top | item 28200691

Terrorist watchlist exposed via misconfigured Elasticsearch cluster

439 points| david_shaw | 4 years ago |bleepingcomputer.com | reply

252 comments

order
[+] cyberlurker|4 years ago|reply
> “The terrorist watchlist is made up of people who are suspected of terrorism but who have not necessarily been charged with any crime,” Diachenko wrote. “In the wrong hands, this list could be used to oppress, harass, or persecute people on the list and their families. It could cause any number of personal and professional problems for innocent people whose names are included in the list.”

I’m curious how many journalists are on the list. Now that we are pulling out of Afghanistan, we should reevaluate the other actions we took after 9/11. The patriot act deserves another look and possible edit.

[+] __blockcipher__|4 years ago|reply
> The patriot act deserves another look and possible edit.

Boy, that was the understatement of the year.

The patriot act doesn’t need an edit or another look. It needs to be completely abolished, yesterday.

[+] beambot|4 years ago|reply
> The terrorist watchlist [...] could be used to oppress, harass, or persecute people on the list and their families.

So... what was it actually used for? Wasn't this the same list that results in extra scrutiny at airports & whatnot -- wouldn't that count as harassment?

[+] ashtonkem|4 years ago|reply
Given the history of the FBI deciding that journalists and activists are actually terrorists to be suppressed? Probably quite a few.
[+] lostlogin|4 years ago|reply
> “In the wrong hands…”

It’s in the wrong hands already - the wrong hands made the list, and there are plenty of examples of what has happened to various misidentified people over the years.

[+] justinzollars|4 years ago|reply
I'm curious about this list too. For example are Islamic people I know on it? There are never any details on how to access these lists. The article could be fake for all I know.
[+] syrrim|4 years ago|reply
Didn't the patriot act expire without renewal?
[+] stjohnswarts|4 years ago|reply
There is nothing Patriotic about the Patriot Act and it needs to be fully rescinded. That law is a travesty in every way. It was knee jerk reactionary law that shouldn't have been in place more than a couple years.
[+] sschueller|4 years ago|reply
Senator Ted Kennedy was mistakenly matched with someone on the list back in the Bush era around 2004. How can you make that mistake?
[+] lancemurdock|4 years ago|reply
> The patriot act deserves another look and possible edit.

once you give the gov power, it is never given back to the people.

[+] Rd6n6|4 years ago|reply
Wikipedia says the no fly list only had 47k people on it. The terror watch list had about 1.9M though, so this must be the terror watch list.

1.9M people is a massive number of people

> The No Fly List is different from the Terrorist Watch List, a much longer list of people said to be suspected of some involvement with terrorism. As of June 2016, the Terrorist Watch List is estimated to contain over 2,484,442 records, consisting of 1,877,133 individual identities.

https://en.m.wikipedia.org/wiki/No_Fly_List

[+] Joker_vD|4 years ago|reply
You know, I can understand why the Terrorist Watch List is secret ― but not why the No Fly list is. If there is a list that governmental agencies and/or commercial companies are obliged to check you're not on before providing you with their service, then surely such list must be public or at the very least, one should be able to easily inquire about whether he/she is on it or not.

For a related example, Russian government maintains a list of banned Internet resources. The list is not public — at least in theory — but there is an official web site where you can input an URL or a domain name and it would response either with "no, it's not on the list", or with "yes, it's on the list, here's who ordered it and when".

[+] datavirtue|4 years ago|reply
It's not a secret, just need-to-know basis.
[+] londons_explore|4 years ago|reply
Surely the easy way to check if a name is on the list is to book a flight in that name. If the booking gets rejected, it's on the list.

Repeat for every name you want to check, and make use of the airlines free cancellation policy so you don't actually have to spend money.

[+] scrps|4 years ago|reply
>The researcher considers this data leak to be serious, considering watchlists can list people who are suspected of an illicit activity but not necessarily charged with any crime.

"In the wrong hands, this list could be used to oppress, harass, or persecute people on the list and their families."

I'd imagine being on a list that limits your personal freedom without being charged with a crime and convicted falls pretty squarely within the definition of being oppressed & persecuted before even considering any second order effects of the list being leaked.

[+] ClumsyPilot|4 years ago|reply
As expected, it is only a matter of time untill all the intensely private data collected by NSA and pals is leaked or stolen and used by criminals for fraud and extortion.
[+] vmoore|4 years ago|reply
This. Eventually all sensitive data becomes concentrated enough that it becomes leakable material
[+] rodgerd|4 years ago|reply
Well, there are reports that the Taliban have gained control of a bunch of biometric scanning and reporting tools used by the US forces in Afghanistan so...
[+] loceng|4 years ago|reply
Or a list of allies and talent to hire or leverage.
[+] r1ch|4 years ago|reply
It's amazing how many hacks and data breaches all come down to dangerous default settings. Elasticsearch defaulted to no security, anyone hitting the IP has full access to the cluster. MongoDB is another infamous example. Even today, one of my sites is being DDoSed by a bunch of 2007-era Ubiquiti network devices which use ubnt / ubnt as the root login and naturally got exposed to the internet. Bad defaults linger for a long time.
[+] southerntofu|4 years ago|reply
And that's why some of us use firewalls, and/or avoid the Docker craze like hell.
[+] WrtCdEvrydy|4 years ago|reply
I wonder if this will end up on haveibeenpwned?

"The FBI leaked your name as a terrorist"

[+] gjsman-1000|4 years ago|reply
The freaking FBI leaked your info. Not a stupid private organization. The FBI. And also, because the FBI doesn't tell people they are watching them, there was absolutely nothing - no product, no service - you could have just not signed up for to avoid this leak.

What next, the IRS?

[+] imglorp|4 years ago|reply
I would like to know if any grumbling about the agencies on social media--like this post--has landed me on the watch list.
[+] tubbs|4 years ago|reply
That would be funny (I guess). At any rate, neither email addresses nor phone numbers were part of the leak.
[+] gjsman-1000|4 years ago|reply
Just an hour ago I was having a dialogue with someone on Hacker News saying we needed a national ID system after the T-Mobile hack. I said that the US Government should not be trusted to be any more secure than T-Mobile with such a system.

I rest my case.

[+] int_19h|4 years ago|reply
What really bugs me about these lists isn't just that they exist, but that there's continuous clamoring to expand the scope in which they are applied. For example:

https://www.theatlantic.com/politics/archive/2015/12/no-fly-...

So, basically, politicians have found it to be a convenient tool to skirt due process concerns in general when pushing for their favorite agenda.

[+] raxxorrax|4 years ago|reply
It is amazing what the hunt for terrorism has done to modern countries. They only look fearful and weak, exactly what professional terrorists always wanted them to be.

Anyone who knows bureaucratic behavior knows that even in the absence of real terrorists, people will find their way onto lists like these.

I hope the lists will leak to a wide audience. Find the cases that are wrong and sue those responsible behind the desks. This is the only way this can stop.

The website is extremely horrible. Did use a dev browser without adblock. Grave mistake.

[+] criticaltinker|4 years ago|reply
> [cybersecurity researcher Bob Diachenko] was able to find about 1.9 million records detailing individuals’ no-fly statuses, full names, citizenship, genders, passport numbers, and more.

> “it seems plausible that the entire list was exposed”

[+] nurgasemetey|4 years ago|reply
Out of curiosity, how can I search myself?
[+] jl6|4 years ago|reply
Would love to know how the FBI dealt with transliteration deduplication of non-Latin names, cf. the many spellings of Muammar Gaddafi. Although I guess they would just use whatever’s on the passport?
[+] oa335|4 years ago|reply
They didn’t. I know of several people with an extremely common name (Basically Muslim equivalent of “John Smith”) who were unable to fly or cross borders, even with the “Redress numbers” that they are supposed to give out in case of mistaken identity.
[+] _moof|4 years ago|reply
"In the wrong hands, this list could be used to oppress, harass, or persecute people on the list and their families."

Teetering on the brink of an epiphany.

[+] voldacar|4 years ago|reply
So somebody found the terrorist watchlist and didn't upload it anywhere or start a torrent, but instead took some screenshots and gave vague descriptions of the data to journalists?

I'd like my reality unmediated, please

[+] thepasswordis|4 years ago|reply
Suggestion:

Take the Facebook leak from earlier. Create hundreds of collections if 1.9M people. Release it to the dark web.

Just flood then zone with noise. FBI can still keep their list (and know it’s legit), and peoples privacy will be ensured.

Otherwise this is going to 100% get integrated into various social credit systems we have in the US.

[+] smitty1e|4 years ago|reply
Among the basic concepts of American Civil Rights used to be Sixth Amendment right to confront accusers.

Legal weenies may engage in mental gymnastics to rationalize the evil of no-fly lists.

They deserve the receiving end of their perfidy.

[+] Ceezy|4 years ago|reply
These people are morons! They claimed to be crème de la crème and watch. Few years ago they wanted to force Apple to create a "secure backdoor". Hope we gonna get more details.

Sorry for the rant

[+] tomc1985|4 years ago|reply
Elasticsearch is like the security breach gift that keeps on giving...
[+] kieselguhr_kid|4 years ago|reply
I mean, the FBI should 1000000% know better than to expose their unsecured Elasticsearch cluster to the internet. While Elasticsearch should be more secure by default, I'd say the blame is much more on the agency.
[+] Saris|4 years ago|reply
It's crazy how many instances are setup to be accessible from the internet, but they don't bother to secure it.
[+] hughrr|4 years ago|reply
Awaiting future headline “Secret CSAM hash list leaks online”.

Keeping lists secret appears to be something the human race is really really bad at.

[+] grishka|4 years ago|reply
It's so secret it gets distributed to every compatible iOS device, right