5 ms·

Experian Vulnerability Shows Any Report with just SSN, DOB, ADR

171 points by coloneltcb 4y ago

jeffbee 4y ago
H&R Block used to give you any of their clients' tax returns with SSN, last name, and ZIP Code. I think this form of authentication is extremely common. The big problem with asking for SSN+DOB or SSN+ZIP or even SSN+Name is these are highly correlated. SSNs are issued in order by date, in tranches given to each hospital, which gives you a fair chance of guessing a ZIP. Once you have a ZIP and a year you can also make informed guesses as to last name.
- bagels 4y ago
  There are, at this point, I would have to assume, databases with those in them available for purchase or download. No need to use statistics and guesses.
- water8 4y ago
  [dead]
- stonogo 4y ago
  That's how SSNs are distributed now. The majority of adults did not get them assigned at birth. Before the 80s, it was common not to get one at all until you started working. After the mid-80s a child needed one for their parents to claim them as a dependent, with the minimum age lowering until we reached today's situation.
  - kylehotchkiss 4y ago
    Up until 2011. The SSA adjusted the distribution technique then. https://www.ssa.gov/employer/randomization.html https://www.ssa.gov/employer/randomization.html
  - jeffbee 4y ago
    Even before assignment at birth, they were geographically allocated based on the applicant's address, which is even worse because that allows you to make accurate guesses about recent ZIP instead of ZIP at birth. These correlations were well-known even before 1987, when they switched to assignment at birth. https://pubmed.ncbi.nlm.nih.gov/6613981/ https://pubmed.ncbi.nlm.nih.gov/6613981/
    - stonogo 4y ago
      Your linked paper is about correlating year of birth to a social security number, which I would reckon is much easier than correlating to zip code, given that social security numbers both predate zip codes and were geographically assigned based on the US State in which the applicant lived when the number was requested. My own SSN was assigned to me at age ten when I lived fifteen hundred miles from the place of my birth, and I have moved a further thousand miles from there in the meantime; there's basically no way to predict my ZIP code from it. Anyway, according to that lookup table, I was born in 1927, a conclusion with which I strenuously disagree. Those methods may have been statistically useful in the year of publication but so many things have changed, and so many more people move between states than before the 80s, that I doubt its validity now. As a reference, the pandemic drastically slowed down American interstate household moves, but even so, 8% of the population moved states in 2020 -- including 18% of people between 20 and 29. (https://www.weforum.org/agenda/2021/12/american-relocation-home-covid19/ https://www.weforum.org/agenda/2021/12/american-relocation-h...) In short, I think it may have been more feasible in the past to draw these correlations, and now it's less feasible. On the other hand, massive data leaks are de rigueur, so it's probably just easier to buy databases from criminals on the internet.
      - deleted 4y ago
        [deleted]
lol768 4y ago
Am I reading correctly that Krebs gave the vendor three full days (of which at least three are not working days), over the Christmas holiday to patch this before disclosure on Mastodon? I can understand (but not necessarily agree) with arguments for full disclosure when the consumer has a choice to avoid using the vendor .. but, in this case?
- lapcat 4y ago
  No, what Krebs said was "So it's Dec. 27, and I still haven't heard anything from Experian." In other words, they haven't even responded to his report.
- 0ct4via 4y ago
  Given the gravity of the issue and the supposed standing of the vendor, 3 days should be plenty time to at least respond -- working days or not. Additionally, Krebs has stated that Experian has yet another glaring security issue. He's not saying exactly how to do it, or dropping POC in the post. Given the size and importance of Experian, there's nothing wrong with pointing out this issue, especially when after 4 days they can't even acknowledge an issue this serious. Krebs stating a vulnerability exists, is more responsible than not disclosing it -- given their importance, and history of security screw-ups, the people have a right to know.
  - jameshart 4y ago
    But it’s not three arbitrary days, is it? It’s December 24th, 25th and 26th, none of which are working days in the US, and which encompass one of the biggest global holidays of the year.
    - eli 4y ago
      Surely they should be staffed to mount at least a minimal response to security incidents even over holidays? A malicious actor wouldn’t wait until business hours.
      - 4y ago
jrib 4y ago
"ADR" == "address" in this context > All you needed was the person's name, address, SSN and DOB.
mindslight 4y ago
[flagged]
mauvehaus 4y ago
So, what I'm reading is I can get my credit report for free without having to figure out which sites are legit and which are phishing sites?
- maxbond 4y ago
  The legit site is https://www.annualcreditreport.com/index.action https://www.annualcreditreport.com/index.action You can check me on this here https://consumer.ftc.gov/articles/free-credit-reports https://consumer.ftc.gov/articles/free-credit-reports
ralph84 4y ago
Krebs on his credit report: > Glad I checked, too, because the info in there is so completely wrong I don't even know where to start. So a guy who holds himself out as a security expert hasn't even been monitoring his own credit report. I guess the Ubiquiti incident already made clear this guy is a charlatan.
- recursive 4y ago
  This is just Experian's credit report. Everyone knows you can't trust them. Only a first-party credit report should be accepted when the stakes are high.
japanman425 4y ago
So what?
kmoser 4y ago
The mechanics are no different from giving your info to a potential landlord for them to do a security check. So in that respect, the system is working exactly as intended. The difference is, this allows somebody to do a non-consensual credit check on you. Not to mention the whole other raft of problems brought on by the credit reporting industry.
indymike 4y ago
This is the problem with companies that want to hoard "high value" data as a business model: they become the juiciest targets. When the inevitable happens, they play too big, too essential to fail.
treis 4y ago
This info plus $20 will get you an Experian report all the time. It's their business model.
throw23948672 4y ago
Yea, I can finally get my credit report!
jiveturkey 4y ago
I’m not seeing whether this bypasses a freeze or not. Anyone have more details? I find it very odd that he would leave that important piece of information out.
_8j50 4y ago
> All you needed was the person's name, address, SSN and DOB. This info has been exposed on pretty much most Americans for many years now. Yes, but you can change your SSN anytime, it is still considered confidential info and the US has no easily changeable national ID system. Most banks let you take over an account with just SSN and knowledge of debitcard number (without cvv code) and sometimes dob. If you think your ssn is exposed don't count on companies and government bureaus not relying on it. Change it.
- dustyharddrive 4y ago
  SSA doesn’t say you can proactively change it: https://faq.ssa.gov/en-us/Topic/article/KA-02220 https://faq.ssa.gov/en-us/Topic/article/KA-02220
  - _8j50 4y ago
    If your ssn is compromised, lost or damaged you can change it up to 3 times
alexhackney 4y ago
IDK why this surprises anyone. I applied to expand my HELOC last month with my credit union. TransUnion sold my info to every mortgage company out there and I guarantee you I got 100+ calls and text messages from companies I've never heard of asking me to apply with them. They just sell any and all of our data over and over again. Can't opt out and can't stop it. 100s of calls to my cell phone.
flandish 4y ago
Funny. Tried logging in last night. Pw was forgotten. Tried forgot pw link.. put in email. No acct with that mail. Odd. Tried signing up… “email already in use..” …umm.

171 points by coloneltcb 4y ago

H&R Block used to give you any of their clients' tax returns with SSN, last name, and ZIP Code. I think this form of authentication is extremely common. The big problem with asking for SSN+DOB or SSN+ZIP or even SSN+Name is these are highly correlated. SSNs are issued in order by date, in tranches given to each hospital, which gives you a fair chance of guessing a ZIP. Once you have a ZIP and a year you can also make informed guesses as to last name.

bagels 4y ago
There are, at this point, I would have to assume, databases with those in them available for purchase or download. No need to use statistics and guesses.
water8 4y ago
[dead]
stonogo 4y ago
That's how SSNs are distributed now. The majority of adults did not get them assigned at birth. Before the 80s, it was common not to get one at all until you started working. After the mid-80s a child needed one for their parents to claim them as a dependent, with the minimum age lowering until we reached today's situation.
- kylehotchkiss 4y ago
  Up until 2011. The SSA adjusted the distribution technique then. https://www.ssa.gov/employer/randomization.html https://www.ssa.gov/employer/randomization.html
- jeffbee 4y ago
  Even before assignment at birth, they were geographically allocated based on the applicant's address, which is even worse because that allows you to make accurate guesses about recent ZIP instead of ZIP at birth. These correlations were well-known even before 1987, when they switched to assignment at birth. https://pubmed.ncbi.nlm.nih.gov/6613981/ https://pubmed.ncbi.nlm.nih.gov/6613981/
  - stonogo 4y ago
    Your linked paper is about correlating year of birth to a social security number, which I would reckon is much easier than correlating to zip code, given that social security numbers both predate zip codes and were geographically assigned based on the US State in which the applicant lived when the number was requested. My own SSN was assigned to me at age ten when I lived fifteen hundred miles from the place of my birth, and I have moved a further thousand miles from there in the meantime; there's basically no way to predict my ZIP code from it. Anyway, according to that lookup table, I was born in 1927, a conclusion with which I strenuously disagree. Those methods may have been statistically useful in the year of publication but so many things have changed, and so many more people move between states than before the 80s, that I doubt its validity now. As a reference, the pandemic drastically slowed down American interstate household moves, but even so, 8% of the population moved states in 2020 -- including 18% of people between 20 and 29. (https://www.weforum.org/agenda/2021/12/american-relocation-home-covid19/ https://www.weforum.org/agenda/2021/12/american-relocation-h...) In short, I think it may have been more feasible in the past to draw these correlations, and now it's less feasible. On the other hand, massive data leaks are de rigueur, so it's probably just easier to buy databases from criminals on the internet.
    - deleted 4y ago
      [deleted]

lol768 4y ago

Am I reading correctly that Krebs gave the vendor three full days (of which at least three are not working days), over the Christmas holiday to patch this before disclosure on Mastodon? I can understand (but not necessarily agree) with arguments for full disclosure when the consumer has a choice to avoid using the vendor .. but, in this case?

lapcat 4y ago
No, what Krebs said was "So it's Dec. 27, and I still haven't heard anything from Experian." In other words, they haven't even responded to his report.
0ct4via 4y ago
Given the gravity of the issue and the supposed standing of the vendor, 3 days should be plenty time to at least respond -- working days or not. Additionally, Krebs has stated that Experian has yet another glaring security issue. He's not saying exactly how to do it, or dropping POC in the post. Given the size and importance of Experian, there's nothing wrong with pointing out this issue, especially when after 4 days they can't even acknowledge an issue this serious. Krebs stating a vulnerability exists, is more responsible than not disclosing it -- given their importance, and history of security screw-ups, the people have a right to know.
- jameshart 4y ago
  But it’s not three arbitrary days, is it? It’s December 24th, 25th and 26th, none of which are working days in the US, and which encompass one of the biggest global holidays of the year.
  - eli 4y ago
    Surely they should be staffed to mount at least a minimal response to security incidents even over holidays? A malicious actor wouldn’t wait until business hours.
    - 4y ago

jrib 4y ago

"ADR" == "address" in this context > All you needed was the person's name, address, SSN and DOB.

mindslight 4y ago

[flagged]

mauvehaus 4y ago

So, what I'm reading is I can get my credit report for free without having to figure out which sites are legit and which are phishing sites?

maxbond 4y ago
The legit site is https://www.annualcreditreport.com/index.action https://www.annualcreditreport.com/index.action You can check me on this here https://consumer.ftc.gov/articles/free-credit-reports https://consumer.ftc.gov/articles/free-credit-reports

ralph84 4y ago

Krebs on his credit report: > Glad I checked, too, because the info in there is so completely wrong I don't even know where to start. So a guy who holds himself out as a security expert hasn't even been monitoring his own credit report. I guess the Ubiquiti incident already made clear this guy is a charlatan.

recursive 4y ago
This is just Experian's credit report. Everyone knows you can't trust them. Only a first-party credit report should be accepted when the stakes are high.

japanman425 4y ago

So what?

kmoser 4y ago

The mechanics are no different from giving your info to a potential landlord for them to do a security check. So in that respect, the system is working exactly as intended. The difference is, this allows somebody to do a non-consensual credit check on you. Not to mention the whole other raft of problems brought on by the credit reporting industry.

indymike 4y ago

This is the problem with companies that want to hoard "high value" data as a business model: they become the juiciest targets. When the inevitable happens, they play too big, too essential to fail.

treis 4y ago

This info plus $20 will get you an Experian report all the time. It's their business model.

throw23948672 4y ago

Yea, I can finally get my credit report!

jiveturkey 4y ago

I’m not seeing whether this bypasses a freeze or not. Anyone have more details? I find it very odd that he would leave that important piece of information out.

_8j50 4y ago

> All you needed was the person's name, address, SSN and DOB. This info has been exposed on pretty much most Americans for many years now. Yes, but you can change your SSN anytime, it is still considered confidential info and the US has no easily changeable national ID system. Most banks let you take over an account with just SSN and knowledge of debitcard number (without cvv code) and sometimes dob. If you think your ssn is exposed don't count on companies and government bureaus not relying on it. Change it.

dustyharddrive 4y ago
SSA doesn’t say you can proactively change it: https://faq.ssa.gov/en-us/Topic/article/KA-02220 https://faq.ssa.gov/en-us/Topic/article/KA-02220
- _8j50 4y ago
  If your ssn is compromised, lost or damaged you can change it up to 3 times

alexhackney 4y ago

IDK why this surprises anyone. I applied to expand my HELOC last month with my credit union. TransUnion sold my info to every mortgage company out there and I guarantee you I got 100+ calls and text messages from companies I've never heard of asking me to apply with them. They just sell any and all of our data over and over again. Can't opt out and can't stop it. 100s of calls to my cell phone.

flandish 4y ago

Funny. Tried logging in last night. Pw was forgotten. Tried forgot pw link.. put in email. No acct with that mail. Odd. Tried signing up… “email already in use..” …umm.