,
7 tweets,
2 min read
Read on Twitter
There is a MASSIVE data security breach in Indonesia right now. The election commission has an online indexable website that lists ๐ฒ๐๐ฒ๐ฟ๐ ๐๐ถ๐ป๐ด๐น๐ฒ ๐๐ผ๐๐ฒ๐ฟ with their full name, place of birth, partial ID number, gender, address (district level), and more.
You can literally google up the full name of an indonesian you know, and chances are you'll be able to find this info on them. You can also infer more info like family relations and potentially birthdays.
This blows the doors for social engineering attacks wide open.
This blows the doors for social engineering attacks wide open.
Basically every adult in Indonesia has now been indexed by search engines and more, likely impossible to take down from the internet. It's very difficult for me to emphasize how dangerous this level of information is.
For proof, here's my entry.
My name is public. I've hidden other people's data for due diligence, but that means nothing. My parents are also publicly open people and you'd find their entries right near mine.
My name is public. I've hidden other people's data for due diligence, but that means nothing. My parents are also publicly open people and you'd find their entries right near mine.
You might be thinking "it's just a name and rough info. What's the big deal?"
Imagine if you were the victim of a crime and someone wants revenge.
Imagine if you're a minority and someone wants to commit a hate crime.
Imagine if you had revenge porn published with your name.
Imagine if you were the victim of a crime and someone wants revenge.
Imagine if you're a minority and someone wants to commit a hate crime.
Imagine if you had revenge porn published with your name.
Imagine if you had a dangerous enemy.
If you were an activist.
A politician.
A lawyer.
Have some crazy ex.
Not one of these?
Imagine if your ๐ฝ๐ฎ๐ฟ๐ฒ๐ป๐ or ๐ป๐ฒ๐ถ๐ด๐ต๐ฏ๐ผ๐ฟ was one, and someone wanted ๐ต๐ฉ๐ฆ๐ช๐ณ head.
There are many reasons this data isn't fully public.
If you were an activist.
A politician.
A lawyer.
Have some crazy ex.
Not one of these?
Imagine if your ๐ฝ๐ฎ๐ฟ๐ฒ๐ป๐ or ๐ป๐ฒ๐ถ๐ด๐ต๐ฏ๐ผ๐ฟ was one, and someone wanted ๐ต๐ฉ๐ฆ๐ช๐ณ head.
There are many reasons this data isn't fully public.
Regarding responsible disclosure: I found this topic discussed publicly in the originally-linked tweet, and I did my best to inform government officials before making my tweet. I moved to confirm the data leak and am actively pushing for a fix on the government level.
