A group of hackers, known as "doxing-as-a-service" providers, have been tricking major tech companies into sharing private data by impersonating law enforcement officers. These hackers, who call themselves "Exempt," use spoofed email addresses and fake documents to convince companies that the requests are coming from a legitimate source. They claim that they have successfully extracted sensitive information from virtually every major US tech company, including Apple and Amazon.
The hackers' method involves using authentic or convincing fake law enforcement email accounts, as well as creating fake domains that mimic legitimate police departments. They also craft highly convincing fake official documents to back up their requests. Exempt claims that he has made up to 500 successful requests in recent years, with the highest-paying request being $1,200 for a single dox of someone who was allegedly "grooming minors on an online gaming platform."
The hackers exploit loopholes in the system by using emergency data requests (EDRs) that bypass additional verification steps. These EDRs are typically used in cases involving threats of imminent harm or death, and companies under pressure to fulfill the request quickly often comply without verifying the authenticity of the request.
Tech companies have laid out step-by-step guides on how to craft these requests, but even with these guidelines, hackers can still find ways to exploit the system. Apple, for example, provides a form that allows government or law enforcement agents to request information from the company, but Exempt claims that he was able to make requests through this form using compromised law enforcement email accounts.
The problem is partly due to the fact that there are over 18,000 individual law enforcement agencies in the US, all of which use their own email naming conventions and domain registrations. This creates a complex landscape for companies to navigate when it comes to verifying the authenticity of requests.
To address this issue, some companies like Kodex have developed secure online portals that law enforcement can use to make data requests. However, even with these systems in place, hackers can still find ways to exploit weaknesses.
The FBI's former agent turned security expert, Matt Donahue, notes that traditional communication channels like email are not designed for the level of identity verification and real-time decision-making required in modern investigations. He argues that public/private-sector coordination is crucial in preventing such exploits, but says that anyone suggesting these requests are carelessly responded to has little understanding of the subject matter.
The incident highlights the need for greater security measures and better communication channels between law enforcement agencies and tech companies to prevent such exploits. It also underscores the importance of awareness about the risks of doxing and the importance of protecting sensitive information.
The hackers' method involves using authentic or convincing fake law enforcement email accounts, as well as creating fake domains that mimic legitimate police departments. They also craft highly convincing fake official documents to back up their requests. Exempt claims that he has made up to 500 successful requests in recent years, with the highest-paying request being $1,200 for a single dox of someone who was allegedly "grooming minors on an online gaming platform."
The hackers exploit loopholes in the system by using emergency data requests (EDRs) that bypass additional verification steps. These EDRs are typically used in cases involving threats of imminent harm or death, and companies under pressure to fulfill the request quickly often comply without verifying the authenticity of the request.
Tech companies have laid out step-by-step guides on how to craft these requests, but even with these guidelines, hackers can still find ways to exploit the system. Apple, for example, provides a form that allows government or law enforcement agents to request information from the company, but Exempt claims that he was able to make requests through this form using compromised law enforcement email accounts.
The problem is partly due to the fact that there are over 18,000 individual law enforcement agencies in the US, all of which use their own email naming conventions and domain registrations. This creates a complex landscape for companies to navigate when it comes to verifying the authenticity of requests.
To address this issue, some companies like Kodex have developed secure online portals that law enforcement can use to make data requests. However, even with these systems in place, hackers can still find ways to exploit weaknesses.
The FBI's former agent turned security expert, Matt Donahue, notes that traditional communication channels like email are not designed for the level of identity verification and real-time decision-making required in modern investigations. He argues that public/private-sector coordination is crucial in preventing such exploits, but says that anyone suggesting these requests are carelessly responded to has little understanding of the subject matter.
The incident highlights the need for greater security measures and better communication channels between law enforcement agencies and tech companies to prevent such exploits. It also underscores the importance of awareness about the risks of doxing and the importance of protecting sensitive information.
I'm not convinced these "doxing-as-a-service" hacks are the end of the world. Like, sure, hackers got some tech bigwigs to spill the beans on someone without consent, but is it really that shocking? 
Companies like Amazon and Apple are basically begging for this kind of thing by making it so easy to request sensitive info with a fake badge or email address. Come on, guys! Use two-factor auth and verify those emails already!
Like, who needs fake IDs and documents when you have a better way of identifying yourself online? And honestly, how much is $1,200 really worth when someone's personal info gets leaked all over the dark web? 
Let's just say I'm not buying into this "oh no, hackers are so scary" narrative.
. Like, what's the point of even doing that? They're just exploiting loopholes in the system to get private data from major tech companies. And it's not like they're even using their own email accounts or domains anymore - they're spoofing legit ones and crafting fake docs too 
. It's soooo easy for them to find vulnerabilities in the system, especially with all these individual law enforcement agencies out there using their own naming conventions and domain registrations. 
. It's time for tech companies and law enforcement agencies to work together more closely to prevent these kinds of exploits. And we need better security measures in place ASAP 
. Can't have just anyone making dox requests without proper verification, you know?
... They're literally preying on loopholes in the system, exploiting people's trust for their own gain 
. It's like, what's next? Companies are already making steps to make it harder for them, but I guess you'll never be 100% secure 
. We need to raise awareness about this stuff so people can protect themselves online 
They're like ninjas, sneaking around and getting away with all this sensitive info 
.
. I mean, 18k law enforcement agencies in the US? That's a lot of variables 
.
. We need better security measures and clearer communication channels to prevent this kind of thing from happening again 
. It's not just about doxing anymore, it's about protecting people's identities and sensitive info 
.
i feel so much for all the companies that got tricked into sharing their data, especially apple and amazon 
it's like they're trying to exploit loopholes in the system & take advantage of tech companies' good faith 
anyway, gotta say, it's crazy how these hackers are making up to $1200 for a single dox 
But seriously, this is super serious stuff! These guys are basically exploiting loopholes in the system to get sensitive info from major tech companies. It's crazy to think that they're making over $1,200 per dox! 
. I mean, we all know about the importance of protecting sensitive info, but this is on a whole different level! 
. It's time for law enforcement agencies and tech companies to work together to prevent these types of exploits in the future 
.
. i feel like we need some kind of national ID system for law enforcement emails or something 
but at the same time, hesitating to make changes because of all the people who would say "but what about our 4th amendment rights?" 
I'm so glad that Kodex is working on secure online portals but like, what's being done about the other companies that don't have this system in place? 
gotta keep our info safe! 
companies need to step up their game and create more secure systems for making data requests. public/private sector coordination is key, but i guess it's not that simple 
and yeah, i see what they're doing with the law enforcement angle - it's like they're exploiting a loophole in the system to get what they want. 
maybe they can help prevent some of these hacks in the future? and yeah, awareness about doxing is super important too... we need to be more careful about what info we share online 
.
and find ways to verify authenticity without falling for these fake requests. It's crazy that law enforcement agencies have so many different email naming conventions & domain registrations - it's like a nightmare to navigate!