Identity-theft expert Robert Siciliano covers fraud tactics in a rapid 20-slide presentation. He discusses the Albert Gonzalez breaches, Social Security number vulnerabilities, ATM skimming, phishing, and spyware. He recommends credit freezes and identity-theft protection services.
Chapters
Well, our first speaker to kick off, give it up for Mr. Robert Siciliano! All right, Robert, are you ready? Do this thing. All right, there you go. This is the face of identity theft. Criminal hacker Albert Gonzalez and his organized web mob stole over 230 million records, including credit and Social Security numbers. This kid buried over a million dollars in cash in his mom's backyard. Hey, if the whole speaking thing doesn't work out for me, I know my next business plan. It is said in 2001 that security professionals and software developers were about 1 year ahead of the bad guy in technology. By 2004, the bad guy was 2 weeks behind. In 2010, the bad guy is days, weeks, months, even years ahead of the good guy. We're losing this battle. We are functioning under a fundamentally flawed system. That means the Social Security number has become your primary identifier, and it's available everywhere. Credit, as we know it, is wide open. There's no lock in the door. The bad guy gets your social, they get credit under your name. And fake IDs. What are fake IDs? Easily printed paper documents that can become who you are. I did some searches online and I found this website among many. This is noveltyid.com. Their tagline is, "Your online supplier for novelty IDs." They say, "Be who you want to be. Our system of identification is one that is based on the honor system. It is devised with the mindset that we are all sheep." and there are no wolves? Further, there are 49 valid versions of the Social Security card in circulation. No rhyme or reason. There's 14,000 types of birth certificates. There is 200+ forms of driver's licenses. No rhyme or reason to these identifying documents whatsoever. Further, 14 states are now producing forms of ID with no photograph on them like third world countries. Additionally, please tell me, what is a handwritten signature? This looks like an EKG graph. A handwritten signature is supposed to identify who we are. It has no proactive security value whatsoever. What husband or wife has not forged their spouse's signature? It is a complete false sense of security. And then, uh, public records. The Government Accountability Office estimates that as much as 28% of our records are public. That means death, birth, and marriage certificates, deeds and titles to homes, all with personal identifying information, are now available to the world. 28% of them are online. It used to be you had to go to the state house and city hall to get these docs. Now they're everywhere. They're all over the internet. I did some searches online and I found the quick claim deed for Porter Goss. Who's Porter Goss? He's the former director of the CIA. Here is Porter Goss' signature, his social, his wife Miriam. I blacked them out. This is their private information available online to the whole world. If the former director of the CIA's social is online, where's yours? What's happening is enterprise networks are becoming harder. Enterprise networks, you have big banks, you have major corporations that invest millions billions in hardware and software in the information security professionals to protect their data on their servers, which essentially is our information that they harbor. And as enterprise networks spend all of this money and these resources, what's happening is unprotected networks are sniffed out by the hackers. Unprotected networks of the small to medium businesses, the moms and the pops, it's you and I. It's that unprotected wireless connection to the internet that you have in your home or your office that then becomes the path of least resistance for the bad guy to get into the banks, server. They're going after you now. So what's happening is social media identity theft is when the bad guys use your social media to crack the code. They go to your Facebook page to get your kids' names, your pets' names, your birth dates, your wife's and your mother's maiden name, and they use that information to answer the qualifying questions that you filled out when you signed up for online banking, that email program. This information allows them to reset the password on your social media and on your online accounts. Peer-to-peer file sharing is software you download and install on your computer that allows you to get free pirated music, movies, and software from other people's PCs on the peer-to-peer file sharing network. Problem is, is that P2P can also open up your hard drive's My Documents folder, which means you share your PDFs, your Word documents, and your Excel files with your information with the world. Phishing is emails that we receive that look like they're coming from Bank of America, PayPal, AOL, your bank, that look legitimate. The whole idea behind them is to get you to click on links like this one that says click on www.bankofamerica.com. And you would think if you click on that link it brings you to your bank, but in fact it brings you to a spoofed fake website designed to steal your credentials. The Nigerian 419 scams work so well because people are often naive, gullible, and sometimes greedy. Phishers made $9 billion last year. Developing countries like China and India are now providing scammers with fresh meat. Scams that you and I might have fell for 5 years ago, they're falling for today. And spyware is commercially available software, also in the form of a virus, that when installed on your PC allows a bad guy the option to record all your emails, chats, keystrokes, and websites visited. They can see every single thing that you do on the computer. If you go to the wrong website, click the wrong link, a 14-year-old from Romania can remotely control your computer all day long, might be doing it right now. Mm-hmm. And then key catchers are small hardware devices about the size of the tip of your thumb installed into the back of the PC, into the USB or the PS/2 port, And piggybacking the key catcher is the keyboard plug. And everything you plug into the keyboard all day ends up in the key catcher. We see this a lot in schools where the students plug them into the teachers' PCs to get testing information. And then ATM skimming. ATM skimming is hardware fixed to the face of the ATM over the card slot. This device is designed to skim the information off the back of your credit or debit card. The brochure holder has a small wireless camera in it. That camera takes video of the keypad as you're punching in your PIN code. What you always have to do is cover up the keypad with your other hand. And then ATMs on eBay. Did you know you can buy an ATM on eBay? Criminal hackers and identity thieves are snapping these things up left and right. This one is $612. Anybody can get into the cash dispensing business, deploy them in hotels and restaurants, and skim our information. And how do you like apples, right? This ATM right here is sitting in my garage. I bought this off a guy named Bob at a bar in Boston for $750 off of Craigslist. Bob, however, forgot to clear off the ATM's logs, which meant when I got this thing back to my office, it had over 1,000 credit and debit card numbers on it. ATM security begins with a guy named Bob in a bar in Boston. How do you like them apples? And the way you protect yourself, get yourself a Credit Freeze and Identity Theft Protection. Combined, the two lock down your identity, lock down your Social Security number, so the bad guy can't open up new accounts under your name using your Social. I am Robert Siciliano at robertsiciliano.com. That's 20 slides, 20 seconds each, in 6 minutes and 40 seconds. And that's how it's done. Alright.
