9 ms·

FBI seizes notorious marketplace for selling millions of stolen SSNs

91 points by ddtaylor 4y ago

mlindner 4y ago
If it was already notorious... what took them this long?
SoftTalker 4y ago
> SSNDOB listed the personal information for approximately 24 million individuals in the United States, including names, dates of birth, SSNs, and credit card numbers Great, good to shut it down, but how long until its replacement springs up? It probably already has. Instead of going through all this effort and expense to track the sellers of this information, it would be better to make "names, dates of birth, SSNs, and credit card numbers" valueless on their own. I'm not sure what the alternative looks like, but posession of this kind of personal information about someone should not be useful or valuable.
- rightbyte 4y ago
  Put it in a public phone directory and maybe SSN will finally not be used as some layer of security. Credit card numbers likewise.
  - dqv 4y ago
    It would certainly be a darkgrayhat move to do such a thing. It would be effective at deprecating SSNs as identifiers but would cause a lot of pain and suffering for a lot of people in the interim.
    - sokoloff 4y ago
      I don’t have much worry about the use of SSNs as an identifier; it’s the fact of knowing them being used as an authentication mechanism which continues to puzzle me.
      - dqv 4y ago
        Sorry, I misspoke, but yes deprecating them for authentication would be the goal.
  - grishka 4y ago
    Credit card numbers aren't supposed to be private, are they? We use them all the time to send money. It's the expiry date and the CVC that should be kept secret, but even then 3dsecure is a thing.
    - rightbyte 4y ago
      We give the cards to strangers in restaurants etc. The CVC or date should not be on the card really if it is some sort of safe guard. The whole credit card setup is quite insane when you think about it.
      - duskwuff 4y ago
        The checking system is so much worse. The only parameters needed to make an ACH payment are a name, a routing number, and the account number -- all of which are printed on every check. There is very little fraud protection, and it is difficult for an account holder to dispute an incorrect or fraudulent transfer.
        tremon 4y ago
        There is very little fraud protection, and it is difficult for an account holder to dispute an incorrect or fraudulent transfer. I see a cause and effect here. Make it easier (by law) for the account holder to dispute a transfer, and I'm sure the banks will suddenly spend more effort on fraud prevention.
    - Tagbert 4y ago
      There is a whole layer of security and compliance around the handling of credit card numbers that anyone who processes them has to go through. They are not considered publish information.
  - bombcar 4y ago
    SSNs are coincidentally almost the same number of digits as US phone numbers, so just make it so you can register your SSN as an alternate phone number for your cell phone. You'd probably need a separate country code for it ...
  - deleted 4y ago
    [deleted]
- svachalek 4y ago
  Yup. This stuff is all so deeply compromised at this point it's almost surprising you can still sell it. I guess fraud is still rare enough that companies would rather ask for SSN and say "hey we tried" than actually bother to look deeper.
  - yieldcrv 4y ago
    FULLZ (a text file containing this information) sell for about $.99 per file/person on darknet markets, mostly to build up the seller's reputation. There are 20,000,000 from just this one source and sellers seemingly randomly chose them. Thats just a lot of people. The buyer can use the same social security number for a different purpose than the last buyer. Like, maybe the prior buyer wanted to try something easy like opening a credit card. The compromised person has a low but improving chance of noticing and locking their credit report, making their social security number useless(-ish) for credit card applications. The next buyer though may have never considered that and might just open a bank account with an online bank. You wouldn't know if a bank account has been opened in your name. And the account itself doesn't have to be used for anything flag worthy or that could frame you (I wanted to say "anything criminal" but obviously some laws are being violated even if the funds are clean). On darknet markets, many people chose to skip laundering money, and just open bank and brokerage accounts in any developed nation under anyone's name. They just trade stocks and accumulate dollars. Eventually, whenever they want, they will laundering to cash out completely. But people can fly under the radar for a very long time, staying liquid, and not really doing any kind of consumptive spending from those accounts. So the same social security numbers can be used many times, and there are also too many social security numbers for the level of interest in this, for now.
  - kube-system 4y ago
    Places that ask for your SSN are usually not doing so for auth, it's mostly as a taxpayer ID, or a unique identifier because names aren't unique. (banks, employers, etc) For fraud prevention they typically do behavior analysis or use a composite of personal data. SSN + DOB + Name + last address you lived at + etc.
- 2OEH8eoCRo0 4y ago
  "Don't hold criminals accountable because there will always be more criminals"
  - haswell 4y ago
    This is an unnecessarily reductionist interpretation. “Don’t clean and bandage the gaping wound because it’ll just keep bleeding” The point isn’t to stop going after criminals, the point is that just going after criminals is as pointless in the long run as just dressing a wound that actually requires a different solution - stitches. Given limited resources, addressing the root of the problem would be more valuable than continuing to go after the symptoms. Since I doubt the same agency would be part of a real solution, it probably becomes a conversation about where funding is directed.
    - 2OEH8eoCRo0 4y ago
      I agree with the core of your argument but I think it's more complicated. If SS weren't important criminals would move onto something else. If you stop going after criminals would there be more or less SS theft? If the solution is to phase out whatever criminals are using against people then you'll just be on a different path that never ends.
      - haswell 4y ago
        I think this is fair. The ideal path is probably not just one or the other, but a combination of both.
      - everforward 4y ago
        The problem is that a SSN was designed to be secret, and then everyone decided to use them as a UUID for people, which are generally not secret. The solution is to split them. Give everyone some kind of citizen ID number that isn't private, but is unique. Then give everyone some kind of auth mechanism that identifies a person when combined with their ID number. What we currently do is using SSN as the identifier, with DOB as the auth mechanism. That's terrible because the SSN is supposed to be secret, and DOB is basically public knowledge at this point. They also can't be easily re-issued, which is it's own problem. There are obvious and substantial differences between SSN and some of the newer cryptography-based ID cards other countries are using.
- kube-system 4y ago
  Whatever tokens you use to identify someone will be a target for identity theft. You can make the tokens harder to guess or harder to replicate, but with an associated decreased accessibility. The convenient thing about names and DOBs is that most people have them, and most people remember them. The issue with most surrogate tokens is that a remediation process is necessary for when people lose or forget them, and those processes fall back on, you guessed it, name/DOB, etc. Fraud is just a very difficult problem to solve.
  - f38zf5vdt 4y ago
    No, it's not. Estonia solved it by issuing ID cards with a private key that signs for a public key identifier. [1] Then proving your identity requires the presence of the physical token rather than just the identifier. Unfortunately most Western nations are so embroiled in bureaucracy that this obvious solution will not be available for a long time. [1] https://en.wikipedia.org/wiki/Estonian_identity_card https://en.wikipedia.org/wiki/Estonian_identity_card
    - 8note 4y ago
      What do you do when you lose it though? Or it burns in a fire? A surrogate token still needs a replacement mechanism
      - bombcar 4y ago
        It's pretty easy to implement that if you have a central authority to manage the public keys, which a government can do. A bigger issue is how to handle it being stolen (if the "card" also needs something like a passphrase it can reduce this risk, but it's probably better to make it relatively easy to "cancel" if you lose yours, and then you have to head to the DMV or whatever to procure a replacement). Certainly better than knowing 10 digits and where you were born and to whom.
        kube-system 4y ago
        "Better" depends on which specific problem that someone is experiencing. If your problem is that someone stole the token, then you're better off with a PKI token. If your problem is that you have lost your token, then you're better off with a non-PKI memorable token.
- hakfoo 4y ago
  Identity theft can be solved by going more hands-on. Make KYC really mean KYC. If you couldn't get a line of credit without an in-person appearance and fingerprint, that form of identity theft becomes unviable. You have detailed info as to who tried to commit fraud, that can immediately be used for prosecution or tracking repeat offenders.
skeletal88 4y ago
Just stop using a number as something to autehticate people with, it is just stupid.
- nojito 4y ago
  The issue isn’t just ssns. The issue is that they made the whole package available. Ssn, dob, etc.
  - grishka 4y ago
    Just stop using semi-public information that anyone curious enough can piece together as something to authenticate people with, it is just stupid.
    - throwaway92394 4y ago
      You run into the same issue you do with 2FA - I cannot remember my own SSN. What happens if I lose my license, SSN, and master password manager password in a fire? What happens if someone has a stroke and forgets a recent pin code, etc. Do I go to my state and request new IDs? How do they authenticate me?
      - hyperman1 4y ago
        This has been solved by just about any other western country, and probably a lot of other countries. E.g. I have an eID card. The gov can reset the pin. There are procedures to request a new one. Therecare revocation lists. Fake eIDs are rare. Its not perfect, but it works great compared to the USA. The real problem is a semi religious fear of the US governement having working ID systems. So there are all kinds of half baked substitutes in use, that barely work and push the trouble on the end user. ID theft is a solved problem just about anywhere, if the US wants it, it can solve it too.
- jandrese 4y ago
  Tell the credit rating agencies that.
smiddereens 4y ago
Terry_Roll 4y ago
The state cant even keep its own house in order, why do people continue to trust them to act in the public's best interest? They are abusing their authority to cover up their mistakes! Lets face it, if arguably the most important job in the country needs zero qualifications, what hope does that country have?
- Terry_Roll 4y ago
deweller 4y ago
> ...to seize four domains hosting the SSNDOB marketplace... So they just got control of 4 domains pointing to the site, put up a takedown page and then issued a press release? Did they actually do anything to stop the owners of the site from pointing another domain to the marketplace?
- str3wer 4y ago
  it's not the first time they just put a random seized photo on a domain then do a press release. take for example joker stash, after seizing one of their proxies they made a press release saying that after years of hard work they took it down. after two hours it came back online on the same domain.
diego_sandoval 4y ago
It doesn't sit well with me that law enforcement can just seize domains like that. In situations like these, is there anything you can do to reduce risk of your domain name being seized? Does it help to register them on ccTLDs of countries that won't care? like .ru? How have The Pirate Bay clones managed to be so resilient?
- oh_sigh 4y ago
  They can't just seize domains like that - it was done in conjunction with the courts.
- bombcar 4y ago
  If you are physically in the US and your domain is seized, it's the least of your worries, because you almost certainly have been seized yourself.
throw0101a 4y ago
SSNs really should be treated as (at most) usernames and not passwords.
- kube-system 4y ago
  They mostly are. If they are used in the process of authenticating it is almost always in composite with other data.
  - tremon 4y ago
    Like a DOB?
jylam 4y ago
As a European/French, why is the SSN so important to Americans ? I mean my SSN in France was automatically generated at my birth (basically from my birth gender, date, location, and the Nth baby I was this year in this location). I could generate the correct SSN of most my close friends from my head to maybe 3 digits on the first try if I had to. They took a bit more than that ok (credit card numbers, but you can't do much with this without the CVV and the expiration date anyway, and you'll need to send a confirmation to your bank anyway). So why is that such a big deal ?
- Invictus0 4y ago
  American infrastructure uses SSNs as a form of authentication for sensitive things like bank accounts, medical records, loan applications, housing applications, etc. With a SSN, it is much easier to steal someone's identity.
- gregschlom 4y ago
  Because SSN are the main way that banks and credit agencies use to identify people (which is not at all what they were intended for originally). If you know somebody else's SSN plus a couple of semi public details (name, date of birth, address), you can go to a bank and borrow money under their name.
- medo-bear 4y ago
  in croatia there is a personal identification number as well as the unique birth number of citizen (my transaltion). the latter is what you describe and the former i think is similar to the us ssn. the former should only be known to you. you use it, for example, when you sell your property or apply for credit. i think it is a huge fraud risk, especially in times of airbnb, because at least in croatia this is written on your id and passport and the national health card
- throwaway92394 4y ago
  So in the US you can do "credit freezes" which prevent people from taking out new loans/new cards in your name. HOWEVER - you can't do anything about the fact they can call up your bank, say "I forgot my password" and then give them your SSN. Your bank will happily reset the password for them. If someone has your SSN they essentially have everything they need to get access to any of your financial, medical, or utility accounts, and can also use it for KYC/AML to open say a crypto account in your name. You cannot do anything to prevent this option.
jwilk 4y ago
Archived copy without GDPR nag screen: https://web.archive.org/web/20220608152051/https://techcrunch.com/2022/06/08/fbi-ssndob-millions-social-security-marketplace/ https://web.archive.org/web/20220608152051/https://techcrunc...
syngrog66 4y ago
once that data is out in the wild it lives forever. better to assume a kind of "no critical PII is actually secret anymore" and work to upgrade our systems to no longer be so naive

91 points by ddtaylor 4y ago

If it was already notorious... what took them this long?

> SSNDOB listed the personal information for approximately 24 million individuals in the United States, including names, dates of birth, SSNs, and credit card numbers Great, good to shut it down, but how long until its replacement springs up? It probably already has. Instead of going through all this effort and expense to track the sellers of this information, it would be better to make "names, dates of birth, SSNs, and credit card numbers" valueless on their own. I'm not sure what the alternative looks like, but posession of this kind of personal information about someone should not be useful or valuable.

rightbyte 4y ago
Put it in a public phone directory and maybe SSN will finally not be used as some layer of security. Credit card numbers likewise.
- dqv 4y ago
  It would certainly be a darkgrayhat move to do such a thing. It would be effective at deprecating SSNs as identifiers but would cause a lot of pain and suffering for a lot of people in the interim.
  - sokoloff 4y ago
    I don’t have much worry about the use of SSNs as an identifier; it’s the fact of knowing them being used as an authentication mechanism which continues to puzzle me.
    - dqv 4y ago
      Sorry, I misspoke, but yes deprecating them for authentication would be the goal.
- grishka 4y ago
  Credit card numbers aren't supposed to be private, are they? We use them all the time to send money. It's the expiry date and the CVC that should be kept secret, but even then 3dsecure is a thing.
  - rightbyte 4y ago
    We give the cards to strangers in restaurants etc. The CVC or date should not be on the card really if it is some sort of safe guard. The whole credit card setup is quite insane when you think about it.
    - duskwuff 4y ago
      The checking system is so much worse. The only parameters needed to make an ACH payment are a name, a routing number, and the account number -- all of which are printed on every check. There is very little fraud protection, and it is difficult for an account holder to dispute an incorrect or fraudulent transfer.
      - tremon 4y ago
        There is very little fraud protection, and it is difficult for an account holder to dispute an incorrect or fraudulent transfer. I see a cause and effect here. Make it easier (by law) for the account holder to dispute a transfer, and I'm sure the banks will suddenly spend more effort on fraud prevention.
  - Tagbert 4y ago
    There is a whole layer of security and compliance around the handling of credit card numbers that anyone who processes them has to go through. They are not considered publish information.
- bombcar 4y ago
  SSNs are coincidentally almost the same number of digits as US phone numbers, so just make it so you can register your SSN as an alternate phone number for your cell phone. You'd probably need a separate country code for it ...
- deleted 4y ago
  [deleted]
svachalek 4y ago
Yup. This stuff is all so deeply compromised at this point it's almost surprising you can still sell it. I guess fraud is still rare enough that companies would rather ask for SSN and say "hey we tried" than actually bother to look deeper.
- yieldcrv 4y ago
  FULLZ (a text file containing this information) sell for about $.99 per file/person on darknet markets, mostly to build up the seller's reputation. There are 20,000,000 from just this one source and sellers seemingly randomly chose them. Thats just a lot of people. The buyer can use the same social security number for a different purpose than the last buyer. Like, maybe the prior buyer wanted to try something easy like opening a credit card. The compromised person has a low but improving chance of noticing and locking their credit report, making their social security number useless(-ish) for credit card applications. The next buyer though may have never considered that and might just open a bank account with an online bank. You wouldn't know if a bank account has been opened in your name. And the account itself doesn't have to be used for anything flag worthy or that could frame you (I wanted to say "anything criminal" but obviously some laws are being violated even if the funds are clean). On darknet markets, many people chose to skip laundering money, and just open bank and brokerage accounts in any developed nation under anyone's name. They just trade stocks and accumulate dollars. Eventually, whenever they want, they will laundering to cash out completely. But people can fly under the radar for a very long time, staying liquid, and not really doing any kind of consumptive spending from those accounts. So the same social security numbers can be used many times, and there are also too many social security numbers for the level of interest in this, for now.
- kube-system 4y ago
  Places that ask for your SSN are usually not doing so for auth, it's mostly as a taxpayer ID, or a unique identifier because names aren't unique. (banks, employers, etc) For fraud prevention they typically do behavior analysis or use a composite of personal data. SSN + DOB + Name + last address you lived at + etc.
2OEH8eoCRo0 4y ago
"Don't hold criminals accountable because there will always be more criminals"
- haswell 4y ago
  This is an unnecessarily reductionist interpretation. “Don’t clean and bandage the gaping wound because it’ll just keep bleeding” The point isn’t to stop going after criminals, the point is that just going after criminals is as pointless in the long run as just dressing a wound that actually requires a different solution - stitches. Given limited resources, addressing the root of the problem would be more valuable than continuing to go after the symptoms. Since I doubt the same agency would be part of a real solution, it probably becomes a conversation about where funding is directed.
  - 2OEH8eoCRo0 4y ago
    I agree with the core of your argument but I think it's more complicated. If SS weren't important criminals would move onto something else. If you stop going after criminals would there be more or less SS theft? If the solution is to phase out whatever criminals are using against people then you'll just be on a different path that never ends.
    - haswell 4y ago
      I think this is fair. The ideal path is probably not just one or the other, but a combination of both.
    - everforward 4y ago
      The problem is that a SSN was designed to be secret, and then everyone decided to use them as a UUID for people, which are generally not secret. The solution is to split them. Give everyone some kind of citizen ID number that isn't private, but is unique. Then give everyone some kind of auth mechanism that identifies a person when combined with their ID number. What we currently do is using SSN as the identifier, with DOB as the auth mechanism. That's terrible because the SSN is supposed to be secret, and DOB is basically public knowledge at this point. They also can't be easily re-issued, which is it's own problem. There are obvious and substantial differences between SSN and some of the newer cryptography-based ID cards other countries are using.
kube-system 4y ago
Whatever tokens you use to identify someone will be a target for identity theft. You can make the tokens harder to guess or harder to replicate, but with an associated decreased accessibility. The convenient thing about names and DOBs is that most people have them, and most people remember them. The issue with most surrogate tokens is that a remediation process is necessary for when people lose or forget them, and those processes fall back on, you guessed it, name/DOB, etc. Fraud is just a very difficult problem to solve.
- f38zf5vdt 4y ago
  No, it's not. Estonia solved it by issuing ID cards with a private key that signs for a public key identifier. [1] Then proving your identity requires the presence of the physical token rather than just the identifier. Unfortunately most Western nations are so embroiled in bureaucracy that this obvious solution will not be available for a long time. [1] https://en.wikipedia.org/wiki/Estonian_identity_card https://en.wikipedia.org/wiki/Estonian_identity_card
  - 8note 4y ago
    What do you do when you lose it though? Or it burns in a fire? A surrogate token still needs a replacement mechanism
    - bombcar 4y ago
      It's pretty easy to implement that if you have a central authority to manage the public keys, which a government can do. A bigger issue is how to handle it being stolen (if the "card" also needs something like a passphrase it can reduce this risk, but it's probably better to make it relatively easy to "cancel" if you lose yours, and then you have to head to the DMV or whatever to procure a replacement). Certainly better than knowing 10 digits and where you were born and to whom.
      - kube-system 4y ago
        "Better" depends on which specific problem that someone is experiencing. If your problem is that someone stole the token, then you're better off with a PKI token. If your problem is that you have lost your token, then you're better off with a non-PKI memorable token.
hakfoo 4y ago
Identity theft can be solved by going more hands-on. Make KYC really mean KYC. If you couldn't get a line of credit without an in-person appearance and fingerprint, that form of identity theft becomes unviable. You have detailed info as to who tried to commit fraud, that can immediately be used for prosecution or tracking repeat offenders.

skeletal88 4y ago

Just stop using a number as something to autehticate people with, it is just stupid.

nojito 4y ago
The issue isn’t just ssns. The issue is that they made the whole package available. Ssn, dob, etc.
- grishka 4y ago
  Just stop using semi-public information that anyone curious enough can piece together as something to authenticate people with, it is just stupid.
  - throwaway92394 4y ago
    You run into the same issue you do with 2FA - I cannot remember my own SSN. What happens if I lose my license, SSN, and master password manager password in a fire? What happens if someone has a stroke and forgets a recent pin code, etc. Do I go to my state and request new IDs? How do they authenticate me?
    - hyperman1 4y ago
      This has been solved by just about any other western country, and probably a lot of other countries. E.g. I have an eID card. The gov can reset the pin. There are procedures to request a new one. Therecare revocation lists. Fake eIDs are rare. Its not perfect, but it works great compared to the USA. The real problem is a semi religious fear of the US governement having working ID systems. So there are all kinds of half baked substitutes in use, that barely work and push the trouble on the end user. ID theft is a solved problem just about anywhere, if the US wants it, it can solve it too.
jandrese 4y ago
Tell the credit rating agencies that.

smiddereens 4y ago

Terry_Roll 4y ago

The state cant even keep its own house in order, why do people continue to trust them to act in the public's best interest? They are abusing their authority to cover up their mistakes! Lets face it, if arguably the most important job in the country needs zero qualifications, what hope does that country have?

Terry_Roll 4y ago

deweller 4y ago

> ...to seize four domains hosting the SSNDOB marketplace... So they just got control of 4 domains pointing to the site, put up a takedown page and then issued a press release? Did they actually do anything to stop the owners of the site from pointing another domain to the marketplace?

str3wer 4y ago
it's not the first time they just put a random seized photo on a domain then do a press release. take for example joker stash, after seizing one of their proxies they made a press release saying that after years of hard work they took it down. after two hours it came back online on the same domain.

diego_sandoval 4y ago

It doesn't sit well with me that law enforcement can just seize domains like that. In situations like these, is there anything you can do to reduce risk of your domain name being seized? Does it help to register them on ccTLDs of countries that won't care? like .ru? How have The Pirate Bay clones managed to be so resilient?

oh_sigh 4y ago
They can't just seize domains like that - it was done in conjunction with the courts.
bombcar 4y ago
If you are physically in the US and your domain is seized, it's the least of your worries, because you almost certainly have been seized yourself.

throw0101a 4y ago

SSNs really should be treated as (at most) usernames and not passwords.

kube-system 4y ago
They mostly are. If they are used in the process of authenticating it is almost always in composite with other data.
- tremon 4y ago
  Like a DOB?

jylam 4y ago

As a European/French, why is the SSN so important to Americans ? I mean my SSN in France was automatically generated at my birth (basically from my birth gender, date, location, and the Nth baby I was this year in this location). I could generate the correct SSN of most my close friends from my head to maybe 3 digits on the first try if I had to. They took a bit more than that ok (credit card numbers, but you can't do much with this without the CVV and the expiration date anyway, and you'll need to send a confirmation to your bank anyway). So why is that such a big deal ?

Invictus0 4y ago
American infrastructure uses SSNs as a form of authentication for sensitive things like bank accounts, medical records, loan applications, housing applications, etc. With a SSN, it is much easier to steal someone's identity.
gregschlom 4y ago
Because SSN are the main way that banks and credit agencies use to identify people (which is not at all what they were intended for originally). If you know somebody else's SSN plus a couple of semi public details (name, date of birth, address), you can go to a bank and borrow money under their name.
medo-bear 4y ago
in croatia there is a personal identification number as well as the unique birth number of citizen (my transaltion). the latter is what you describe and the former i think is similar to the us ssn. the former should only be known to you. you use it, for example, when you sell your property or apply for credit. i think it is a huge fraud risk, especially in times of airbnb, because at least in croatia this is written on your id and passport and the national health card
throwaway92394 4y ago
So in the US you can do "credit freezes" which prevent people from taking out new loans/new cards in your name. HOWEVER - you can't do anything about the fact they can call up your bank, say "I forgot my password" and then give them your SSN. Your bank will happily reset the password for them. If someone has your SSN they essentially have everything they need to get access to any of your financial, medical, or utility accounts, and can also use it for KYC/AML to open say a crypto account in your name. You cannot do anything to prevent this option.

jwilk 4y ago

Archived copy without GDPR nag screen: https://web.archive.org/web/20220608152051/https://techcrunch.com/2022/06/08/fbi-ssndob-millions-social-security-marketplace/ https://web.archive.org/web/20220608152051/https://techcrunc...

syngrog66 4y ago

once that data is out in the wild it lives forever. better to assume a kind of "no critical PII is actually secret anymore" and work to upgrade our systems to no longer be so naive