Turkish Citizenship Database Leak (Update 2)
Who would have imagined that backwards ideologies, cronyism and rising religious extremism in Turkey would lead to a crumbling and vulnerable technical infrastructure?
Seen online after a subsequently-deleted tweet called attention to it:
This paste with a link to a 6.6 GB file, purportedly containing clear-text information on 49,611,709 Turkish citizens, including the following details:
- National Identifier (TC Kimlik No)
- First Name
- Last Name
- Mother’s First Name
- Father’s First Name
- City of Birth
- Date of Birth
- ID Registration City and District
- Full Address
An IP lookup places the IP in Iceland, with the owner as Flokinet Ehf, website: twistednetworks.net.
[UPDATE: a commenter points that the source I used was wrong:
First: the IP is located in Romania
Second: that twistednetworks.net has nothing to do with the hosting company Flokinet Ehf. It’s very obvious in the IP whois or even if you do a simple google search, that the host website is https://www.flokinet.is
Please check your facts carefully.
Weird… I’ll have to go back to figure out which lookup site I used that was so wrong, but thanks!
The hackers left a terse message:
Lesson to learn for Turkey:
- Bit shifting isn’t encryption.
- Index your database. We had to fix your sloppy DB work.
- Putting a hardcoded password on the UI hardly does anything for security.
- Do something about Erdogan! He is destroying your country beyond recognition.
Lessons for the US? We really shouldn’t elect Trump, that guy sounds like he knows even less about running a country than Erdogan does.
Turkey’s communications minister has denied reports of a massive data leak containing the personal information of nearly 50 million Turkish citizens, saying the leak was an “old story” from 2010, as allegations triggered concerns over personal data protection.
“This is a very old story. A similar allegation was made in 2010,” Turkish Transportation, Communication and Maritime Affairs Minister Binali Yıldırım told reporters during a meeting with board members of the Turkish World Union of Engineers and Architects (TDMMB) on April 5.
Denied reports? “Similar allegation?” Is he saying that the data are fake or just that it’s an old leak and not new data? The reporters could have done a better job on questioning and follow-up here, but it seems that my suspicion that this was an old leak was correct.
Update: as more info comes out, it seems that yes, these are not new data, but then why didn’t the government ever investigate this leak before? Media (including this site) reported this leak more than one year ago.
Update2: Turkey’s election authority says the leak was not from their system, but the data appear to be data they had shared with others. So one down (if they’re telling the truth), and a bunch of other entities to check with.