The OneMinute Geek: Identity Theft

The Problem:

Identity theft is so easy it’s becoming an entertaining pastime. People even compete to see how much personal information they can find on the Internet. If identity theft is so easy, what can you do to avoid being a victim?

The Solution:

First, it’s important to understand just how vulnerable we all are. The average person will be able to pull up personal information that could be used for identity theft after about an hour’s learning time with a book on Google hacking.

Fire up Google and start exploring for yourself.  I’m not referring to keyword searches.  I’m talking about harnessing Google’s true horsepower to dish up anything from the more than 8 billion pages of information on the Net.

Look for databases that should be protected by firewalls.  Start by typing in “filetype:xls” and Google will pull up tons of Microsoft Excel spreadsheets.  Include in your search keywords like “ssn”, which is commonly used to denote “Social Security Numbers.”

Many organizations use such spreadsheets to list personal data.  And many of those same organizations are seriously negligent with their network security, leaving themselves—and the people in their databases-- dangerously exposed.

Hackers have been leveraging search engines like Google and Yahoo for quite some time.  Also, anything that is connected to the web – and not properly secured - can be compromised.  This includes all kinds of devices, like webcams, printers and even the office copier.  Checkout, for example, http://johnny.ihackstuff.com/

Last month security experts in Seattle held a contest to demonstrate how effective Google is as a hacking tool.  In less than an hour, contestants were able to pillage names, dates of birth, Social Security numbers, and credit card numbers, all apparently left exposed by the U.S. Department of Justice.  Contestants were also able to uncover a variety of other information including the following.

• Database of convicts, complete with identifying information
• Database containing over 300 scanned passports.
• Web site listing the names, birth dates, Social Security numbers, race and religion of 602 helicopter pilots who died in Vietnam.
• Brazilian Web site that contained the names, credit card numbers, birth dates and home phone numbers of 388 Americans who appeared to have ordered pornographic movies online.
• Information about people on terrorist watch lists

The winning team produced a directory of social security numbers for over 70 million dead people—the only information sometimes needed to apply for a loan.

What can businesses and government agencies do to ensure they are not sharing proprietary information via the Web?

• Accept the fact that people WILL find you via the Net and that people ARE interested in what’s on your computer.
• Perform an extensive, professional audit of your network’s security.  
• Make sure search engine “spiders” do not have access to your intranet.
• Change the default configurations of your Internet-enabled devices such as. web cams.
• And if you’re an individual consumer?  How can you mitigate the risk of identity theft?
• Avoid sharing your Social Security number whenever possible.
• Subscribe to a service that monitors your credit report.
• Be sure your computer is properly “locked down” with a firewall, antivirus software, anti-spyware software and operating system updates.

For more info, go to:  http://www.consumer.gov/idtheft/

James Kerr is President/CEO of SuperGeeks, a Hawaii-based computer service and repair company (www.supergeeks.net). Please feel free to send your questions, comments and suggestions to Mr. Kerr. He can be reached at kerr@supergeeks.net and 942-0773.