ie8 fix

How to find out if your personal info has been leaked in a security breach

By | July 13, 2011, 5:00am PDT

Summary: If you want to find out if your email address was stolen in a hacker breach, try out this tool.

When I was an undergraduate in engineering school, I worked on side projects. They weren’t exactly intended for the public good.

Kids, don’t try this at home

One project involved building a long-range beam laser that we could shine down from the dorms and freak out the drunks stumbling home from frat parties. Another was perfecting a multi-stage bottle rocket we could launch from a stealthy launch platform in our dorm window, which would fly halfway across the quad before igniting the second stage and then strafing the campus security guards as they did their rounds.

The world was a different place in the late 1970s. Those stunts would have landed me and my fellow engineering students in an ocean of hot water, had they been attempted in this post-9/11 era. Back then, it was just lolz all around.

Granted the projects I did for degree requirements were academically sound (I did graduate with honors, after all). But the side projects, well, socially redeeming wasn’t exactly a concept I was able to fully integrate into my psyche until well after I graduated.

His mother should be very proud

And then there’s Julian Pulgarin. Julian was an intern at Facebook and is currently a candidate for Bachelor of Software Engineering at the University of Waterloo in Ontario, Canada.

Julian decided, what with all the lists of personal information being released to the public by the likes of Anonymous, Wikileaks, AntiSec, and LulzSec, individuals might be worried that their information might now be out “in the wild.”

So Julian’s been curating the released data. He’s built a database containing all the email addresses (over 1.4 million addresses, including the Booz Allen Hamiliton breach).

See also: Military Meltdown Monday: 90,000 military email profiles released by AntiSec

All you have to do is go over to HackNotifier.com. Enter your email address (which he promises me he’s not capturing), and the site will tell you if your email address is in any publicly available leaked database.

Now, Julian’s not all altruism and spice and everything nice. He’s got a neat, little profit engine built into his database, which is the “notifier” portion of the site. For $9.99 a year, you can register with HackNotifier and if any new breaches do have your information, he’ll let you know.

The necessary cautionary words

Obviously, all I have is Julian’s word that he’s not capturing email addresses for future nefarious purposes, but in my conversations with him, he seems like a good kid. He’s built a useful service and, if he’s lucky, he might also make a few bucks off it.

Me? Well, I probably shouldn’t say any more about what I was up to when I was his age, but it sure as heck wasn’t public service.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

David Gewirtz, Distinguished Lecturer at CBS Interactive, is an author, U.S. policy advisor, and computer scientist. He is featured in The History Channel special The President's Book of Secrets.

Disclosure

David Gewirtz

At various times during his adult life, David has voted for both Democrats and Republicans, and has been disappointed by both. He is deeply disturbed by how partisanship has come before patriotism in America, which gives him the freedom to pick on both sides.

David is a frequent guest on TV and radio stations across America and can usually be heard or seen on-the-air at least once a week. He writes weekly commentary and analysis for CNN’s Anderson Cooper 360 and has been interviewed by Fox News, CNN, various ABC and NBC affiliates, and Canada’s Global TV. He has been a featured guest on National Public Radio and has also been featured on Voice of America, Radio Free Europe, and Radio Liberty where his commentaries on technology, industry, and emerging nations have been broadcast into 46 countries (all in their own unique translations).

David is the executive director of U.S. Strategic Perspective Institute, a nonprofit research and policy organization. He is the Cyberterrorism Advisor for the International Association for Counterterrorism & Security Professionals, a columnist for The Journal of Counterterrorism and Homeland Security and a special contributor to Frontline Security Magazine. He is a member of the FBI’s InfraGard program, the security partnership between the FBI and industry. David is also a member of the U.S. Naval Institute and the National Defense Industrial Association, the leading defense industry association promoting national security.

David is an advisory board member for the Technical Communications and Management Certificate program at the University of California, Berkeley extension. He is also a member of the instructional faculty at the University of California, Berkeley extension.

David’s “day job” is as publisher and editor-in-chief of ZATZ publishing, an online publisher of technical magazines. Other than than his ownership stake in Component Enterprises, Inc. (the parent company of ZATZ), David has no additional industry investments.

ZATZ has many advertisers who do, in part, provide for David’s lush income and extravagant lifestyle. Most of them are IBM and Lotus aftermarket suppliers, some of them make goodies for Microsoft Outlook, and a few make all sorts of strange mobile devices and add-on products. David has been a regular judge of the IBM Awards, but has no formal financial interest in or with IBM.

Because the ZATZ online magazines often review products, David and ZATZ are sent an overwhelming stream of unsolicited, silly, and often useless products to review. Because they’re such a pain to track and ship back, these products often wind up in a dumpster or fill up the corner of a large closet. Although David has no plans to review products in connection to his ZDNet blog, if he does do a product review, he will disclose any relationship completely in that posting.

Both through ZATZ and independently, David derives a small income through various advertising and sales relationships with Amazon.com and Google. These are minor relationships and they will not impede his willingness or ability to chastise either company should they deserve it.

David has many other business relationships, but none of them relate to anything he covers in his ZDNet blog. David does have a bit of the sales-guy bug and if he’s not doing a sales deal with someone at least once a month, he goes through withdrawal. He has a number of consulting clients, but none of them relate to anything he covers for ZDNet (and if they ever do, he will either disclose that fact, or decline to write about them).

Back in the 1980s, David held the unusual title of “Godfather” at Apple. He has written and published 40 incredibly simplistic applications for Apple’s iPhone.

Although David is forbidden to disclose the terms of his iPhone developer agreement, he isn’t drinking the Apple Kool Aid, will never be confused with a metrosexual, and feels free to mock Apple, and Apple users, any time the occasion permits, on alternate Tuesdays, or if he’s bored.

Biography

David Gewirtz

In addition to hosting the ZDNet Government and ZDNet DIY-IT blogs, CBS Interactive's Distinguished Lecturer David Gewirtz is an author, U.S. policy advisor, and computer scientist. He is featured in The History Channel special The President's Book of Secrets, is one of America's foremost cyber-security experts, and is a top expert on saving and creating jobs. He is also director of the U.S. Strategic Perspective Institute as well as the founder of ZATZ Publishing.

David is a member of FBI InfraGard, the Cyberwarfare Advisor for the International Association for Counterterrorism & Security Professionals, a columnist for The Journal of Counterterrorism and Homeland Security, and has been a regular CNN contributor, and a guest commentator for the Nieman Watchdog of the Nieman Foundation for Journalism at Harvard University. He is the author of Where Have All the Emails Gone?, the definitive study of email in the White House, as well as How To Save Jobs and The Flexible Enterprise, the classic book that served as a foundation for today's agile business movement.

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?
25
Comments

Join the conversation!

Just In

RE: How to find out if your personal info has been leaked in a security breach
jorjitop 17th Jul
@bradavon

That is what webmail accounts are for. You should always create an account with Hotmail, Yahoo, or (heaven forbid) Gmail, just for all these subscriptions and logins that you have to do. No harm in that address getting out.

Better off forgetting Gmail as that is just Google spyware. More risky than most spammers.
0 Votes
+ -
Excellent idea, but too cautious to try it.
Bruce Lang Updated - 13th Jul
"Enter you email below to get started" - Worded like an outside country money scam.

"No emails are stored without your permission" - Okay, but what about my email address?

Sorry, but it's a trust issue.
@bdlang@... Thanks for the feedback regarding the wording. Just to be clear, the email that you enter on our website will be used once in a SELECT query against our database, and will not be stored in any way. If you have any more questions feel free to contact me at jpulgarin@hacknotifier.com
I tried it with Firefox 5 and received an error message saying "Referral Headers" had to be turned on. Couldn't any settings were they could be turned on or off so they must be off by default deeper in the setting of which, I will not mess with. Make the site work with browsers out-of-box.
@The Rifleman This should work soon, it was caused by overzealous cross site request forgery protection which is not necessary under our particular case. Thanks!
0 Votes
+ -
Not so sure
john@... Updated - 13th Jul
Mine did not some up in the search. I was pretty sure mine was stolen in the SOE Hack. I have been a subscriber for SWG since it started. I also get 10 times the spam I used to plus additional Facebook spam.
0 Votes
+ -
Re: Not so sure
jpulgarin 13th Jul
@john@... John, the PSN hack was never made public so it is not in our database. Various other Sony breaches, like the ones published by LulzSec, are.
The site's not loading at all on Chrome 12 or IE9 on Windows 7 for me sad. It just says "Waiting for response...". I live in The UK if that helps.

Sure it's a risk to enter your e-mail address into this site too but then you've already entered it in plenty of other places. Are you sure they're all trustworthy? I know I've used it on web forums, I've then not visited again. I had a question, you need to register before you can ask it.
@bradavon

That is what webmail accounts are for. You should always create an account with Hotmail, Yahoo, or (heaven forbid) Gmail, just for all these subscriptions and logins that you have to do. No harm in that address getting out.

Better off forgetting Gmail as that is just Google spyware. More risky than most spammers.
0 Votes
+ -
dood, get some bandwidth
pgit 13th Jul
ZDNet referrals are apparently DDoS-ing your site. I can't get it to load OR time out. wink
0 Votes
+ -
Server appears to be overloaded... not responding.
0 Votes
+ -
Server's Down
jpulgarin 13th Jul
Hey guys, we're currently moving to a much bigger server, should be about 10 minutes. Sorry for the inconvenience!
@jpulgarin: It's working now and I'm clean happy. Thanks.
OK. I tried, but the site will not take my email address. Is this only for Microsoft users? I use Linux.
OK. I can answer my own question. I typed in address and went to the site. It worked fine for on Linux.
How do I try it out. Down load it.
@rhm1934@... Go to www.hacknotifier.com, enter an email address and hit your enter key or click on "Have I been hacked?" Nothing to be downloaded and installed.
0 Votes
+ -
No good deed...
archetuthus 13th Jul
...goes un-"corrected," unedited, un-"improved" upon, un-picked at.

But it's still appreciated!
0 Votes
+ -
Thanks for the answers
rschoonh@... 13th Jul
Very unusual to see a developer/site operator respond quickly (or even at all) in the article Talkback. Thanks.
"Obviously, all I have is Julian?s word that he?s not capturing email addresses for future nefarious purposes, but in my conversations with him, he seems like a good kid."

That's pretty much what is said about every serial killer.
0 Votes
+ -
Are you serious?!?!
OzRunner 13th Jul
As long as there are gullible people like you lot out there, the Nigerian scammers will have a long and lucrative future. Why would any sane person give some kid their personal details (even if it's only an email address)? You deserve everything that will surely happen!
0 Votes
+ -
Thank you
aspir8or 13th Jul
Unlike some, I was willing to take the risk that hacknotifier was not just an email harvesting site (we all took the same risk when new sites appeared that required your email to join up. Hello Facebook), I entered my main email address and was told that a techsite address had been hacked.

I haven't been to that site for a couple of weeks, but it was the work of moments to reset my pw. I didn't get a nasty notice from them to stop my spamming or whatever other use anyone would find for my account details.

I haven't noticed any change in the quantity or contents of spam (3 - 4 spam messages a day) I use unique pws for every site, so there would have been no point trying to use my details on similar sites or the big sites that have multi-millions of users users, like gmail or facebook.

My other addresses came through squeaky clean, and as I've been changing my pws on everything over the past few days, I don't anticipate any further problems for a while.

So a great big THANK YOU to hacknotifier, and for those who still look under the bed every night to make sure there are no boojums lurking, well that's your choice and I hope you change all your passwords at regular intervals. I do, which means that that techsite's details have only been out in the wild for 2 months at the most, but I'll still be checking with hacknotifier at regular intervals as well.
0 Votes
+ -
Julian was my roommate
narakb2 13th Jul
He is one of the most ethical people I know. He's currently attending Singularity Institute bootcamp, which contemplates the future of humanity and how to further it. This guy isn't going to be doing anything bad with this site.
That's akin to: "I won't drop a load in your mouth...", "The check is in the mail....", "Read my lips: No New Taxes..."

Kenneth Lay, Jeff Skilling and Dennis Kozlowski "seemed" like good kids to someone once too.

Lot's of strange escape/unescape javascript functions and interactions between FB, events(dot)chatteranalytics(dot)com and 980-async(dot)olark(dot)com the moment you hit the "Have I been Hackjed?" button. Seems a little fishy to have all of this interaction with outside servers, including Facebook, for what is purported to be a simple database query.

But I'm sure it's ok... because someone said he "seems like a nice guy."
0 Votes
+ -
okay.. even if he is honest
brambo2000 14th Jul
what happens when someone hacks the kids hacknotifier.com servers. they pick up even more info (ie if big business can't secure their servers.. how can the kid). what is he going to do put it in his basement? and live over the top of the server farm?? happy

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix