0

HIBP is a great service that I've been using for a long time.

I had a question surrounding Domain Search feature on HIBP. I believe there has to be some form of verification from our end in order to search for breached accounts by domain. How are the Threat Intelligence companies bypassing this? when all we provide to them are various domains as keywords and they are able to provide us with all the breached emails. Is there a way for us to download the entire email dump for a particular breach? It would be great if you could provide some clarity here!

  • 3
    I asked Troy Hunt directly. Should have an answer for you before too long. – Polynomial Apr 18 '19 at 16:52
  • Haha, I had reached out to him too! But haven't received response yet and I end up posting the question here. Keep us posted! – Data Shark Apr 18 '19 at 17:34
  • Is there a reason you believe these threat intelligence companies are getting their data from HIBP? I would assume that most of them gather dumped credential data from the source just like Troy does. – PwdRsch Apr 18 '19 at 19:24
  • Because the following is explicitly mentioned in their reports "This data has been secured from the "HaveIBeenpwned" repository." – Data Shark Apr 18 '19 at 22:25
  • Interesting. My understanding is the same as yours, that your org's admins would have to verify 'ownership' in a way that a third party could not. I just confirmed that even verifying it once is only good for a 60 minute window to download the results. Seems like they have to be misattributing the source of their data. – PwdRsch Apr 18 '19 at 23:48
1

Here's the answer from the CTI Vendor. (Name replaced with Vendor X)

For HIBP, Vendor X had a custom and paid integration. Vendor X paid HIBP a fee whenever a new breach (which Vendor X did not have) was acquired by HIBP. Therefore, we did not use the Open API, we built a custom integration that pushed any new breach acquired by HIBP into the Vendor X portal. This was the reason no passwords were ever present in HIBP breaches in Vendor's portal (paid service), because under UK and GDPR law, any exchange of PII (including passwords) between any two entities, where money is involved, is a crime.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.