Leaked Guntrader firearms data file shared. Worst case scenario? Criminals plot UK gun owners' home addresses in Google Earth
- Reference: 1630419550
- News link: https://www.theregister.co.uk/2021/08/31/guntrader_breach_csv_danger/
- Source link:
As an exercise in amplifying a data theft to levels that endanger public safety, the latest evolution of [2]the Guntrader database break-in is likely to become an infosec case study in how breaches can become worse over time as stolen information is put to ever more intrusive uses.
Dumped online last week onto an animal rights activist's blog, the reformatted Guntrader breach data was explicitly advertised as being importable into Google Earth so randomers could "contact as many [owners] as you can in your area and ask them if they are involved in shooting animals."
[3]
Names, home addresses, postcodes, phone numbers, email addresses and IP addresses are included in the file – along with precise geographic coordinates for a large number of the 111,295 people listed in the breach.
[4]
[5]
The file emerged on a clearnet site hosted in Iceland and presents a severe risk not only to British firearm and shotgun certificate holders but also anyone who moved house to one of the addresses mentioned in the leak of the stolen database, which contains data up to five years old.
[6]
The 111,000 location entries from the Guntrader DB break-in plotted on Google Earth. Click to enlarge
Firearms are attractive to criminals. Targeted robberies and burglaries to steal them, while unusual, are certainly not unknown. Police have previously issued warnings to the licensed firearms community emphasising personal safety after a spate of robberies targeting licensed firearms owners outside their homes and at rifle ranges; the Guntrader breach could lead to a spate of such crimes.
British policy on firearms ownership is that domestic homes that may contain a handful of firearms or shotguns are less likely to be targeted than the alternative of central armouries presenting a high-value target. Security measures are proportionately ramped up depending on the number and type of guns – but all firearms security begins with obscurity. This breach takes away that obscurity for about 20 per cent of the registered owners across the country.
Down to physical security now
One worried shooter who spoke to The Register said that while his details were in the stolen data, the geolocation information pointed to his parents' home and not his own. A registered firearms dealer who initially scoffed at being included "because I don't have signs outside" could be traced down to his warehouse's industrial estate; Googling his name revealed the precise unit number.
[7]Misconfigured Azure Blob at Raven Hengelsport exposed records of 246,000 anglers – and took months to tackle, claim infosec researchers
[8]Tech biz must tell us about more security breaches, says UK.gov as it ponders lowering report thresholds
[9]Hole blasted in Guntrader: UK firearms sales website's CRM database breached, 111,000 users' info spilled online
[10]IT management biz Kaseya's VSA abused to infect businesses with ransomware
[11]Hard cheese: Stilton snap shared via EncroChat leads to drug dealer's downfall
While some in the licensed firearms community who spoke to The Register expressed the hope that this latest development might go unnoticed, the horse bolted from that stable in July. Criminals plotting the Guntrader location data on a map was only a matter of time.
Guntrader has not explained why it was collecting location coordinates down to six decimal places. We have asked the company for comment. A number of law firms appear to be touting for business off the back of the data leak, though it seems unlikely any of those cases will progress into a representative action in the High Court. There is also the possibility that it goes the way of [12]the latest attempt to sue Dixons Carphone over its 2018 data leak once it gets there.
It appears likely that the latest version of the Guntrader database break-in may be covered by [13]section 58 of the Terrorism Act 2000 , which makes it a crime to collate "information of a kind likely to be useful to a person committing or preparing an act of terrorism." Breaching section 58 is punishable with 15 years in prison. The South West Regional Cyber Crime Unit as well as the National Crime Agency are both said to be investigating.
[14]
The Countryside Alliance had not responded to a request for comment at the time of publication.
The Information Commissioner's Office told us: "We are aware of a potential change in the Guntrader Ltd incident and we will be making enquiries." ®
Updated to add at 15:36 UTC on 31 August 2021:
The British Association for Shooting and Conservation has been in touch to say: "BASC is concerned about this latest development. We have flagged those concerns to the National Crime Agency. In the meantime, we advise the shooting community to maintain vigilance around security and report any concerns to the police."
Get our [15]Tech Resources
[1] https://support.google.com/earth/answer/176685?hl=en
[2] https://www.theregister.com/2021/07/23/guntrader_hacked_111k_users_sql_database/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YS5SQpCeJW0mXzoPBVHmdQAAAEg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YS5SQpCeJW0mXzoPBVHmdQAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YS5SQpCeJW0mXzoPBVHmdQAAAEg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://regmedia.co.uk/2021/08/31/guntrader_locations.jpg
[7] https://www.theregister.com/2021/07/27/azure_blob_raven_hengelsport/
[8] https://www.theregister.com/2021/07/27/uk_security_breach_reporting_law_thresholds/
[9] https://www.theregister.com/2021/07/23/guntrader_hacked_111k_users_sql_database/
[10] https://www.theregister.com/2021/07/03/in_brief_security/
[11] https://www.theregister.com/2021/05/25/cheese_fingerprint_prison/
[12] https://www.theregister.com/2021/08/04/carphone_dixons_2018_breach_lawsuit_strikeout/
[13] https://www.legislation.gov.uk/ukpga/2000/11/section/58
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YS5SQpCeJW0mXzoPBVHmdQAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[15] https://whitepapers.theregister.com/
Re: No surprises here
> vegan is just a slightly different variant of sociopath from serial killer.
You forgot to compare anyone to Hitler.
Lose 10 internet points, return to 4chan
Re: No surprises here
A bit harsh. Not all vegans are sociopaths: there was one I was acquainted with for over a year before I even knew he was vegan. (Though I have to say, his extreme skinniness and cold sensitivity made more sense after I found out.) Some people (believe it or not) are just quietly vegan for their own reasons.
Re: No surprises here
Veganism is so last year. Air Fryers are the new hot thing to proselytise now.
Re: No surprises here
"vegan is just a slightly different variant of sociopath from serial killer."
That statement is about as a stupid as the belief by any animal rights activist that any person who owns a gun wants to kill animals; there is lots of blanket and straw-man statements. Some vegans choose to be vegan because they extend their empathy of humans to animals, which is the antithesis of sociopathy.
In my experience, the loudest detractors of vegetarianism/veganism often are the most ignorant of what they are talking about, or just cherry-pick the craziest of 'X' groups. Kind of like how some evangelical Christians talk about atheists. But please, I can't wait for you to tell me about my beliefs.
Re: No surprises here
You were all set to get an up vote, then you came out with that super dumb, troll worthy, vegan comment.
Oh and I'm not a vegan, so not offended, it's just one of the dumbest comments ever posted here (and that's saying something with amanfrommars's regular nonsensical ramblings)
section 58
This section should be for those who allowed the break-in to happen, i.e. the guntrader folks. They amassed this amount of data, which itself is an illegal weapon.
This whole episode also should highlight the absurdity from many points of view. Why are there so many firearms and why do we need to have all of this data in a vulnerable place? Oh yes, money. Owning and using guns is fine as long as the government get its cut. Damned the consequences. I guess some people should literally shoot themselves in the foot to get back to earth.
Re: section 58
Watch out you're not caught by plod with a bus timetable in your pocket. That's a clear section 58 violation.
Re: section 58
That's why as a simple precaution the bus timetable bears no resemblance to the actual position of the bus.
It has been suggested that all bus timetables are a deliberate counter-terrorist disinformation program, similar to the fake 'D-Day' army in Dover heading for Calais
Storage
My understanding is that only pest control firearms can be stored at home (locked cab etc) and the handgun stuff only at the range.
So the burglars can be detected for the angle grinder purchases to convert 12-gauges into whippets.
Re: Storage
My understanding is that only pest control firearms can be stored at home
Is there a rigorous definition of "pest". I'm sure that a large percentage of animal activists consider hunters to be pests.
And vice versa of course.
Re: Storage
Nope. The guidance states
"Under the Firearms Rules 1998, a prescribed safekeeping condition is attached to all firearm and shotgun certificates. It is an offence not to comply with these conditions. The maximum penalty for this offence can be up to 6 months in prison, or a fine, or both.
The safekeeping condition attached to firearms or shotgun certificates requires that the guns and section 1 ammunition must be stored securely to prevent, so far as is reasonably practicable, unauthorised people taking or using them. Any other person who does not hold a firearm or shotgun certificate is included in the term ‘unauthorised’.
When a gun or section 1 ammunition is being used or the holder has the gun with him for some purpose connected with its use, transfer or sale, reasonable precautions must be taken for the safe custody of the gun(s) and section 1 ammunition.
The condition does not apply to the ammunition for a shotgun. However, as a matter of common sense, you should take reasonable precautions for its safe custody."
https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/117794/security_leaflet.pdf
Re: Storage
Handgun stuff is completely banned in the UK
Re: Storage
muzzle-loading pistols are legal
Re: Storage
I'm not really sure who downvoted this; [1]Section 5 of the Firearms act says:
Weapons subject to general prohibition:-
any firearm which either has a barrel less than 30 centimetres in length or is less than 60 centimetres in length overall
So yes, pistols are banned. Unless it's an air pistol, or if you are a Crown (not civil) servant (ie Police; Armed forces etc) carrying something issued to you.
[1] https://www.legislation.gov.uk/ukpga/1968/27
Registrations
And just another example of why I don't like registrations of private data. That a company has data this exacting is even more worrying than a government entity having it (maybe).
Consequences
When there is a breach of such calibre, company should pay for relocation of people who fear for their safety.
Even if that includes plastic surgery, replacing documents, buying a house like for like and finding jobs in the new area.
If that makes them go bankrupt? Tough luck.
Re: Consequences
And to demolish every one of those homes too and never allow another living space to be built there? Because potential burglars have no idea if the gun owner still lives at that place or if it has been sold or rented to someone else, who might unknowingly be at risk.
Now this is a blight on house prices the Mail should be reporting ...
if they weren't rammed up the Tories back passage, that is.
"British Association for Shooting and Conservation"
I've always thought that was a strange name for an organisation. Like "The Royal Society for the Prevention of Blindness and Running Around on Uneven Surfaces with Pointy Sticks", or something (RSPBRAUSPS for short).
Re: "British Association for Shooting and Conservation"
Strange as it may seem to people who have only ever lived in towns or cities, if you want birds to live in a wood in order to be able to have a go at shooting some of them once a year then you need to make that place much nicer for them to live than anywhere else.
That involves considerable management of the wood, and preventing pests that may enter it from killing the birds and their young offspring off before they can fly.
You'll rarely find activist protesters doing the boring bits of looking after any woodland for years. Woods have always been managed; completely wild is rarely a beneficial state for most animals/birds.
No surprises here
Animal rights activists committing/provoking/cheerleading the murder of people, what else is new? Anyone who claims they do it because of empathy, compassion, sympathy or anything of the like is fooling themselves, vegan is just a slightly different variant of sociopath from serial killer.