34 ms·

This reminds me of the "I Will Kill You & Birth You" DEFCON presentation by Chris Rock. https://www.youtube.com/watch?v=9FdHq3WfJgs https://www.youtube.com/wat

• KirillPanov 5y ago
  Holy poop that video is hilarious. And great. Summary to convince you the link is clickworthy: Basically death certificates are the "identity system" version of free(). They're how identities (which are valuable) become no longer valid. He shows how to hack this, which is much easier than the malloc() side since adult death certificates are valid immediately whereas adult birth certificates need to be aged (at least) 18 years. It is stupidly easy to get certified as one of the roles (coroner, funeral director, etc) that are allowed to file death reports, which nowadays are just text boxes and clicking on a webpage. This results in a death certificate listing whatever the attacker desires. In particular, they get to declare the next of kin. These declarations fail to be validated shockingly often. End results are (a) life insurance fraud (b) probate fraud and (c) pretty vicious revenge served cold, since getting declared dead causes a ton of huge problems for the target but not for a while (e.g. when passports come up for renewal). His delivery is also awesome, a bunch of really funny deadpan jokes. Best quote: slide title "reasons for killing someone". Last bullet point "Kill your opposing lawyer, the judge, or IRS auditor to slow them down."