Hole blasted in Guntrader: UK firearms sales website's CRM database breached, 111,000 users' info spilled online
- Reference: 1627039744
- News link: https://www.theregister.co.uk/2021/07/23/guntrader_hacked_111k_users_sql_database/
- Source link:
The Guntrader breach earlier this week saw the theft of a SQL database powering both the Guntrader.uk buy-and-sell website and its electronic gun shop register product, comprising about 111,000 users and dating between 2016 and 17 July this year.
The database contains names, mobile phone numbers, email addresses, user geolocation data, and more including bcrypt-hashed passwords. It is a severe breach of privacy not only for Guntrader but for its users: members of the UK's licensed firearms community.
[1]
Andrew Barratt, UK MD of infosec biz Coalfire, analysed the database after it was dumped on the RaidForums website. He told The Register : "I suspect it was probably a drive-by style attack. So gut feeling looking at the response from the attackers that they posted on forums, [it was] completely un-targeted, it was kind of very much like 'lol we pulled another site' and then it's like, oh, wow."
[2]
Guntrader hack notification email to users. Click to enlarge
Guntrader spokesman Simon Baseley told The Register that Guntrader.uk had emailed all the users affected by the breach on 21 July and issued a further update yesterday.
"The Information Commissioner's Office was informed within hours of the breach being discovered and since then we have been working with them and the other relevant agencies to mitigate whatever impact if any this might have upon Guntrader's users."
[3]
[4]
Baseley did not answer questions about why Guntrader's website has no information on it about the hack, at the time of writing.
Guntrader is roughly similar to Gumtree: users post ads along with their contact details on the website so potential purchasers can get in touch. Gun shops (known in the UK as "registered firearms dealers" or RFDs) can also use Guntrader's integrated [5]gun register product, which is advertised as offering "end-to-end encryption" and "daily backups", making it (so Guntrader claims) "the most safe and secure gun register system on today's market."
Why are gun shops recording all this data?
British firearms laws say every transfer of a firearm (sale, drop-off for repair, gift, loan, and so on) must be recorded, with the vast majority of these also being mandatory to report to the police when they happen. This is a time-consuming process, especially for gun shops making lots of transfers every day.
Guntrader aimed to automate the tedious administrative side with its combined CRM and stock management product, which also interfaced with its website.
The product generated automatic emails to police firearms licensing units containing legally required data. It does not appear that these emails were captured in the stolen database.
The categories of data in the stolen database are:
Latitude and longitude data
First name and last name
Police force that issued an RFD's certificate
Phone numbers
Fax numbers
bcrypt-hashed passwords
Postcode
Postal addresses
User's IP addresses
Logs of payments were also included, with Coalfire's Barratt explaining that while no credit card numbers were included, something that looks like a SHA-256 hashed string was included in the payment data tables. Other payment information was limited to prices for rifles and shotguns advertised through the site.
Reports on shooting sports websites indicated that Guntrader had blamed an iframe on a customer's website as the point of entry. We have asked for more information about this and will update this article if Guntrader gets back to us.
[6]Appeals court nixes online blueprint sharing ban on 3D-printed 'ghost guns'
[7]UK Home Office: We will register thousands of deactivated firearms with no database
[8]Bloke thrown in the cooler for eight years after 3D-printing gun to dodge weapon ban
[9]A few reasons why cops haven't immediately shot down London Gatwick airport drone menace
Although it seemed likely that the database contained copies of RFDs' electronic registers and police transfer notifications, Barratt's analysis showed that this was not the case. He told The Register : "There's no evidence of that correspondence in the CRM tables that seem to have been pulled… I suspect the way the product works is upon a transaction taking place, it just generates that message and notifies the local [police] force dynamically" without keeping a record of it.
Barratt also warned that copies of the database being shared online are laced with malware, cautioning shooters not to download it themselves to check if their info is in it (more advice is available towards the end of this article).
[10]
Garry Doolan, deputy director of communications for the British Association for Shooting and Conservation, told The Register : "It's likely to be a while before the full implications of this breach are known. We expect a full investigation to provide the detail, but we don't need the outcome of that investigation to tell us that such a breach is a significant concern for shooters."
He added: "The best advice has to be for gun owners to be vigilant and aware of their personal and home security. BASC is working with the National Crime Agency to ensure we can brief our members with the most up-to-date information. If people spot anything suspicious, they should inform the police immediately."
The National Rifle Association and the British Shooting Sports Council are aware of the hack.
[11]
Public feelings about the hack at the National Shooting Centre, Bisley Camp, where the National Rifle Association's annual championships is taking place this week, was grim yesterday as some competitors realised their personal data had been obtained by crooks. Some put a brave face on, with one quipping to your correspondent: "They set out to piss off the gun owners ? Really?"
What should I do about this?
You can check if your data is included in the hack by visiting [12]Have I Been Pwned and inputting your email address. HIBP is a trusted resource run by Microsoft regional director Troy Hunt.
If you're a shooter, don't be tempted to download the database yourself from the various places it is circulating online. If you've already done that, run a full antivirus scan of whatever devices you opened the file on. If you're not sure what that means, ask a tech-savvy friend or relative for help.
Coalfire's Barrett said the most meaningful security risk resulting from this comes from burglaries, though he pointed out that all lawfully owned firearms and shotguns in the UK are stored in hefty police-approved safes, joking that criminals would need "plasma cutters" to break into secure storage.
If you used the same password on Guntrader that you used on other websites, change it now. Criminals are well known for testing stolen usernames and login information against other popular websites (eg, email services, online banking) to see if they'll work.
While bcrypt is well regarded in the infosec world as a slow-to-crack password encryption and hashing algorithm, it's not invulnerable. This applies especially if you're one of the public figures whose data is said to be in the leaked database. ®
Get our [13]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YPrnozmrCAp64oWaTBbuiAAAABE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://regmedia.co.uk/2021/07/22/guntrader_breach_notification_email.jpg
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YPrnozmrCAp64oWaTBbuiAAAABE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YPrnozmrCAp64oWaTBbuiAAAABE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.guntrader.uk/Gun-Register/
[6] https://www.theregister.com/2021/04/29/appeals_court_nixes_ban_on/
[7] https://www.theregister.com/2019/11/08/home_office_deactivated_weapons_email_address/
[8] https://www.theregister.com/2019/02/15/texas_3d_gun/
[9] https://www.theregister.com/2018/12/20/gatwick_drone_non_shootdown_reasons/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YPrnozmrCAp64oWaTBbuiAAAABE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YPrnozmrCAp64oWaTBbuiAAAABE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://haveibeenpwned.com/
[13] https://whitepapers.theregister.com/
"I think he means “should be”…."
Most likely the are - the police do make house calls to check that you're storing the kit as required. A friend of mine who received such as visit complained that the two officers were .... armed. For some reason he was rather put out by that.
Generally the chap from the licensing is unarmed, and mostly visits periodically to see what sort of place you have as filtering out the incredibly stupid is apparently quite easy; they do things like stick up Nazi flags and have leaflets for "do you fancy joining $bannedgroup?" on their coffee table.
If he had a pair of officers turn up, chances are that his neighbours saw him cleaning his and called the police saying "my neighbour is walking around with a gun!" resulting in an armed response unit going to check on him.
And yes, most firearm holders have weapons either out in use, or in the cabinet. You do have a few people who use them and then leave them out of the cabinet to clean for prolonged periods, but these people are definitely in a minority because they are too stupid to own a firearm and tend to get eliminated from firearms ownership in one way or another.
I say "too stupid to own a firearm" because either you are using corrosive primers or propellents in your weapon, in which case you must clean the weapon *immediately* after using it if you don't want to lose measurable amounts of the metal in the barrel on each occasion, or your not using corrosive primers or propellents in which case it doesn't per se require cleaning. In both cases it can go straight back in the cabinet, as the license conditions of holding a weapon in the UK requires.
plasma cutter my arse
gun safes are metal boxes attached to the framework of the building, nothing like a safe in which you would keep valuables.
All guns are stored separately from ammo in different part of the house. I. e. on break in you will lilely not be confronted by an armed gun owner.
A fair few guns are going to find there way into the hands of crims as a result of this.
Most likely are.
Your local constabulary's FEO will inspect your storage arrangements before issuing your certificate so most people have them.
Guntrader is roughly similar to Gumtree
Then surely it should be called Guntree?
Re: Guntrader is roughly similar to Gumtree
Ridiculous copyright and trademark laws means you will probably get a higher fine and jail time for using that name than you would be for selling stolen guns on there *
* For joke purposes, I don't think stolen items were sold on this gun site or Gum.....oh wait a minute, i'll get my hat
They set out to piss off the gun owners? Really?
Why did you say this? Are you implying that you are going to go round and shoot them?
Re: They set out to piss off the gun owners? Really?
Joking aside, the animal rights activists are going to be jumping on this.
If I were a gun owner who partakes in a bit of the old hunting, I'd be concerned. In terms of threats to gun users, the activists are more of a threat than terrorists. That's not me saying it, that's the view of anti-terror officers.
Re: They set out to piss off the gun owners? Really?
Not being funny; but if you knew what the police response is to people breaking in to properties that are registered as holding firearms and explosives you'd look up the details specifically to avoid burgling them.
Suffice to say that the police take people attempting to obtain firearms or explosives (aka materials useful for terrorism) really, really seriously and it is one of the few things that will attract a large scale immediate response from the Police these days. Moreover, given it's a terrorism offence they get to hold people for 90 days without charge while their life is forensically dissected. Only an idiot would do it.
Re: They set out to piss off the gun owners? Really?
More or less my thought, aside from the fact that they are breaking into a farm (playing the odds) where they know the farmer is armed and they've f-all chance of getting away if the alarm goes off.
Re: They set out to piss off the gun owners? Really?
Oh I know! I had the full armed response unit outside the place I worked at because the alarm had been set - and I tripped it by accident.
What I mean though is that there will be people outside of those trying to obtain the firearms that will want their pound of flesh. The police response to that won't be nearly the same as those trying to steal a shotgun.
only private owners
no entries for 2nd hand, hardly used howitzers? A friend of a friend's asking, purely for research!
Re: only private owners
There is a guy that drives a pink tank around London as a pride thing.
IIRC since the gun is smooth bore (rather than rifled) it only needed a shotgun licence - apparently they don't care that it's a 120mm "shotgun"
Why bother with plasma cutters?
All it really needs is some cable ties and a baseball bat to force the gun owner to tell you where the keys are. The kind of people wanting to steal guns aren't going to be too fussy about hurting someone in the process.
ObXKCD: https://xkcd.com/538/
Re: Why bother with plasma cutters when one has COSMIC Lancers?
Re: Actual actual reality: nobody cares about his secrets ..... [1]https://xkcd.com/538/
Now that is one very safe and extremely secure space to be in, unhindered as it is by second and third party doubts and worries .... both as real and imagined phantom fears.
And a grand place to be for Further Future Planning ACTivity Secrets to be freely and clearly shared/constantly 0day presented, in order to reach the many and those who may matter and would express a particular interest in such matters, and certainly more than any identifiable as any peculiar Chosen Few Doing God's Work, .... with ambiguity in the task considered and rendered persona non grata and as a perverse friend in league with wannabe foe ..... Mortal Idiots on Stupid Missions .... Cracked Kamikaze Operations.
[1] https://xkcd.com/538/
Re: Why bother with plasma cutters?
Cable tie cock ring and a baseball bat....kinky!
Re: Why bother with plasma cutters?
Remind me not to attend a party Chez NonSSL
Re: Why bother with plasma cutters?
Well it's an alternative to "Correct Horse Battery Staple"
Re: Why bother with plasma cutters?
The kind of people wanting to steal guns aren't going to be too fussy about hurting someone in the process.
The kind of people wanting to steal "guns" don't want either a highly accurate metre plus long single shot rifle, or a double barrel shotgun which is pretty much all that's held by legal firearms owners.
The kind of people wanting "guns" want pistols or sub machine guns that can be concealed in a jacket or down their trousers; and as these are illegal for the last 20+ years they aren't going to get them from legal shooters are they?
The best form of combat usable weapon that your going to find legally in the UK is the .303 Lee Enfield of WW2 vintage; but while that's a perfectly acceptable weapon it's useless to criminals as it's too visible and impossible to hide; if wandering around with a long weapon in the streets your going to get shopped pretty quickly by the public and the police are going to stick a helicopter on top so they don't lose them, while surrounding them with armed response squads. Even in a vehicle there are very limited numbers of places that a meter and a quarter of rifle will go. Many to most car boots won't comfortably hold a rifle and require them to poke through a ski hatch or similar, or lay across the back seats; not exactly useful if your up to something nefarious and want it to be hidden!
Rifles also require a certain level of training to be fired with any accuracy at distance while standing if you have more than an aspiration to hit something, hence the preference for short weapons that facilitate being pulled from a jacket and let shots be liberally sprayed from such a short range that it's impossible to miss by modern gangsters.
Mmmm! and now the criminals know where they can get guns
By and large, they seem to have known that before hand
No great shakes.
Not much call for shotguns and bolt action rifles in the criminal world.
Handguns have been banned in the UK for many years. The only people who have them are already criminals.
Re: No great shakes.
The only people who have them are already criminals.
Sir, I think you may want to reconsider your last sentence.
Yours,
DCI John Doe, Metropolitan Police
Re: No great shakes.
Try getting a Portugese speaking plumber after 8pm is all I'm saying
Re: No great shakes.
>>>Handguns have been banned in the UK for many years. The only people who have them are already criminals.
Careful. You'll have the pistol fetishists up in arms over that comment. (Those Brits who are jealous about Americans' 2nd Amendment rights are easily triggered.)
Re: No great shakes.
Those Brits who are jealous about Americans' 2nd Amendment rights are easily triggered
I see what you did there. :D
@AC
"Mmmm! and now the criminals know where they can get guns"
There are plenty of guns around for the criminals. Its the law abiding that go through the many hoops of insanity.
Re: @AC
A typically well argued post from you. It's unfathomable how anyone in the UK, as you clearly are, can look across the atlantic and draw the conclusion that gun licensing requirements in the UK are too onerous.
Re: @AC
If you are law abiding then you won't have that many problems obtaining a firearm for a lawful purpose.
If you just "want a gun" though then yes, you shall no doubt find innumerable and impassible obstacles that keep firearms out of your hands.
Re: @AC
@Peter2
"If you are law abiding then you won't have that many problems obtaining a firearm for a lawful purpose."
Not many problems being relative in a slow process (according to the guys I used to shoot with anyway) which requires approval from a force not really happy with issuing licenses so will look for any minor problem to delay or reject an application. Assuming things are still as bad as a few years ago. That being for target shooting not shotguns however (which I believe to be a little easier).
The amusing/irritating problem in the UK is the ban on hand guns which makes an olympic sport illegal.
Investigating a security breech
At least there's a reasonable excuse for the typo on this occasion.
Two sides of the pond
Here in UKia, people realise you're more likely to be targeted by criminals if they know you have a gun.
I'm not anti-gun BTW. I know farmers who have firearms. Our system where you can have a gun if a) you have a reasonable use for one and b) you're not a nutcase, well that seems fair.
Solution
Let's wait for a knee jerk reaction from the government.
I bet they'll start with something along the line that websites in the UK will not longer be able to store personal data on in-house databases and they'll have to use new government API that will authenticate and securely keep sensitive info.
This way it for sure will not be hacked and no donor company will make billions implementing that inevitable car crash.
Re: Solution
See the article on Government IT projects...
"... investigating a security breech ..."
I see what they did there!
The hefty safes are fine but who needs a plasma cutter? https://xkcd.com/538/
"the most safe and secure gun register system on today's market."
The last part appears to be correct.
“all lawfully owned firearms and shotguns in the UK are stored in hefty police-approved safes”
I think he means “should be”….