Why does sayakenahack have dummy data? If I enter “123456” and “112233445566” I still get results.
I was struggling with answering this question, as some folks have used it to ‘prove’ that I was a phisher. We’ll get to that later, for now I hope to answer why these ‘fake’ IC numbers exist in the sayakenahack.
Firstly, I couldn’t find a good enough way to validate IC numbers as I was inserting them into the database. Most of you think that IC numbers follow a pre-define pattern :
- 6-digit birthday (yymmdd format)
- 2-digit state code
- 4-digit personal identifier, where the last digit is odd for men, and even for women.
But, there are still folks with old IC numbers, and the army have their own format. Not to mention that the IC Number field can be populated by passport numbers (for foreigners) and Company registration IDs. So instead of cracking my head on how to validate IC numbers, I decided to pass them all in.
The only ‘transformation’ I do is to strip them of all non-AlphaNumeric characters and uppercasing any letters in the result. This would standardize the IC numbers in the database, regardless of source file format.
Had I done some validation, I might have removed these dummy entries — but fortunately I didn’t.
Upon further analyzing the data, I went back to the original source files and notice something strange, the account numbers belonged to some strange names. And then it made sense — this was Test data.
Test data in a Production Environment to be exact.
And when the Database for the telco was dumped, the telco’s didn’t remove these test accounts from their system. So what we have is a bunch of dummy accounts, with dummy IC numbers.