- Blog about a good case of social engineering
- Formulate some measures which can reduce the effectiveness of social engineering attempts
In TV was one movie about stealing identity. The story was - how to steal the identity of British home secretary - is it possible and how easy it would be.
The whole story was a show, how easy it would be to warn other people and especially government to do something to prevent it in the future.
In 2007 has been one good documentary about stealing identity - "How Not to Lose Your Identity" by Bennett Arron from Great Britain. He got itself into fraud in quite simple way - shopping company has sent a mail to his old living address, where new resident and also fraudster in this case already lived. The mail contained a postcard, where some kind of home shopping company offered printed catalog. The fraudster ticked the box on postcard to request a catalog, which arrived with order form. The fraudster ordered some goods and that home shopping company opened an account with Arron's name. Then the fraudster bought mobile phone using that home shopping account as proof of his address. This buying using Arron's stolen identity continued until he could stop it. It took Arron and his family three years to recover from the identity theft. Arron approached the companies involved, seeking compensation, but they all refused. Also two weeks after the case that home shopping company stopped sending such postcards to request printed catalogues.
So, Arron started to investigate identity stealing techniques by stealing identities itself using phone book and chose randomly peoples. He stole victim's trash late at night. He got e.g. discarded bank statements, PIN-code notification letters etc, which gave him enough information to have immediate access to the victim's accounts, change their addresses and open new accounts.
First of all Bennett tried to steal his childhood hero Spiderman identity - Peter Parker during 30 days. He found from phonebook even two persons, who carried such name. Hed had the purpose to show to government, how easy it would be to steal someone's identity just by using phonebook and other freely available information. So - choosing the victims took 5 days. He went to the first Peter Parker's house and stole his trash bags from garden. Officially it should be a crime but Bennett took a risk. From stolen trash Bennett found also some useful data - bank security code and PIN-code notification letter.
Then he called to another Peter Parker in purpose to get know his date of birth. Bennett lied, that he is from bank and just checking some details about ordered credit card and among other things he asked the date of birth and got it! Bennett said, that when he has the second Peter Parker's date of birth - he can buy goods from online stores for hundreds of pounds. Lot of online shops doesn't check the person - who they really are and give £200 credit before they start to checking. So identity thieves can try several online shops to order goods with stolen identity...
Then Bennett met one female victim of phonecall, when someone stole her identity and lent a sportscar and disappeared...
Then Bennett went to the big shop and set up some movable walls with warnings about identity theft in U.K. as the most rising crime. He claimed himself as a free identity fraud protector and lot of people gave their personal data without any suspicion. He got 20 people's personal data within two hours (!) and only two people refused to give their data. So now Bennet could even open bank account in the names of these peoples! But he was so honest, that destroyed these papers with collected identities. I guess he could go even more deeply to show to government, how easy it was to collect such sensitive data and what is possible to do with such data - how much damage there can be and how long time it takes to recover.
Then Bennett meets one security expert and asks whether ID-card would solve the problem about ID-theft. The expert says - no.
Then Bennett received a letter from one of the online shops, where he bought photocamera. The shop asked additional provements and Bennett called to that company. Within the conversation the age was asked. Bennett answered wrongly - 34 instead of 24 and this online shop didn't give him credit to get goods before pay. He was quite upset but there was nothing to do - OK, got one lesson about identity theft, Bennett said.
Then he went back to first Peter Parker's house to steal some more trash from his garden by hoping to find some more documents inside with personal information he could use. He found some bank documents and got an idea to change postal address on his bank account.
Next morning Bennett has surprise - one of the online shops sent him goods, what Bennett ordered using first Peter Parker's identity. He got four pairs of shoes as spiders have 8 legs... Just for reminding - Peter Parker aka Spiderman was the hero Bennett is following during his identity theft experiment.
Then Bennett decided to meet that Peter Parker and own up, that he stole Peter's identity. He firmly proved to real Peter Parker, how easy it was to steal his identity by just stealing some trash from his garden and now he has bought even four pair shoes in his name... This meeting went in friendly atmosphere and real Peter Parker was also shocked, how easy this identity theft can be and he was the lucky guy, that this was honest Bennett, who made this experiment and not somebody else.
Then Bennett realized, that even he has a lot of provements how he stole Peter Parker's identity - it isn't enough to show, how serious problem it really is. So - he decided to steal U.K.-s home secretary Charles Clarke identity. Bennett decided, that he should steal the driving licence of his next victim. It's a two stage process - first step was to get Charles Clarke's birth certificate. It was easy to order someone's birth certificate in U.K. - you can order it by using free service in internet.
Then Bennett decided to get new copy of Charles Clarke driving licence in reason it was lost and with changed postal address and Bennett's picture and he readed some warnings from it - if to cheat, then two years in prison or £1000 of penalty is waiting... Bennett wasn't sure whether he wants to do that... But Bennett did it and few days later he got a mail and you don't believe - the new driving licence was there in the name of Charles Clarke but with Bennett's photo... But having a driving licence as a personal identification document, gives you plenty of opportunities to do in the name of stolen identity, whatever you want - only sky can be the limit.
Then Bennett parents visited him and he said to his parents, what he is doing about identity theft case. His parents were very concerned about such experiment and asked whether Bennett don't afraid to be prosecuted doing such criminal things. Bennett convinced then his parents, that he is doing right thing, because the identity theft is really big and rising problem in U.K.-s society and they shouldn't worry about him.
Bennett tried to organize meeting with Charles Clarke's office but it was refused and then Bennett was concerned about how to show and prove all this he has been done. He tried several times to rearrange meeting with home secretary but all the time it was cancelled. Bennett claimed, that he stole Charles Clarke's identity and therefore he wants to meet. I guess this was a mistake to say the reason, why he wants to meet.
Then Bennett decided to write an e-mail directly to Charles Clarke to announce him about the identity theft. Bennett even sent him the copy of driving licence application he used to steal Charles Clarke's identity. Even 5 days later he got no response from home secretary...
Then Bennett find out, that Charles Clarke will go to visit prime minister and he figured out the way home secretary will use when driving and he decided to be next to the road and show directly with posters, that he has Charles Clarke's identity. When Bennett drived to this place, he stuck into traffic jam. Then he went through this route and put lots of paper sheets onto walls and posts to show to Charles Clarke, that he has his identity... He even measured exactly half an mile from parliament to stay and start his protest meeting to show his stolen identity. He wrote onto big posters: "Mr Clarke - Your identity is in my hands". But he didn't succeed - Charles Clarke didn't catch it.
After 6 weeks he sent letters to mr Clarke's office, Bennett found from newspapers, that the home secretary has several problems with his response area and he wasn't anymore the home secretary. Then Bennett said, that he hopes the next home secretary will take more seriously the identity theft and Bennett doesn't need to steal his identity to convince him...
So, Arron started to investigate identity stealing techniques by stealing identities itself using phone book and chose randomly peoples. He stole victim's trash late at night. He got e.g. discarded bank statements, PIN-code notification letters etc, which gave him enough information to have immediate access to the victim's accounts, change their addresses and open new accounts.
First of all Bennett tried to steal his childhood hero Spiderman identity - Peter Parker during 30 days. He found from phonebook even two persons, who carried such name. Hed had the purpose to show to government, how easy it would be to steal someone's identity just by using phonebook and other freely available information. So - choosing the victims took 5 days. He went to the first Peter Parker's house and stole his trash bags from garden. Officially it should be a crime but Bennett took a risk. From stolen trash Bennett found also some useful data - bank security code and PIN-code notification letter.
Then he called to another Peter Parker in purpose to get know his date of birth. Bennett lied, that he is from bank and just checking some details about ordered credit card and among other things he asked the date of birth and got it! Bennett said, that when he has the second Peter Parker's date of birth - he can buy goods from online stores for hundreds of pounds. Lot of online shops doesn't check the person - who they really are and give £200 credit before they start to checking. So identity thieves can try several online shops to order goods with stolen identity...
Then Bennett met one female victim of phonecall, when someone stole her identity and lent a sportscar and disappeared...
Then Bennett went to the big shop and set up some movable walls with warnings about identity theft in U.K. as the most rising crime. He claimed himself as a free identity fraud protector and lot of people gave their personal data without any suspicion. He got 20 people's personal data within two hours (!) and only two people refused to give their data. So now Bennet could even open bank account in the names of these peoples! But he was so honest, that destroyed these papers with collected identities. I guess he could go even more deeply to show to government, how easy it was to collect such sensitive data and what is possible to do with such data - how much damage there can be and how long time it takes to recover.
Then Bennett meets one security expert and asks whether ID-card would solve the problem about ID-theft. The expert says - no.
Then Bennett received a letter from one of the online shops, where he bought photocamera. The shop asked additional provements and Bennett called to that company. Within the conversation the age was asked. Bennett answered wrongly - 34 instead of 24 and this online shop didn't give him credit to get goods before pay. He was quite upset but there was nothing to do - OK, got one lesson about identity theft, Bennett said.
Then he went back to first Peter Parker's house to steal some more trash from his garden by hoping to find some more documents inside with personal information he could use. He found some bank documents and got an idea to change postal address on his bank account.
Next morning Bennett has surprise - one of the online shops sent him goods, what Bennett ordered using first Peter Parker's identity. He got four pairs of shoes as spiders have 8 legs... Just for reminding - Peter Parker aka Spiderman was the hero Bennett is following during his identity theft experiment.
Then Bennett decided to meet that Peter Parker and own up, that he stole Peter's identity. He firmly proved to real Peter Parker, how easy it was to steal his identity by just stealing some trash from his garden and now he has bought even four pair shoes in his name... This meeting went in friendly atmosphere and real Peter Parker was also shocked, how easy this identity theft can be and he was the lucky guy, that this was honest Bennett, who made this experiment and not somebody else.
Then Bennett realized, that even he has a lot of provements how he stole Peter Parker's identity - it isn't enough to show, how serious problem it really is. So - he decided to steal U.K.-s home secretary Charles Clarke identity. Bennett decided, that he should steal the driving licence of his next victim. It's a two stage process - first step was to get Charles Clarke's birth certificate. It was easy to order someone's birth certificate in U.K. - you can order it by using free service in internet.
Then Bennett decided to get new copy of Charles Clarke driving licence in reason it was lost and with changed postal address and Bennett's picture and he readed some warnings from it - if to cheat, then two years in prison or £1000 of penalty is waiting... Bennett wasn't sure whether he wants to do that... But Bennett did it and few days later he got a mail and you don't believe - the new driving licence was there in the name of Charles Clarke but with Bennett's photo... But having a driving licence as a personal identification document, gives you plenty of opportunities to do in the name of stolen identity, whatever you want - only sky can be the limit.
Then Bennett parents visited him and he said to his parents, what he is doing about identity theft case. His parents were very concerned about such experiment and asked whether Bennett don't afraid to be prosecuted doing such criminal things. Bennett convinced then his parents, that he is doing right thing, because the identity theft is really big and rising problem in U.K.-s society and they shouldn't worry about him.
Bennett tried to organize meeting with Charles Clarke's office but it was refused and then Bennett was concerned about how to show and prove all this he has been done. He tried several times to rearrange meeting with home secretary but all the time it was cancelled. Bennett claimed, that he stole Charles Clarke's identity and therefore he wants to meet. I guess this was a mistake to say the reason, why he wants to meet.
Then Bennett decided to write an e-mail directly to Charles Clarke to announce him about the identity theft. Bennett even sent him the copy of driving licence application he used to steal Charles Clarke's identity. Even 5 days later he got no response from home secretary...
Then Bennett find out, that Charles Clarke will go to visit prime minister and he figured out the way home secretary will use when driving and he decided to be next to the road and show directly with posters, that he has Charles Clarke's identity. When Bennett drived to this place, he stuck into traffic jam. Then he went through this route and put lots of paper sheets onto walls and posts to show to Charles Clarke, that he has his identity... He even measured exactly half an mile from parliament to stay and start his protest meeting to show his stolen identity. He wrote onto big posters: "Mr Clarke - Your identity is in my hands". But he didn't succeed - Charles Clarke didn't catch it.
After 6 weeks he sent letters to mr Clarke's office, Bennett found from newspapers, that the home secretary has several problems with his response area and he wasn't anymore the home secretary. Then Bennett said, that he hopes the next home secretary will take more seriously the identity theft and Bennett doesn't need to steal his identity to convince him...
Certainly - this is the most desperate way to prove, how easy it could be to steal someone's identity and it is just amazing, that politicians doesn't do anything to stop this. At least Bennett Arron made this movie to show this and I hope the word will spread across the globe to warn people to be more paranoiac when giving out personal data over phone or throwing out important documents. Be warned - you could be the next victim of identity theft!
Some links:
- the movie How Not to Lose Your Identity (2007) (Bennett Arron)
- http://www.imdb.com/title/tt1034313/
- http://www.bennettarron.com/identity-theft/
- https://www.youtube.com/watch?v=-URDjwb0fS4
- http://www.zdnet.com/article/auscert-2011-firms-ignore-id-theft-risk/
- another movie Identity Theft: The Michelle Brown Story (2004)
Some measures which can reduce the effectiveness of social engineering attempts.
- be a little paranoiac - don't give your personal data such as date of birth, address, name etc over phone, e-mail etc to someone you don't know or not sure, who she/he really is
- be a curious and ask, who she/he is and what purposes she/he have and what & why is planned to do when asking such sensitive information
- never give any personal information out through electronic channels - if it's needed - ensure, that it is secure enough and you with another side are the only one persons, who are accessing this information to avoid spying
- if you are the entrepreneur - please take it more seriously when selling anything or offering any kind of service - be doubtful and require at least double provement of identification
- if there is possible - please require or use digital signing and/or encryption sensitive data when moving or storing it over unsecure channel like internet
- whenever possible - avoid weak/vulnerable software such as Microsoft ones and other proprietary products - you never know, which spies has been there built-in already
- update and upgrade used software frequently to ensure you're protected against sniffing at cyberspace - using e.g. Linux gives you more reliability due to fact, that they using software digital signing, which avoids lot of malware, including spyware
- avoid proprietary file formats - they can leak sensitive information. E.g. avoid MS Office file formats (OOXML and older ones) and use OpenDocument ones. Even Microsoft released metadata removal tool (for MS Office 2003 only), most people doesn't know about it. Such tool (direct link) should built-in with MS Office itself... Newer MS Office 2007 has it already built-in - read further... Please read further also about metadata removal tools.
No comments:
Post a Comment