B Internet Records by belorn on Monday May 25, 2020 @07:46AM (#23300101)
The netflow data from cloudflare, which is 0.05% of all traffic, is retained for 60 days according do the compliance report. 8.3B log entries is a lot, but I suspect that given how large market share cloudflare has, 0.05% over 60 days is also not a small data set. My intuition with probability calculus make me suspect that given normal internet usage over 60 days, a person is more likely than not to end up in cloudflares netflow log.
[ Parent | on HN ]
Re:Thai Database Leaks 8.3B Internet Records by tialaramex on Monday May 25, 2020 @09:15AM (#23300666)
> a person is more likely than not to end up in cloudflares netflow log.

They are, but because this is all Cloudflare's 1.1.1.1 service does, that log only tells you that the IP address used Cloudflare's service.

So whereas this Thai data more or less says e.g. You watched Netflix between 18:40 and 19:26 and then again 21:33 to 22:09 the Cloudflare data says you own a device that uses Cloudflare's 1.1.1.1 DNS service. Maybe you can try to do some kind of activity estimate e.g. me idly browsing random web sites probably causes more DNS queries versus a SmartTV just periodically doing auto-updates when I'm asleep, but the 2000:1 dilution would make that more unreliable.

It isn't strictly nothing but it's damn close.

[ Parent | on HN ]
Re:Thai Database Leaks 8.3B Internet Records by belorn on Monday May 25, 2020 @09:59AM (#23301172)
If the attacker also have access to the anonymized data set which is stored for 25hrs they should be able to deanonymize quite a bit of the data by just comparing time stamps and finding patterns.

It is much better than just having normal logs laying around, and since the data is split in two data set, there is a possibility that having access to one does not automatic result in having access to the other. The dilution is also helpful, through I am uncertain to the extent given the amount of traffic generated.

[ Parent | on HN ]