News T-Mobile investigates database crack

http://www.bit-tech.net/news/bits/2009/06/09/t-mobile-investigates-database-crack/1

T-Mobile US is currently investigating claims from a cracker on the Full Disclosure mailing list that he has copies of vast swathes of the company's data.

 

Well, I hope the ******* gets caught and I hope my info is not part of what he stole

 

lol I dunno.. that's pretty ballsy to try and sell it whole like that- I'm sure he'll get offers if it has the right kind of information.. but that's a big risk if he's in the states (I doubt it).. betting russian

 

Was reading about this on slashdot, the amerifags in the comments were saying t-mobile cant 'encrypt' the data because of all the police/agency access rules or whatever - still sounds like this guy has been in their system for a while - if its true then some admins are in for a sacking

 

Well, this amount of data translates into hundreds of gigabytes, of not terabytes. So either this guy exaggerates a bit or T-Mobile have the worst admins in the world, missing such amounts of data going "somewhere". This could also be done from the inside or by an pissed-off ex-employee, in such cases it would be much harder to spot. Either way, it's a big failure for T-Mobile.

@p3n
Encryption of corporate data is a "grey area" and most companies are still afraid to do it at all. In UK for example all kinds of encryption are technically illegal, legally you can't even use SSH or sFTP, in US encryption is okay but the companies are afraid of being accused of trying to hide the data - that happened several times indifferend cases, judges often fail to understand data encryption and assume it's an attempt to hide evidence.

 

Gareth - you are absolutely right. Love the use of the archaic spelling of "gaol" btw. Good to see someone flying the flag for good old British English in the face of the scourge of AmericaniZation.

n3mo - with respect, you're talking rubbish.

 

@mclean007
According to this place:
http://rechten.uvt.nl/koops/cryptolaw/cls2.htm#uk
I was partly wrong. While not entirely illegal, the fact that you encrypt something may be an incriminating fact in itself: "the fact of the appellants' knowledge of the keys may itself become an incriminating fact" (§21)
Also, refusal of handing in the keys on demand doesn't fall under the privilege against self-incrimination, not very democratic if you ask me.