News for hackers. Stuff that matters.

A comment on Names of Canada truck convoy donors leaked after reported hack. Parent comment

Re:Names of Canada truck convoy donors leaked after reported... by albroland on Monday February 14, 2022 @12:04PM (#30334434)
I'd think it's far more likely that GiveSendGo doesn't have the most sophisticated and well maintained tech stack and an exploit was easily found by hacktivists engaging in defacement and doxxing.
[ Parent | on HN ]
Re:Names of Canada truck convoy donors leaked after reported... by nostrademons on Monday February 14, 2022 @12:10PM (#30334544)
It was an open S3 bucket linked from the source code of the Freedom Convoy's donation page:

https://techcrunch.com/2022/02/08/ottawa-trucker-freedom-con...

[ Parent | on HN ]
Re:Names of Canada truck convoy donors leaked after reported... by mattferderer on Monday February 14, 2022 @02:19PM (#30336864)
The Tech Crunch article is much more informative.

Not only was this S3 public for reading but sounds like you could create & update as well since 2018. It contained "50 gigabytes of files, including passports and driver licenses".

Per the Tech Crunch article:

> It’s not known for exactly how long the bucket was left exposed, but a text file left behind by an unnamed security researcher, dated September 2018, warned that the bucket was “not properly configured” which can have “dangerous security implications.”

[ Parent | on HN ]
Re:Names of Canada truck convoy donors leaked after reported... by cudgy on Monday February 14, 2022 @01:59PM (#30336542)
Let’s put it in the cloud, man. Everybody’s doing it!
[ Parent | on HN ]
Re:Names of Canada truck convoy donors leaked after reported... by spoils19 on Monday February 14, 2022 @03:46PM (#30338076)
An open S3 bucket is a huge red flag that this feels state manufactured. Most people aligned with this protest probably possess the technical chops to know to do better.
[ Parent | on HN ]
Re:Names of Canada truck convoy donors leaked after reported... by fknorangesite on Monday February 14, 2022 @06:15PM (#30339838)
> An open S3 bucket is a huge red flag that this feels state manufactured.

I suspect both Occam and Hanlon would disagree.

[ Parent | on HN ]