.

How I Stole Someone's Identity

<<

don

User avatar

Administrator
Administrator

Posts: 4226

Joined: Sun Aug 28, 2005 10:47 pm

Location: Chicago

Post Fri Sep 05, 2008 12:20 pm

How I Stole Someone's Identity

Kewl article on Scientific American I found through a recent post by sgt_mjc Password reset beware.


The author asked some of his acquaintances for permission to break into their online banking accounts. The goal was simple: get into their online accounts using the information about them, their families and acquaintances that is freely available online
By Herbert H. Thompson

As a professor, a software developer and an author I've spent a career in software security. I decided to conduct an experiment to see how vulnerable people's accounts are to mining the Web for information. I asked some of my acquaintances, people I know only casually, if with their permission and under their supervision I could break into their online banking accounts. After a few uncomfortable pauses, some agreed. The goal was simple: get into their online banking account by using information about them, their hobbies, their families and their lives freely available online. To be clear, this isn't hacking or exploiting vulnerabilities, instead it's mining the Internet for nuggets of personal data. Here's one case. I share it here because it represents some of the common pitfalls and illustrates a pretty serious weakness that most of us have online.

Setup: This is the case of one subject whom I'll call "Kim." She's a friend of my wife, so just from previous conversations I already knew her name, what state she was from, where she worked, and about how old she was. But that's about all I knew. She then told me which bank she used (although there are some pretty easy ways to find that out) and what her user name was. (It turns out it was fairly predictable: her first initial + last name.) Based on this information, my task was to gain access to her account.



For full story:
http://www.sciam.com/article.cfm?id=ana ... ocial-hack

Don
CISSP, MCSE, CSTA, Security+ SME
<<

sgt_mjc

Sr. Member
Sr. Member

Posts: 294

Joined: Tue Feb 05, 2008 8:34 am

Location: AL

Post Fri Sep 05, 2008 1:17 pm

Re: How I Stole Someone's Identity

Whats scary here is that she volunteered some of the information like her user name. User = weak link. Thanks don for the article.
Mike Conway
CISSP
CompTia Security +
C|EH
<<

X_Spec

Post Thu Oct 16, 2008 12:07 pm

Re: How I Stole Someone's Identity

Quite believeable considering the vast amount of information stored online
now''a'days personally i don't bank online and probably never will after reading this.

Return to Tutorials

Who is online

Users browsing this forum: No registered users and 0 guests

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software