A database posted online allegedly contains the personal information of 49 million people on the Turkish citizenship database, potentially making more than half of the population of the country vulnerable to identity theft and massive privacy violations.
The database, which has not been verified as authentic, was posted to a server apparently hosted in Romania on Monday with an introduction reading “Who would have imagined that backwards ideologies, cronyism and rising religious extremism in Turkey would lead to a crumbling and vulnerable technical infrastructure?”
As well as the national ID numbers for all of the entrants in the system, it also contains a large amount of other personal information, including full name and parents’ names, full address, and date of birth. Specifically excerpted from the full dump are what appear to be the specific information of the current president of Turkey, Recep Tayyip Erdoğan, his predecessor, Abdullah Gül, and the current prime minister, Ahmet Davutoğlu.
Alongside the full database, the site hosting the dump also contains some “lessons to learn” for Turkey, hinting at how the data was stolen. The lessons include: “Bit shifting isn’t encryption”, “Index your database. We had to fix your sloppy DB work”, and “Putting a hardcoded password on the UI hardly does anything for security”. The advice suggests that the database itself was shoddily secured, with little effective security to keep whoever accessed it from exfiltrating the entire dump.
The final lesson comes from a different angle, warning Turks: “Do something about Erdoğan! He is destroying your country beyond recognition.” The suggestion that the hacker isn’t themselves Turkish is backed up in another statement, which gives “lessons” to Americans: “We really shouldn’t elect Trump, that guy sounds like he knows even less about running a country than Erdoğan does.”
But those word choices could be misdirection. Some typing errors in the posting suggest a writer whose native language is not English, and Turkish media reports in 2013 suggested that the national database was stolen, but by Russians, not Americans. The manager of Konda, a Turkish opinion pollster, told reporters that “Hackers in Russia hold 54 million Turkish citizens’ ID numbers, addresses, father names” and “in two hours hackers downloaded all the information.”
Turkey’s national ID number system is used to enable access to a number of government services, like taxation, voting, education, social security, health care, and military recruitment. It is also used to verify identity in other cases where security is necessary, such as banking.
On top of the risks of having ID numbers made public, Turks on the database also face the prospect of identity theft purely using the personal information contained within the database. Full names, addresses and birthdays are often enough information to begin the process of “social engineering”, where a small amount of personal data is used to gain access to more, which is then traded off for ever-greater access to the target’s personal accounts.
(The Guardian)
