Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
×
Security News

Forget Phishing Just Buy Personal Info 163

Iago writes "If you need information about a person in Moscow, just go to the market and buy it. The Globe and Mail reports that along with the usual pirated software, cd's etc. you can find out information such as the bank records of your competitors, motor vehicle information and tax returns. The question is, how much of this information is being sold in other countries, perhaps in a more sophisticated manner?"
This discussion has been archived. No new comments can be posted.

Forget Phishing Just Buy Personal Info

Comments Filter:
  • by Anonymous Coward
    Nothing like fishing eh
  • by pcmanjon ( 735165 ) on Thursday July 07, 2005 @02:55AM (#13000786)
    They've been doing this for years in other countries. What most people don't realise is that most of these stories you hear about personal information/security breaches (Lexis Nexis, etc etc etc) usually goes to thugs like this.

    These thugs sell this information to people in the black market. This isn't new stuff neither, the news just seems to hover on this and "identity theft" a lot recently. It's been happening since the 80's.
    • by Peyote Pekka ( 635641 ) on Thursday July 07, 2005 @08:15AM (#13001576)
      The difference is that since the 80's it is much easier. Personal data on Windows servers has made getting personal data that much easier. Doing that and connecting it to the Internet is just asking for a gross- or willful-negligence lawsuit. Take the case of the recent Mastercard incident: (sorry, link in Finnish) [tietokone.fi]

      People burned by that one could go for a class action lawsuit against either Mastercard their service supplier or the software vendor or a combination. There's no excuse for using tools known to be defective in a networked context.

      Increasingly that said same vendor has been associated with breaches of security and failures. A year ago it was voting machines now this...

    • Not long ago here in Mexico, a punk servicing a PC in the Federal Electoral Institute downloaded and sold the ENTIRE National Voter Registry to a two bit data aggregator, which in turn sold the database to Choicepoint in the U.S.

      Now the National Voter Registry contains the name, address, telephone and date of birth of all the people over 18 in the entire country. It is the basis for the most trusted identification used over the country and of our voting system.

      The costs of managing and updating the regi

  • A better question (Score:4, Interesting)

    by Anonymous Coward on Thursday July 07, 2005 @02:57AM (#13000792)
    A better question is, how much of this information is real?
    • Comment removed (Score:4, Interesting)

      by account_deleted ( 4530225 ) on Thursday July 07, 2005 @03:22AM (#13000850)
      Comment removed based on user account deletion
      • Re:A better question (Score:2, Interesting)

        by myukew ( 823565 )
        I don't think so, I haven't much black market experience, but I think it's much easier to fake databases than stealing them. And judging by the ratio of fake software and audio sold on such markets I would say that the chances are good to be ripped of buying such databases
        • Comment removed based on user account deletion
        • Beyond fake, one would suspect a percentage of the information is of the honeypot variety, and will lead to a knock on the door at an unreasonably early hour by some nondescript fellows with a subpoena.
        • I can find my own passport number, my mobile numbers and my car's registration number in these databases. I routinely use these databases to find post addresses of my friends by their phone numbers.

          So I guess these databases are pretty correct.
    • The problem is, if *any* of it is real, then we have a problem.

      Especially recently with all of the banks coming out with information of their customers being comprimised.
    • Probably a good deal of it. While the article focused on Russia, another recent article showed how easy it was to get the personal information of people from databases which had been offshored.

      $100 (even Canadian) per CD is a worthy amount of money in Russia or other second/third world countries where back-office operations have been off-shored to. This problem is only going to keep growing at these price levels.

      The point here is that there is very strong incentive to provide accurate data at these pr

  • Why buy the cow when you can have the milk for free? Phishers/Pharmers will still steal things rather than pay for them. Besides, like it says in the article, the illicit databases are compiled from data stolen by hackers, so it's just another layer in the cake of computer crime.
    • well why not steal it, use it, and sell it...you get what you want and you make a bit on the side to the inept phishers that haxor your mghz to get your info... thats what i do...er....would do... isnt that right jason mitchell, 5425 34th st apt 12105 san francisco ca 94014...

      btw where are the soviet russia jokes... i read 9 posts when i posted this, and none of them started "in soviet russia..." i know people typicall dislike them here, but can you really think of a more approite story...
    • It's not only the idea that phising / pharming is free, the data just might be more accurate. I know from my own habbits I'm not too happy to provide personal information on websites where it's easy to be harvested. On the other hand if a piece of malware is distributing the info while I'm not aware of it, it just might be more accurate
    • by Anonymous Coward
      wasn't Layer Cake (er, i mean L4yer Cake) meant to be a pretty good film?
      as for the id stuff, well there're plenty of big companies whose sole purpose is collection and selling-on of personal data, such as credit history, full name, address, telephone number, spending habits and so on.
      This is the main reason i'm dead against the UK's proposed id cards. I simply don't trust whichever crappy company they award the contract to not to sell all my details to a bunch of criminals. And by criminals i mean real c
  • Disinformation? (Score:5, Interesting)

    by Anonymous Coward on Thursday July 07, 2005 @02:58AM (#13000795)
    A massive flood of fake information would dilute the value of stolen i.d. right?
    • very good point, and perhaps a tactic in full effect
    • Re:Disinformation? (Score:3, Interesting)

      by lifeblender ( 806214 )
      Not at all. It would increase the value of trusted stolen ID information. In the end, it would just make thieves use more sophisticated social networks, etc. They'd get around it, and would be willing to pay more for real data, since the work that went into collecting it and verifying it was greater.

      To sum up, it's still supply and demand, and you're talking about diluting the supply. That means that, for those who can get at the 'good stuff', it's worth more.

      On the other hand, if the FBI and the cred
    • This is a fairly good idea, actually, and I actively do this myself to throw off data mining programs. The basic idea is, always fill out surveys and any other demographic feedback forms whenever you can with completely fake and contradictory (but positive) information. With enough confusion associated with your digital identity, you become less likely to be singled out for anything as you will not fit basic marketing or actuarial profiles (be it from legitimate sources or not).
  • by Anonymous Coward
    you need your social, call me 555-5555
  • But, I thought information wants to be free?
    • by RAMMS+EIN ( 578166 ) on Thursday July 07, 2005 @03:38AM (#13000905) Homepage Journal
      Yes. If this information were Free, at least we would be more aware of what was happening. And criminals wouldn't be getting paid for it. This way, the criminals and the people with money benefit.

      I personally don't think I care if my and everyone else's "personal" information becomes public. I don't think there is anything extremely interesting about it. People already find out my phone number, email address, street address, bank account number, sometimes even credit card number, user name, real name, etc. etc. etc. as it is.

      All that said, I don't think it's necessary to make all everything publicly accessible. It does open the door to more fraud (although it can also help catch fraudsters more easily!), spam, etc. So let's say that public information wants to be free, and private information wants to stay private?
    • Yes... keep that in mind. Every information wants to be free. And if you compile a lot of information in a database, this information is likely to leak further. It's like herding sheep. Some of the sheep are bound to get lost eventually.
    • Well RTFA, its not free; you have to buy it.
  • Isn't it scary? (Score:2, Interesting)

    by Quentusrex ( 866560 )
    Doesn't it scare all of you that this has been happening for so long already? I'm not saying there is much we can do about it, but it's still scary.

    Now think about the databases the FBI and the airport security are keeping about you. Not only that but also the ones K-Mart, Wal-Mart, Target, Giant(foods), and other stores. It shouldn't be too hard to be you. Just find out your address, and jump on Google maps. Find the nearest stores to you. With your name and address find out your shopping history. And ex
    • Now think about the databases the FBI and the airport security are keeping about you.

      Not sure I'd worry as much about them. The FBI computer systems aren't as sophisticated as people seem to think. The danger from them is the type of information they have access to in other systems. And the ability to aggregate that information into a file supplemented by direct observation. That's what the real brewha with the Patriot Act is all about. The FBI's ability to do that without judicial oversight. The pr

  • by truckaxle ( 883149 ) on Thursday July 07, 2005 @03:05AM (#13000809) Homepage
    Sell a man a phish he can scam for a day, but teach him how to phish and he can scam for himself for a lifetime.
  • by Willeh ( 768540 ) * <rwillem@xs4all.nl> on Thursday July 07, 2005 @03:10AM (#13000820)
    Yeah right, and what's to say this information is actually valuable? TFA says that at least some of it is, but just like bulk email lists there's bound to be a lot of chaff in all of it, due to natural entropy of data, etc etc.

    And it's not like these lists ever get refreshed much, so what you end up with is increasingly less useful data in these lists, and the vendors don't even care about it. It's just the nature of the beast (and the overall state of former Russia, where anything goes).

    • by Peeteriz ( 821290 ) on Thursday July 07, 2005 @03:45AM (#13000923)
      The things you can buy in Moscow market are the real thing - Russian IRS database, with the income information as accurate as the authorites have it, the living addresses are the ones that the police use, etc.

      If it says 'Tax returns 2003', then it really is the tax returns, as they were for 2003, complete with the ability to easily search for, say, addresses and family relationships of persons in your neighbourhood with more than 100,000$ income last year.
      • On the other side of it though, the next time that the Kremlin wants to make someone vanish, and erase them completely from the public records, there will still be millions of copies of the original records floating around.
    • by RAMMS+EIN ( 578166 ) on Thursday July 07, 2005 @04:23AM (#13001019) Homepage Journal
      ...and the overall state of former Russia...

      Dude! When did the revolution happen? I'd better go and update my little database here [cia.gov].

      Are you sure about your sig? ;-)
    • These Gangsters will defiantly sell you the real thing . If they sell you a fake then they will earn a reputation and lose a lot of business , and if they sell that false information to someone of equal criminal intent then they run a very high risk of a punishment beating or a hit.
      Simple as that , so you can pretty much guarantee that they are selling genuine information , they are mostly selling it to people with equally dubious morals .
      they're no small fry scam artists job nor grifters , these are major
    • I'm sure it's real...

      I mean, if this was a scam someone would have turned the sellers in to the cops for false advertising by now. The market takes care of this kind of thing itself.

      *cough*
  • by Behrooz ( 302401 ) on Thursday July 07, 2005 @03:11AM (#13000822)
    The question is, how much of this information is being sold in other countries, perhaps in a more sophisticated manner?

    All of it, of course. Sooner or later we're going to have to get used to the idea that the concept of preserving privacy as a society disproportionately benefits individuals and groups with the resources to acquire and disseminate information regardless of the obstacles in their way.

    It's too late to save privacy as most people currently envision it. What we need to be doing as a society is focus on transparency and equality-- ensuring that all parties in the social contract stand on an equal footing with regard to what information is publicly available. Secrecy is most dangerous when the powers that be insist that it be one-sided...
    • Wow...I first read this as

      "All of it, of course. Sooner or later we're going to have to get used to the idea that the concept of preserving piracy as a society disproportionately benefits individuals and groups with the resources to acquire and disseminate information regardless of the obstacles in their way."

      Gives the sentence a whole different meaning, doesn't it. And then...

      "It's too late to save piracy as most people currently envision it. What we need to be doing as a society is focus on transparen
  • by The Slaughter ( 887603 ) on Thursday July 07, 2005 @03:12AM (#13000824)
    I think this has always been around, but with the proliferation of the digital era, it becomes easier to make a thousand copies of something.
    Look at medical records, it used to take a few minutes while they looked for your chart. At the medical clinic I currently go to they can locate you instantly. When you go into the doctor's office, he has your information on-screen. If something like a patient's chart goes missing, there's physical evidence that it's gone. But if a computer is poorly secured, you may not ever realized it was compromised.
    What really bothers me is who is purchasing this information. My medical records would be pretty harmless to most people, but what if a coworker with a grudge were to find out about a deadly allergy I have? There's always that scary potential you don't necessarily think about. What if a terrorist uses your identity to get into the country and commit nefarious deeds? Could you be imprisoned while they go free?
    • by RAMMS+EIN ( 578166 ) on Thursday July 07, 2005 @03:53AM (#13000945) Homepage Journal
      ``What if a terrorist uses your identity to get into the country and commit nefarious deeds? Could you be imprisoned while they go free?''

      With the current paranoia, definitely. It's better to be safe than sorry, so let's send back that plane that has someone on board who might be a terrorist (and, after all, anybody could be a terrorist), and let's keep these people safely locked up without a trial, until maybe someday we have some evidence against them, or perhaps for them.

      Seriously. The principle that you're innocent until proven guilty is a healthy one. There's also a reason this has to be proven in front of a judge. These people are trained to be impartial, and to spot weaknesses in the argumentation and evidence on both sides. People in general are easily swayed, especially with media influence.

      Now, to return to your issue about computers, that's a very good point, and highlights an important problem. People think computers don't make mistakes, and information that is stored there and backed up is safe. Both of these are pretty much correct. However, that does not mean that what comes out of a computer is correct in any sense. People still make mistakes when entering information, and I think we here all know how sad a state computer security is in.

      Especially falsification of information from inside is a very real threat. In most applications I have seen, this leaves no traces unless you want it to. Very different from handwritten information, where it's easy to see that something was written by a different person, and investigation may even reveal who that person is. If not by the handwriting, then by the fingerprints.

      Many of these fallbacks are simply not available in computer systems, and with computers being the backbone of virtually everything organized, I think we ought to be really concerned. And, I might add, the fact that most of these are running known faulty software and operated by non-computer-savvy people does not make it any better. Nor does the fact that the workings of said faulty software are hidden.
      • You're right. There's definately cause for concern - there are now so many weak spots in the system. A lot of people with access to these important databases are making less than $10/hr. If you find the right person, $15,000 would get you whatever information or passwords you need - or worse, making changes in records or deleting information.
        It happens too with corporate espionage. Somebody at the help desk might be convinced to hand over the CEO's email account password to a competitor. If I've got $15,000
  • not only in Russia (Score:5, Insightful)

    by Mrs. Grundy ( 680212 ) on Thursday July 07, 2005 @03:12AM (#13000827) Homepage
    What is going on in Russia IS a little scary, but is it really any different that buying the same information from one the businesses operating in the US like choicepoint? The government and industry buys information from HUGE databases legally here in the united states, but for some reason people make it seem scarier when it is a Russian kiosk instead of an american corporation even though both exercise about the same amount of restraint and ethics concerning to whom they will sell information.
    • the american companies usually don't sell your information to burly men named boris and ivan who are planning to kick in your door and put guns to your house as they rob you. I find publishers clearing house sweepstakes and other junk mail to be a much smaller annoyance.
      • the american companies usually don't sell your information to burly men named boris and ivan who are planning to kick in your door and put guns to your house as they rob you. I find publishers clearing house sweepstakes and other junk mail to be a much smaller annoyance.

        "burly men named boris and ivan" can buy your information in the US, all they have to do is hire a lawyer to buy it for them via a corporation the lawer made. Americans are safe from widespread home invasion robberies because they have an

    • What is going on in Russia IS a little scary, but is it really any different that buying the same information from one the businesses operating in the US like choicepoint?

      It is different - slightly.

      In Russia, information is manufactured so that their kangaroo courts can convict slightly shady characters like Mikhail Khodorkovsky [iht.com] on different artificial trumped-up charges.

      In the USA, Choicepoint [gregpalast.com] is contracted to manufacture a suspiciously faulty system and a trumped up list of "felons" to be barred from

  • I am curious with the wonder of when someone is think the contents will from mother russia be on the wikipedias,

    I am in need of some friendshipful cashmonies
  • I'm not surprised (Score:5, Insightful)

    by Underholdning ( 758194 ) on Thursday July 07, 2005 @03:15AM (#13000839) Homepage Journal
    The rule of thumb is: Do not worry about the means of transport, but the destination.
    In other words - don't worry if the encryption used to send the data is 128 bit or 1024. No one will bother try to sniff'n'hack it anyways. Worry about whom you're giving your info to. Sure - they may have cheap DVD's, but in order to sell you cheap goods, they must save money in other areas. Security is (sadly) one of the first things to go.
    • You cannot not give your financial information to government tax authorities - if their databases get sold, as it is happening in Russia, it's not like you can choose an 'alternate provider'
  • not just Moscow (Score:5, Interesting)

    by Ingvar77 ( 845346 ) on Thursday July 07, 2005 @03:15AM (#13000840)
    In every major Russian city you can obtain almost for free a database with phone numbers(including cell), addresses, car registry and pasports for all citizens of this city.
    Even more, it's hard to find a PC in my own city that doesn't have a "Megapolice" database, which contains all above information accessible throught a single easy-to-use interface.
  • by Shag ( 3737 ) on Thursday July 07, 2005 @03:23AM (#13000856) Journal
    The question is, how much of this information is being sold in other countries, perhaps in a more sophisticated manner?
    The answer to that question is available... for a price. ;)
  • In soviet Russia... (Score:2, Interesting)

    by bloblu ( 891170 )
    ...at least corruption was organized. I'm afraid nowadays Russia is just a big mess. You can't expect anything else.

    Anyway, I guess that these days you better have nothing to hide.
    • Which raises another scary issue. Stolen personal data is not that much of an issue. But what's happening to all those nukes that the soviet union built? I assume they are taking care of them as best they can, but how well is that? What about the ones in other countries, where the president may not be as powerful as Putin? Or what about more remote parts of russia, where people are secretly carrying out their own schemes behind Putin's back?
    • I completely thought the title of the parent was leading up into a "In Soviet Russia, information phishes you!
      • In corporate America, certain organizations are corrupt.
        In soviet Russia, corruption certainly was organized.

        See, wasn't that easy?
  • Grammar? (Score:3, Funny)

    by noidentity ( 188756 ) on Thursday July 07, 2005 @03:28AM (#13000873)
    Forget grammar just stick words together see like this isn't that easy
  • India (Score:4, Informative)

    by romit_icarus ( 613431 ) on Thursday July 07, 2005 @03:30AM (#13000880) Journal
    It's being sold in India. I've met "vendors" who do the round of direct marketing agencies peddling CDs for information. The last I checked, about a year ago, a data CD came for 10c/record...
  • by Tink2000 ( 524407 ) on Thursday July 07, 2005 @03:30AM (#13000882) Homepage Journal
    I've given a lot of thought to the subject lately, and really, I've decided I don't care much. In fact, I honestly believe that anyone who stole my identity would after a quick perusal of what they've stolen feel guilty and probably credit me a couple of hundred bucks or so.

    Hey, you can't steal what isn't there, and my credit is already wrecked beyond belief. You'd have to be a pretty desperate scammer to steal my identity.
  • Just curious when we'll actually stop bleeding our personal info to foreign nations?

    How about security?

    Its pretty scary when you realize we were once at war with Russia. Nuclear stand offs... spys... tight security....

    Just how tight was that security?

    It seems to me that either there never was security, or we're just getting so lazy about protecting ourselves.

    The hellish nightmare that one must go through when having their info stolen... is too much of a burden on the victom. It is not right that we con
    • The article and the databases there are about the personal information of Russian residents (well, including Americans who live there), not some outsourcing mishap.
  • Live in the woods in a shack, no computer, no TV, no stereo, just you, the chickens, the cows, your banjo, and Deliverance. Que creepy hillbilly guitar riff.
  • "Private Eye" CD (Score:5, Interesting)

    by Anonymous Coward on Thursday July 07, 2005 @03:54AM (#13000948)
    A few years ago in Israel a CDROM started circulating with information about more-or-less the entire population. The database was probably leaked from the Ministry of Interior. It was originally used by a private investigations firm but a copy leaked and started circulating freely.

    IMHO, once it's out there it's everyone's civil duty to get a copy, just to level the playing field.
  • by divide overflow ( 599608 ) on Thursday July 07, 2005 @04:09AM (#13000984)

    The easiest way to buy personal information here in the U.S. is to set up a fake company, then request the desired information from one of the major credit bureaus: Experian, Equifax, TransUnion, or ChoicePoint. Back in February ChoicePoint admitted to releasing the information on at least 145,000 consumers to fake companies [msn.com].
  • by dan dan the dna man ( 461768 ) on Thursday July 07, 2005 @04:17AM (#13001005) Homepage Journal
    In the UK I've had the ... pleasure (?) ... of knowing some exceedingly dodgy people with very good technical skills. This information has been available to criminals with the requistite amount of cash as long as hackers (sorry crackers) decided they could make a fast buck doing companies rather than pootling around insecure university networks.

    Nothing new here and it certianly isn't limited to dodgy stalls in Moscow markets or corrupt outsourced callcentre employees.
  • by plaxion ( 98397 ) on Thursday July 07, 2005 @04:33AM (#13001051)
    ...but there aren't enough moderation points available in the /. system to stave off the flow of bad "In Soviet Russia..." _AND_ "PROFIT!" jokes that are going to flood in from this one.

    If you think you have a good one, please save someone a mod point by keeping it to yourself, because if it isn't already redundant, it soon will be.

    This message brought to you by the Moderator Points Association of America (MPAA) *ducks*

    --
    I'm commenting on this story to prevent myself from burning moderator points on useless comments like this one ;)
  • Ransom Want Ads (Score:2, Interesting)

    by Valacosa ( 863657 )
    Though this is only alluded to in the article, one of the greatest dangers is using information like this as an ransom hit-list. If you could abduct the kids of the ten richest people in Moscow, odds are at least one of them would pay up...

    Things like that are depressingly common in some parts of the world.
  • ... rope will hang you!

    The Capitalists will sell us the rope with which we will hang them.
    -- Vladimir Ilyich Lenin
  • Off-topic but (Score:1, Informative)

    by Anonymous Coward
    Off topic but important - bombings in London - so far 3 bus bombs and bombings in the tube reported.
  • by SimianOverlord ( 727643 ) on Thursday July 07, 2005 @06:29AM (#13001256) Homepage Journal
    that they haven't scammed detail from places like say, the NYTimes subsriber database. "Mr A Butthole, Kansas" and "Phil McCrackin, Washington" might find unwanted junk mail winging their way towards them.
  • all day every day (Score:3, Informative)

    by spoonyfork ( 23307 ) <[moc.liamg] [ta] [krofynoops]> on Thursday July 07, 2005 @07:55AM (#13001409) Journal

    The question is, how much of this information is being sold in other countries, perhaps in a more sophisticated manner?

    USian? Go get your free credit report [freecreditreport.com]. Look closely at who has recently requested it. They're getting all kinds of information about you. Your bank, credit card company, mobile phone provider, broadband provider, power company, pretty much anyone with your name addy and social security number can sell your info to be requested by someone else at any time. This is a perfectly legal and legit practice. Regarding other countries, these businesses who outsource IT to India/China/Russia will locally all have this information to trade on the white and black market where there are even less data privacy laws.

    I used to worry about identity theft and related crimes. I used to think I was the one in control and had the responsibility of securing my personal information. No, the companies that trade on personal info and credit have the control and the toothpaste is out of the tube. I can never secure the last 30 years of my information again, so why bother trying? All I can do is be vigilant in trying to detect fraud and deal with it on a case by case basis.

    There is too much commerce at stake for governments to pass laws to ensure data privacy or make issuing credit more secure. Stop whining and start making arguments to your local politicians for doing what you want to be done.

    • While you can see who's requested your credit report (and I'd recommend you check it at least annually), this has limited utility.

      While most financial institutions will prefer to obtain this data directly from the major vendors (Experian / Trans Union, Equifax), the problem is that data are transitive, but data tracing is not. You have no idea who among the entities who've requested your data have passed it on, or let it slip, to others.

      You may see the secondary queries and activity resulting from su

  • by varmittang ( 849469 ) on Thursday July 07, 2005 @09:21AM (#13002359)
    Hell, you can buy your wife while in Russia. I would expect to be able to buy just the info on other people's wifes.
  • how much of it is accurrate? And how much of it could end up circulating around, get laundered through a grey market vendor and end up in a law enforcement or financial database?

    This could have serious implications for an individual's credit rating or whether they end up as a guest of a government security agency indefinitely with no legal recourse.

    I have worked in situations where we bought information on customers and just off hand I would say that when we compared our known good (recently updated by t
  • Replies to this thread will list specific references to companies that provide this service, or hashes of files on P2P.
  • In most states you can go to DMV and get their entire database for 50 or so bucks. In Oregon one guy used to post it online, so they made posting it online illegal. (Of course they didn't STOP selling the information!).

    They pretty much give you everything you need to commit identity fraud: License plate number, Car type, DL license, address, banking information, vin number, DOB, and supposedly you can even get the license database which includes driver photos!
  • A couple of notes about it.

    1. I get several pieces of spam in Russian every day advertising these databases. Dammit.

    2. Law enforcement in Russia does nothing about it. In the current situation, it is trivial to catch the seller: the databases advertised in spam, for example, are delivered by a courier. If the police were interested in hindering this activity (or forcing it deeper underground, at least), they would do this in a blink of the eye. Nothing is done, though.

    3. I like the way Norway deals

"Protozoa are small, and bacteria are small, but viruses are smaller than the both put together."

Working...