16

This may seem like a rather nefarious question, however, my motivations are quite the opposite-- I want to know how at risk I might be!

A while ago a very MASSIVE database was leaked that contained the personal information of millions of people. Unfortunately, I'd peg my chances of being in that database at about 80-90%. This means that floating around on the dark web, their could be enough information for a kid to open a credit card in my name and wreak havoc on my life.

The institution that this information has leaked from had to give all possibly affected individuals free credit monitoring for 1 year. After that, the millions of us who were vulnerable are left to monitor ourselves and "hope" for the best.

I don't trust blind hope.

I imagine that when this data was leaked, it was seeded to all of the "typical" dark web sources. With that said, what is the best way for a non-hacker, developer or tech-savvy "power user" to search and discover leaked data so that they can verify whether they are vulnerable from a specific leak?

Yes, I could be lying and looking for a quick way to find 100 SSNs. However, I don't think that's a good excuse to hide this information and not be given a straight answer. If the information is out there, it's out there and there's nothing we can do to stop the spread of the information. However, I can do my personal best to be informed as much as possible on the state of my credit risk and current vulnerability. That is all I am hoping to achieve.

Improve this question
4
  • 2
    what do you think about the legally backed user data of over 80% of internet kept by sites like facebook and google.?
    – Saladin
    Commented Mar 28, 2013 at 11:47
  • Not sure what to say about it. Yes, I'm aware of the issue. However, I try to safe guard myself as best as I can from those channels, but my question would still apply if I used those services and their data was leaked. I know what I've put on what websites. What I don't know is what others have collected about me (not even on my own volition) and someone else has discovered. If they publicly released that data, how can I find it, again, assuming the breach was big enough to get national or, even, global attention.
    – RLH
    Commented Mar 28, 2013 at 12:02
  • i have responded to your comments as a separate answer.
    – Saladin
    Commented Mar 29, 2013 at 12:06
  • Registering on haveibeenpwned.com would at least give you an alert of when your email address appears in a breach.
    – Jim
    Commented Sep 6, 2016 at 17:21

5 Answers 5

Reset to default
31

Here is what I do...

I assume my data is out there... I don't bother looking for it. Somebody will run across my SSN eventually and it will get scraped up into a database and sold around the world.

As far as I'm concerned, searching for my data has little value and certainly won't put the horse back into the barn. In fact, even searching for my SSN or credit card numbers could expose them.

I live in the US and have placed a credit freeze on our 6 credit reports (3 for me and 3 for my wife). This is done at the websites of the big 3 credit bureaus.

When I need a new line of credit (loan, card, etc), I temporarily thaw the reports and they automatically re-freeze after a week or so (Just did this in order to refinance my home). This freezing and thawing process takes about 15 minutes online and has never cost me a cent.

http://www.clarkhoward.com/news/clark-howard/personal-finance-credit/credit-freeze-and-thaw-guide/nFbL/

Improve this answer
6
  • Wow, good response. You very well may get the answer mark. Still, I'm interested in others opinions and thoughts on the matter.
    – RLH
    Commented Mar 28, 2013 at 12:09
  • 12
    +1 for "searching for my SSN or credit card numbers could expose them". Very true.
    – Adi
    Commented Mar 28, 2013 at 12:23
  • 1
    One question though, how could searching for my SSN/CC info expose them?
    – Fixed Point
    Commented Mar 28, 2013 at 19:58
  • 2
    @FixedPoint A basic example is that Google keeps track of everything users enter as a search, so if you search for your SSN, then, somewhere, it's inside a Google database as a search term.
    – SpellingD
    Commented Mar 28, 2013 at 20:58
  • 2
    @FixedPoint, another way would be if you found a "searchable database" and tried to find your SSN in it. Except that it's not a database but just a form faking a search, returning "Not found!", and secretly relaying the SSN to its creators. A similar operation is reported here: lifelock.com/education/articles/id-theft/fake-id
    – LSerni
    Commented Apr 17, 2013 at 14:12
7

Unfortunately, I don't think that this kind of research is going to do you much good. Unless you took upon yourself to seize a copy of the leaked database, and after searching it, you confirmed not being in there. At that point you're safe - against that one database.

But this is a risky business: obtaining the database would be illegal, and even searching for it might land you in a world of hurt. Also, you could probably achieve the same results by requesting the credit monitoring from the institution responsible, and hoping to hear "Sorry, sir: you are not eligible for monitoring since your data were not among the ones leaked". If you trust them, that is :-)

Otherwise, any indirect (and still dangerous) search you undertook would either confirm that you are at risk, or would actually be useless -- because you couldn't be sure whether the search would have found your data, and its failure means they aren't there, or if your data are actually there, and the search did not succeed in rooting them out.

If it is practical to do something to make that information less useful (change passwords, request replacement cards/tokens/PINs to be issued), you should already have done so.

In some countries it is possible to "lock" your credit situation, i.e., you request an access code (the first time it's pretty awkward, your identity needs to be verified etc.), then you declare that henceforward you are not going to request loans, credit cards, etc.; anyone attempting to do so without the proper Credit Central authorization in your name will then automatically be identified as a fraudster.

Improve this answer
1
  • 1
    Appreciate the response. In my case, the data that was breached was data you can not change. Once given, you're stuck with it for life. I swear, sometimes I feel like societal trust is cobbled together with duct tape...
    – RLH
    Commented Mar 28, 2013 at 12:20
3

Although not directly related but very relevant to the questions asked by you, I like to bring in your notice "csi/fbi survey" conducted by CSI with the collaboration of the San Francisco Federal Bureau of Investigation's Computer Intrusion Squad and researchers from the Robert H. Smith School of Business at the University of Maryland.

The survey perhaps has the largest footprint reaching in its fifteen year mark reaching nearly all sector of information use. Including Consulting,Financial Services,Education,Federal Government,Local Government,Information Technology and Retail.

According to excerpt taken from CSI / FBI 2010/2011 survey

The attempt to identify the perpetrator continues to drop—from 60 percent two years ago, to 37.2 percent last year, and now this year down to 23.9 percent. It would seem that mitigation and recovery are much higher priorities than attempting to find the wrongdoer and mete out justice.

Corresponding to low incidence of reports to the media, there was a jump in not going public to anyone at all outside of the organization, with that percentage rising from 15.6 percent last year to 25.4 percent this year. Organizations appear to becoming more secretive than ever about the security incidents they encounter.

By stating these figures I say that there exists a very good reasons for you as a victim of credit fraud or any other privacy violations you would be getting any actionable response against the possible effects / attack on your personal data usage. enter image description here

Improve this answer
2
  • 1
    Excellent information and it does help obtain a good, broad perspective of the entire issue. +1
    – RLH
    Commented Mar 29, 2013 at 13:22
  • Very interesting - as well as disquieting. +1
    – LSerni
    Commented Apr 17, 2013 at 14:06
2

The easiest way to search leaked password databases is to visit a website like LeakProbe https://www.leakprobe.net or HaveiBeenPwned https://haveibeenpwned.com/

you can search these sites for free and find out if you've been in any major leaks.

Improve this answer
1

Download the database and use grep -i to search for your name. You can find grep for Windows too. It might spit out binary junk, but that means it was found.

MyFICO Scorewatch can send you an alert as often as once a week with your (real) FICO (based on Equifax data), if you set the trigger threshold low enough. It is about $140/yr. http://www.myfico.com/Products/Products.aspx

TrueCredit is the cheapest and will give you a fake FICO (Vantage) each month with a complete textual report from all 3 bureaus. It's about $120/yr. http://tui.transunion.com/?enurl=truecredit.com

You can't get a real FICO score from Experian unless you are a business.

Improve this answer
5
  • 1
    good luck doing that on a few TBs of data
    – ratchet freak
    Commented Mar 29, 2013 at 8:39
  • This assumes the database dump is in plain text which is unlikely to be a valid assumption.
    – Burhan Ali
    Commented Mar 29, 2013 at 14:51
  • @BurhanAli The DB doesn't have to be plain text. It can be binary. Grep will search binary files too. Unless the DB file uses compression or encryption, it will still have the strings in the file.
    – Chloe
    Commented Apr 1, 2013 at 3:06
  • I know that grep can search binary files. I meant that this assumes the content you were searching for within the file is in a plain text format and therefore searchable. I'm still not convinced that's a valid assumption.
    – Burhan Ali
    Commented Apr 1, 2013 at 10:01
  • 1
    Just think of how databases work. They must look up information quickly, and they use indexes for that sometimes, and sometimes they scan the whole table. They aren't going to compress or encrypt that. Just check yourself: less /var/lib/mysql/ibdata1 yields text like this "<80>^@^@ mayorjohnson"
    – Chloe
    Commented Apr 3, 2013 at 5:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .