Hacker wipes Romania's land registry database

> Basically, what happened is that they rebuilt it from proof of ownership and testimonies of the people

In a similar vein, I was once curious how you would prove your identity if ALL of your relevant documents (passport, driver's license, birth certificate etc) were lost in some kind of cataclysm e.g. a house fire pre-digital etc

Turns out there is actually a mechanism for this:

- get multiple people to sign sworn affidavits that you are who you say you are

- that begins the "paper trail" of evidence that allows you to start getting the rest of the document chain

- you rebuild from there.

If you're married, there is already a similar process for when a spouse takes the last name of the other spouse. The marriage certificate is the first step and then it goes from there for driver's license, passport, credit cards and so on.

There is little alternative.

A great-great grandfather of mine was mayor of a town through which the front passed twice during WWI. All that survived were basements. Your father's account more or less describes the process by which the land was reparceled.

This is where "possession is 9/10ths of the law" comes from.

Wouldn't work in a city like NYC where nobody knows their neighbours and a chunk of houses are empty and only owned by shady shell companies as investments...

There are also physical markers in the ground at the corners of most properties. So if you had to, you could send a surveyor out to recertify boundaries. That would get very expensive quickly, however.

Not saying that this is the only reason, but it is a big reason why we have a land survey of our property on hand on paper and stored online. If something ever happened to the registry, we could at least establish our claim to our land.

I always wonder how things would be reconciled if something similar happened to a bank. What would be the simplest way to ‘download’ one’s balance whilst proving that the downloaded files were signed by the bank?

In my country, titles are always issued in duplicate. The land registry gets one of these originals, and the landowner the other. Just about every landowner has their original on their person, or held by a bank if it's mortgaged.

So all is not lost if the registry goes up in flames.

Happened here about 30 years ago with a fire in a council planning office. All building plans and records were lost. It was enormously useful because there was no way to prove that that house addition there wasn't approved or in any plans. Fans of Yes Minister will know the appropriate quote from Sir Humphrey.

And this is why we need title insurance :(

Is this the scandal to which you are referring?

https://www.bbc.com/news/technology-23588202

Hah, scan-dal.

I am pretty sure I was bitten by this bug, or a similar bug, on an IRA transfer form that I uploaded to a bank. On the scan that I uploaded, one digit in the account number was a clean "5", but the customer service person said it looked like a good clean "6". I presume their document management system was an outcropping of a system originally set up for dealing with faxes, and used that or a similar compression algorithm.

If its at least somewhat recent hopefully those affected still have paperwork for any property ownership transfers. Finding proof of property you bought decades ago would be a huge pain.

It depends. In my country the online land register data is just a copy of the physical land owning certificate. The physical certificates (1 for the owner, 1 for the local government, and at least 1 more for some document keeping agency) are the source of truth.

Quite likely the opposite: a few weeks ago a ransomware attack halted ~100 hospitals' management systems in Romania, and the cybercrime defense unit just disconnected all hospitals and had the local admins rebuild from backups and paper trails. So I'm quite sure that all public administration IT admins have been running drills and probably have up-to-date backups.

> offline backups are not made after every single transaction.

All you need is an append only tape or even a printer.

Interestingly in the Bangladesh Central Bank hack they used a printer to print out any transactions, but the intruders disabled it or it was just malfunctioning because it's a printer.

But I doubt the Romanians actually had such a system.

In such case notaries (or whoever reports transaction) can resubmit them.

Also, you still have paper documents, kept by parties to transaction, right?

My reading is: "The agency would surely be panicking more than this if they didn't have an offline backup".

I think the "offline" part is what is that "appears" to be, clearly they have backups somewhere, but maybe the attacker just missed to wipe some other "online" location.

I interpreted this as a vagueness related to the reporting accuracy, not the existence of a backup.

i think it is a very happy time charging whatever per hour you want

At least in my EU country, no the digital record is the primary.

When you buy property you get a deed for the land, but the details of a property can change after that. The deed also doesn't contain ownership, it just says what is on the land. It's common for land to have multiple owners (1/32 is not unheard of) due to inheritance.

I'm building a house, the land deed just has the land plot as we bought it, until the house is 100% finished (and registered) we will not get an updated deed, although the digital system has newer data (you need to register the construction progress).

In the UK deeds no longer really exist and do not take precedence over the land registry.

Property that isn't registered can remain unregistered but must be registered before it is sold.

Paper records burn great and are harder to store in multiple locations

Any country big enough was moving digital first/digital only for years. And with a paper records there is always a question if this one is the last one and contains a valid data or it's from years ago and since then everything was changed multiple times.

Just recently I've seen a 30 y.o. deed on some commercial property. Despite it was valid and predated the digital era, it had almost nothing common with the things on the ground.

Squatters, boundary disputes and rent defaults happen all the time.

Plus having most of your net worth locked up in something no sane person would consider buying off you because you can't prove you own it is ... suboptimal

People can come and cut down trees, use the land for their cattle, raise crops or just start building something. If you don't challenge it and they get away with it for a while, they could even gain use of the land legally.

Happens far more often than you would think in developing countries.

After the tsunami that hit Thailand and wiped out many fishing villages on the Pacific coast, the people were evacuated but as soon as they returned, they found the local mafia occupying the land, and as they had no need and there was no land registry, they were forced to rebuy their land.

That depends on the state, some do have a registry.

wtf

There are many examples of important paper records (property, birth/death, etc) being lost in fires or floods, so it's not the case that "everything worked perfectly fine" in those days either.

I agree that digitalization is not a panacea, but things did not work anywhere close to perfectly fine when everything was on paper. There are just as many ways for analog/physical processes to go wrong.

A sophisticated genius hacker in a different country can’t touch your paper records, but an absolute moron with a bic lighter can destroy records just as effectively. Hell, an irresponsible clerk can do an incredible amount of damage just by misfiling things.

Duplication literally doubles costs in the physical world, and has the downside of being very hard to keep in sync. A bank keeping paper ledgers would be absolutely fucked if they had to switch to a backup ledger that was more than a few hours old.

On net, I believe that digitalized documents are a net improvement.

Yeah, we’re early culturewise in the digitization experiment and high on optimism about the benefits, but not very far into reckoning with the downsides and incentives skew a bit towards carelessness.

The real danger is that we’ll be so careless we’ll discard other enduring ways of doing things before we smarten up to their particular benefits.

My hope is that disciplined people still have an intuition for this, even among the digitally steeped. Sysadmin/ops types tend to a culture of diversifying backup location and even media type. Maybe that can reach back to human legible hard copy.

Everything comes with a risk, and people usually take it with a decent understanding of how to mitigate it mostly.

If we start thinking along the lines of technology has risk and we shouldn't use it, we should go back all the way to the discovery of fire as we all know fire can cause a lot of damage if in the wrong hands.

That's not how things work in most countries in Europe: the land registry is the authoritative source, and there are no bearer titles any more.

A backup that isn't offline is not really a backup as it far too easy to destroy it even by accident/carelessness/lack of understanding.

When I was responsible for backups we kept the tape cartridges in a fire safe in a different building. We took a full backup weekly and moved the tape from the robot to the firesafe as soon as the backup was complete. Only the daily incremental backups stayed in the robot for more than a day.

> has entire infra in code

> spinning up a new shard takes a quarter

Both can be true

That sounds good, but wouldn’t you worry that the same hackers will let themselves in via the same route again?

You would need to understand first how they gained access and verify that they can’t do the same again. That in itself could take days if not weeks. Then of course they might have found new vulnerabilities while they were in, so you would need to worry about that too.

Only if you routinely test it, and if that kind of access to the offline backup is low friction enough to be doing that monthly, it might not be enough of a redundancy.

> Recovering could be measured in hours.

Yes, even hundreds of them sometimes.

The most time consuming part of recovering from an attack is validating everything. It takes more than a few hours to validate the infra that stays put isn’t compromised, the IaC code itself isn’t compromised, deploy the infra, bring a copy of the offline backup of your data (your IaC can’t drive to another site and bring the backups, then make a copy, unless tou are really sure you removed any trace of compromise), validate that the backup is sound, then restore it.

In some cases the infrastructure part is the least time consuming. Some platforms are straight forward enough that even manual deployment is fast. But after a hack you can’t trust anything so you need to do the slow validation that takes longer than your projected “hours”.

They are getting expert help. I expect that the agency maintained their own local deployment on infra administered by its own employees. Now they are migrating to the central 'government(-maintained) cloud'.

At the same time they are working with authorities.

Not everything needs an external consultant.

Your prejudice knows no bounds.

If it is any consolation, this kind of corruption exists in many countries. I don’t know how to fix this, but corruption always finds creative ways.

Here is one I learned recently - govt started issuing birth certificates online. Hopefully Less corruption, right? Officials made deliberate spelling mistakes in names etc, because you have to go in person for corrections. In person means bribe, which means back to same situation as before (almost)

It's no different anywhere. Security isn't valued since it's just an email and a .01% or less income fine.

The amount of times my SSN and correlated info has been leaked and I've been offered a free year or credit monitoring is depressing.

There is a somewhat valid argument to be made that aggressively trying to hack these insecure government portals could lead to a real reprioritization towards competence.

I'd say form an IT firm and bid on government contracts and do honest work, but we all know how that goes in reality. Honest workers don't get the contracts. You can still try, though.

Vote and join a party

Look at what the new Hungary PM is doing

Use EU funds to build it then tip the EPPO when they defraud the funds?

Its a bit more nuanced than that. The company responsible for ensuring the cybersecurity of the system told the press that "they secured what the client told them to secure and it was not their job to tell the client what needs to be secured".

And I think it's a label that's used freely on Hacker News against Eastern Europeans

This is how we implemented this at our company:

- We have 2 sources of data that we must backup to continue existing as a business; our postgres and binary files in S3. Everything else is derivable (elasticsearch, so on).

- For postgres, we use barman. With the help of opus/fable, you can get a streaming replication backup working in no time. We have one into another server in the same datacenter (we use baremetal) and another one in another server in a different datacenter.

- We then have a last resort barman backup with bi-weekly base backups + WAL streaming to S3 (both the base backup and WALs). It sends these backups + wal segments into an specific S3 bucket that has object lock in compliance mode. This is a feature from AWS S3 that even the most privileged account credentials (super admin) can't turn off nor delete the files before the object lock, which is 10 days in our case. Object lock compliance mode can only be extended, never shortened.

- For S3, we store them into another versioned bucket, with lifecycle rules to also expire non current versions (== deleted objects) after 10 days. No point in object lock compliance here because it would only protect objects for the most recent 10 days, and you gain nothing. What we do instead: the app servers only have access to these bucket tru an IAM credential that can't delete old versions (so deleted objects have to expire manually via the lifecycle rule) AND this IAM credentials also can't change the object policy.

IMHO, this protects us enough so that even in the worst case scenario (ransomware) we have 10 days to sort everything out and recover our AWS access.

And yes, we test the S3 barman restoration and it works fine. Data loss is at max 5 minutes due to the archive_timeout=300s on the primary.

For the streaming replications in the two servers I mentioned, it's less <1ms, but those wouldn't protect us much in the case of the ransomware - even tough we use tailscale and one compromised server can't ssh into the other.

If I remember correctly, this is the hack that Fico tried to blame on Ukraine, even if the hackers were a known Russian ransomware crew that literally posted in their Telegrams about their support for Russia... right?

> Apparently tied to Ukraine in this case.

Lord no! That accusation doesn't pass the sniff test.

Try looking further east for the real culprits.

it took months to go back fully online. they also had usable backups (so they used those for the data), but the infrastructure had so many vulnerabilities that they had to fix it first, hence the delay

Restored from very old backups and paper documents.

In the UK, the old common law rule does not apply to land that has been registered centrally, that is then the legal definition of who owns the property. However there are still properties that are not registered and for those, the rule you describe is still applicable; the holder of the deeds is the owner.

Registration is now compulsory on sales, but that only came in in 1990.

As to what I mean by binned, I mean literally binned, thrown away.

ideally properties of corrupt politicians

Depends on the vendor. Some just admin access to the array, other require a two person authorization to delete it.

local admin credentials or two factor or the BEST is a immutable time-lock, so a snapshot cannot be deleted before the retention period that was set when it was taken expires

Pretty sure fire is a risk to servers as well.

So which one is the ground truth if there is a difference between them?

Seems to be rather sturdy in my experience. Would we even be able to read an electronic record after 100 or 200 years of storage? Old piece of paper is quite accessible.

Seems like fires and floods would also affect servers too.

>had full privileged access to the database

Why does full access include the ability to delete read only data that should never ever be deleted for the rest of time?

It's like building a self destruct button that ignites the physical records. It's an unnecessary risk to make such a dangerous thing.

... and an incorrect password policy and poor access control. Usually, in these institutions, if STS is not responsible, there are third-party companies, usually proxies, that are responsible for managing the firewall and accessing the data. The lack of procedures and lack of supervision from the authority, combined with the delay from the service providers, leads to a situation where everyone does backups as they think is best. That's why it takes so long now, because STS restores data from different formats, from different places, made at different times

Fair enough. But you do realize that all ownership is a made-up shared fiction that most people believe as real.

I always thought the “you will own nothing” expression referred to a Gini coefficient of 1, not 0.

The intent of abolishing private property would presumably be the latter.

Merkel tree audit log of the data, the poor man's Blockchain, works fine and good enough. Now you have a db and you can claim to use a blockchain for pr reasons.

2/3 attack. Read up on BFT.

Yeah, the overwhelming majority of the benefit of blockchain here is just gotten by making the data public and signed.

Now you may argue "that is a blockchain, not every blockchain is associated with a shitcoin" but to be frank that ship has sailed, if you wanted to defend that you'd have had to do a lot more work over the past decade.

> It is a poor idea to use blockchain for government registries. If you want transparency, simply publish signed daily updates and that's enough.

A blockchain is essentially that, just with the daily update that's being signed also including the signature and hash of the previous day.

Blockchain as a technology is actually useful here. It does not mean automatically that blocks have to be mined by third parties, although pseudocurrencies have gone that route for decentralization reasons.

A blockchain solves the problem of consensus under Byzantine faults. Payments are an incidental use case, and not even a good one because managing payments including avoiding double spending can be achieved with a weaker primitive than consensus.

I suppose the idea could be that you have several different institutions holding the same data, which they know is valid because of the Blockchain.

A blockchain isn't stopping you from doing any of those things, if anything it's facilitating different backup models by different parties. A paper record is so much more susceptible to various kinds of risks, adversarial and otherwise. I recommend to look past the hype or hate at the technology. A blockchain is the logical extreme of where you end up when you think about how to sync backups, and you recognize that it comes with certain mathematical limitations on how much disruption you can handle.