an ancient us military equipment what was sold on eBay contained what appears to be biometric data from troops, known terrorists, and people who may have worked with US forces in Afghanistan and other Middle Eastern countriesaccording to a report in The New York Times.
According to The Verge, the devices were purchased by a group of hackersWhat did you find fingerprints, iris scans, images and descriptions of people, all unencrypted and protected by a “well documented” default password.
In a blog post, the Chaos Computer Club (CCC) called obtaining sensitive data “absolutely boring” given how easy it was to read, copy, and analyze.
However, Matthias Marx, who led the group’s efforts in investigating the devices, doesn’t think the data itself is boring, calling the fact that they were able to get their hands on it “incredible.”
What will they do with the information?
Although they plan to delete the data after CCC finishes their investigation, what they have already found raises concerns about how the military stores this information.
In total, members of the Chaos Computer Club bought six devices, which the Times says the military used a decade ago. to collect biometric information at checkpoints and during patrols, checks and other operations.
Two of the devices, both Secure Electronic Enrollment Kits or SEEK II, had information on their memory cards. According to the hackers, one of the devices contained the names of 2,632 people and “highly sensitive biometric data” that appeared to have been collected around 2012.
The device it only cost them $68. The Times adds that the company that sold it on eBay after buying it at auction did not know it contained sensitive data, according to one of the employees it spoke to. In theory, the devices should have been destroyed after they stopped being used.
The response from the United States and device vendors is also not reassuring: the Times contacted the Department of Defense, which simply requested that the equipment be returned to it. The CCC, for its part, assures that he also contacted the Department and they told him to contact the manufacturer of SEEK, HID Global. The hackers say they received no response.
