Slashdot Mirror
Hacker Shows How To Fabricate Death Records
wiredmikey writes: Hackers the Def Con gathering in Las Vegas on Friday got schooled in how to be online "killers." A rush to go digital with the process of registering deaths has made it simple for maliciously minded folks to have someone who is alive declared dead by the authorities. The process of having someone officially stamped dead by getting a death certificate issued typically involves a doctor filling out one form and a funeral home filling out another, according to Rock's research. Once forms are submitted online, certificates declaring the listed person legally dead are generated. A fatal flaw in the system is that people can easily pose as real doctors and funeral directors.
First thing that comes to mind is indebted college kids using this.
Of course there's no point if you actually graduate since, well, you're dead, so you can't use your degree.
Better for dropouts to get a second chance.
He also showed how to create birth certificates.
There are a number of potential exploits here. One would be to create birth certificates for two fake children, get some credit cards, max them out buying the same stock (one shorting the stock, one long). Whichever makes money, you keep. The other one, you get a fake death certificate, then you don't have to pay.
Of course, all this is fraud, and you can be arrested for it if you get caught.
"First they came for the slanderers and i said nothing."
I dare someone to get all of the presidential candidates declared dead. I mean their souls are dead already so it'd only be fitting.
Find a cooperative public servant and have them declare someone dead.
It's a lot easier than you think it is.
Particularly if you find someone in the police or otherwise having access to police records, all you have to do is fabricate a missing persons report older than 2556 days (7 years), leave it open, and the High Court will issue a presumption of death hence authorising the issuance of a death certificate with no proof of death (ie a body) required.
(EW 2013 C. 13 Section 2)
Then you don't just fuck up their credit score, you wipe their entire digital fingerprint.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
While declaring presidential candidates dead would be fun to watch, declaring local and state candidates could be more disruptive. If a presidential
candidate died, it would be on the news all over. A candidate for alderman somewhere, not so much.
Extra virtual kids of course could appear as income tax deductions. You;d have to say they were home schooled...
I don't see a way to decently defend against this apart from having a much better way to authenticate someone's identity.
Who has to vouch for a birth though? Kid gets born in a bathroom somewhere (it does happen) and there is no physician
around. How does someone like that ever get a birth certificate? Time was relatives could vouch for someone (was common
in early 1900s). If all it takes is someone signing a piece of paper saying "this kid was born somewhere in the US on date
xx-xxx-xxxx, witness Sam nocturnal aviator" how do you know? My birth certificate has attestations but many if not all of
those folks are long dead and it's not as if there is any DNA in the paper to tie it to me.
The whole system seems to be built on sand. Maybe quicksand.
Of course, all this is fraud, and you can be arrested for it if you get caught.
You can get arrested for retweeting someone else's comment.
If you do something they don't like (such as mounting a pistol to a drone, or putting coins in someone else's parking meter), they will find a law that can be extended to cover it.
They can use illegal means to get evidence, then use parallel construction to build a legal case. You can get arrested for anything nowadays.
I wouldn't worry about actions - law in this country has become discretionary, frivolous, and inconsistent. It's not based on harm any more.
Worry instead about getting noticed - that seems to start the process.
Montrealers know what I mean, right?
Two docs by two different people to be dead. Seems simple enough by someone in the know. In terms of life, all I can think of is the scenes from The Shawshank Redemption. Randall Stevens was created through the mail, but one needs a birth cert, a social security number, a bank account, a driver's license. As far as I can tell, that's the minimum to live a real life here in the US. How can one hack all of the above today? A DL in NJ required "six points of ID" presented in person. So... How can one hack a new life after hacking the death of an old one?
So when the victims do not stay dead, does this make them legally zombies?
This is the problem facing people wanting to change their identity. It is why identity theft is the preferred answer. It's easier if the victim doesn't have a driver's license or password. It's all the easier in some countries where public information is used to secure online records. As a bonus, when the police come looking, their own records will lead them astray.
For a brief time some online criminals were selling high-quality fake driver's licenses. If one looks long enough, one can find online criminals selling stolen-identity passports in other countries.
To answer your question: The starting point, a birth certificate is sort of easy, since so many are issued. The difficult part is evidence of existence, that one is a past and continuing consumer. A large part of this comes from one's parents: Education records and child vaccination records and possibly a bank account. This usually allows one to get a SSN. Then a legal identity is needed: Utility and municipal services in the desired name, which can usually be bought with minimal evidence of identity. This leads to a driver's license and a passport.
So building a historical fake identity takes time. There's a criminal opportunity: Creating fake children and selling them once they're old enough. Or if one is suitably paranoid, do it for one's own children.
Making fake identities for long enough would be a way to hack an election
people are very well documented in Europe at both national and local level.
I suspect there are loopholes. For instance if you loose your ID card, you are asked a birth certificate to establish a new one. Obtaining the birth certificate of someone else is not difficult, and it does not have a picture on it (even if there was one, it would a be a toddler). Therefore I do not see what prevent someone from obtaining an ID card with someone else's identity.
Security ALWAYS takes a backseat to immediate gratification. And there are few consequences for failure or incompetence. 60 minutes did an episode about living people declared dead and how it devastates them financially. You are deemed an identity thief. Your bank accounts are closed and new ones can't be opened. Good luck retaining employment.
Two docs by two different people to be dead. Seems simple enough by someone in the know. In terms of life, all I can think of is the scenes from The Shawshank Redemption. Randall Stevens was created through the mail, but one needs a birth cert, a social security number, a bank account, a driver's license. As far as I can tell, that's the minimum to live a real life here in the US. How can one hack all of the above today? A DL in NJ required "six points of ID" presented in person. So... How can one hack a new life after hacking the death of an old one?
A driver's license functions as legal photo ID in the US--the DMV will issue for people who can't drive for various reasons what's basically a non-driver's license, sometimes listed on the signs as such. It takes the same pieces of ID to obtain (the first) one, however, and the birth certificate and social security number in my experience are required (first time only)...and the Feds won't issue you a social security card without a valid photo ID. If you can get an official copy of your birth certificate without a valid photo ID may vary by state, but at least in the state I was born in...because my original one was lost, I had to go with the fiction that my mom (who, as my parent, is on the short list of people who they will give an official copy to) wanted it.
Oh, and yeah, a driver's license or non-driver's license is pretty much essential to getting any other form of what will count as valid photo ID once you're an adult. It might be possibly to parlay a minor's passport or the ilk into a (non-)driver's license, but I wouldn't want to have to test that.
As for the historical records--those don't always get looked at too closely. The bulk of mine from before I was around 16 got misplaced in what is politely described as a very inept paper-to-electronic records transfer effort by the country; of the ones that are known to have survived, it was because somebody else was maintaining them. This is apparently a common enough issue that nobody's batted an eye, since I've also done nothing that'd have my background investigated much.
If someone did this to you?
Obtaining the birth certificate of someone else is not difficult, and it does not have a picture on it (even if there was one, it would a be a toddler).
You were born as a toddler? :-)
Birth certificates used to have a footprint on them, but I haven't seen any recently that have that.
When signing up for College at 16, in the main hall was all the high street banks, wanting you to join with them. 1 of them was offering 5quid to sign up with them (others were offering decent rates, plastic piggy banks, t-shirts, badges "Are YOU in control?"), but that one bank offering 5 quid, cash, there and then... And all you needed was your College sign up form, dutifully stamped by the College Admins. Who weren't checking any ID, just that you filled in what courses you wanted to take.
By 10am it was pandemonium, with a steady stream of students lining up to get their free fivers, a line long enough, with enough chaos it appears going on, that they weren't looking too closely to see how many times people had already signed up. At least for a bit. I'm not sure if it was the same people being recognised, or perhaps the silly names people were starting to use, or maybe they simply ran out of fivers for everyone, but they shut down pretty quick.
There were many a fake bank account setup that day, though I'd imagine that they'd want to check ID/proof of address a bit closely later when you went into the local branch, but a bit of time with some printouts, with the account already setup, you'd have been more than halfway.
Always loopholes, always "lets just get this done for now, we'll sort it later" ways for someone nefarious to get things done, it's all down to that first bit of 'legit' ID, from there, you stack everything else on top of it.
Death tax
The old rule used to be that there are so many people that die as children that you just go get a certificate of live birth for someone near your name. From there you get a SSN (one may have been issued, just get the card). Then you can get a photo ID or a license in most states. Then a passport...
I have not spent must time with that sort of person in a while so I do not know if they are still doing it. I may have had a license and been old enough to drink long before I was of legal age but that would have been a long long time ago, a lifetime away, if it, you know, happened.
"So long and thanks for all the fish."
You only need a birth certificate and some other form of ID to get a social security card and you can mail to get your birth certificate anywhere that I know of - contact the Office of Records (or some other ominous named office).
Requirements:
https://www.socialsecurity.gov...
My daughter's apartment was broken into and her ID was all stolen along with her birth certificate - the true copy and the only copy. It took a bit but we were able to replace it all. I seem to recall a path for those who do not have a photo ID as well. I think she had to go to the State, get an attested copy of some paper that indicated she needed her social security card, and was then able to submit that. Much of it was done with the assistance of a local attorney that my lawyer knew and hired for her. I can call her and ask if need be though it probably is not that important.
"So long and thanks for all the fish."
> you are asked a birth certificate to establish a new one.
They don't ask you, they query the hospital or the municipal government office, where the master of the certificate is stored in some mouldy binder in the basement. Furthermore, you probably have records kept by the military (armed conscript service or lack of fitness thereof for males and civil defense service for ladyfolk). Europe has been totally paranoid about personal identity since the beginning of WWI, so that noone can escape conscription for service of the motherland in some glorious frontal assault...
Example: once I had a problem stemming from my birth certificate, which contains both given names of my mother, of which the second has never been used in daily life, as her fist given name is extremely rare. Anyhow, some time somewhere a clerk left out her second given name when recording my application for driver's licence exam. This mismatch produced an alarm in the computerized background check when I applied my expiring passport's renewal and they wouldn't grant it until the matter is researched. Luckily I was able to call in my mother in person, with her birth national ID card and birth certificate in hand, to shortcut the issue the same day as I had time pressure for travel. BTW, I'm a white caucasian, not very athletic and look completely harmless, so they didn't have any particular suspicion of me being an accomplished tenorist or minaret singer, but "rules are rules" for bureaucrats...
The very idea of one being able to vote without documents is absurd in Europe. You have to have two docs minimum: personal photo ID card and the place of residence booklet or temporary out of residence affidavit (so parties cannot not try cheating narrowly contested locales by mass-migrating their members for the weekend). In some countries one even have to present a third ID (tax number card) because they may ban taxation delinquents from voting and running for office. No taxation without representation and no representation without taxation.
EU = EU + ROPE. Eu means good in greek and the rope is what they use to bind their people, so 450 million can fit in half as much area as CONUS without causing chaos and anarchy.
They don't ask you, they query the hospital or the municipal government office, where the master of the certificate is stored in some mouldy binder in the basement.
In my experience, they do ask you to get the document. But it does not make any difference, as if they fetch the document on their own, you can still give them someonelse's identity.