Slashdot Mirror
Hacker Shows How To Fabricate Death Records
wiredmikey writes: Hackers the Def Con gathering in Las Vegas on Friday got schooled in how to be online "killers." A rush to go digital with the process of registering deaths has made it simple for maliciously minded folks to have someone who is alive declared dead by the authorities. The process of having someone officially stamped dead by getting a death certificate issued typically involves a doctor filling out one form and a funeral home filling out another, according to Rock's research. Once forms are submitted online, certificates declaring the listed person legally dead are generated. A fatal flaw in the system is that people can easily pose as real doctors and funeral directors.
First thing that comes to mind is indebted college kids using this.
Of course there's no point if you actually graduate since, well, you're dead, so you can't use your degree.
Better for dropouts to get a second chance.
He also showed how to create birth certificates.
There are a number of potential exploits here. One would be to create birth certificates for two fake children, get some credit cards, max them out buying the same stock (one shorting the stock, one long). Whichever makes money, you keep. The other one, you get a fake death certificate, then you don't have to pay.
Of course, all this is fraud, and you can be arrested for it if you get caught.
"First they came for the slanderers and i said nothing."
I dare someone to get all of the presidential candidates declared dead. I mean their souls are dead already so it'd only be fitting.
Find a cooperative public servant and have them declare someone dead.
It's a lot easier than you think it is.
Particularly if you find someone in the police or otherwise having access to police records, all you have to do is fabricate a missing persons report older than 2556 days (7 years), leave it open, and the High Court will issue a presumption of death hence authorising the issuance of a death certificate with no proof of death (ie a body) required.
(EW 2013 C. 13 Section 2)
Then you don't just fuck up their credit score, you wipe their entire digital fingerprint.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
While declaring presidential candidates dead would be fun to watch, declaring local and state candidates could be more disruptive. If a presidential
candidate died, it would be on the news all over. A candidate for alderman somewhere, not so much.
Extra virtual kids of course could appear as income tax deductions. You;d have to say they were home schooled...
I don't see a way to decently defend against this apart from having a much better way to authenticate someone's identity.
Who has to vouch for a birth though? Kid gets born in a bathroom somewhere (it does happen) and there is no physician
around. How does someone like that ever get a birth certificate? Time was relatives could vouch for someone (was common
in early 1900s). If all it takes is someone signing a piece of paper saying "this kid was born somewhere in the US on date
xx-xxx-xxxx, witness Sam nocturnal aviator" how do you know? My birth certificate has attestations but many if not all of
those folks are long dead and it's not as if there is any DNA in the paper to tie it to me.
The whole system seems to be built on sand. Maybe quicksand.
Of course, all this is fraud, and you can be arrested for it if you get caught.
You can get arrested for retweeting someone else's comment.
If you do something they don't like (such as mounting a pistol to a drone, or putting coins in someone else's parking meter), they will find a law that can be extended to cover it.
They can use illegal means to get evidence, then use parallel construction to build a legal case. You can get arrested for anything nowadays.
I wouldn't worry about actions - law in this country has become discretionary, frivolous, and inconsistent. It's not based on harm any more.
Worry instead about getting noticed - that seems to start the process.
Two docs by two different people to be dead. Seems simple enough by someone in the know. In terms of life, all I can think of is the scenes from The Shawshank Redemption. Randall Stevens was created through the mail, but one needs a birth cert, a social security number, a bank account, a driver's license. As far as I can tell, that's the minimum to live a real life here in the US. How can one hack all of the above today? A DL in NJ required "six points of ID" presented in person. So... How can one hack a new life after hacking the death of an old one?
So when the victims do not stay dead, does this make them legally zombies?
This is the problem facing people wanting to change their identity. It is why identity theft is the preferred answer. It's easier if the victim doesn't have a driver's license or password. It's all the easier in some countries where public information is used to secure online records. As a bonus, when the police come looking, their own records will lead them astray.
For a brief time some online criminals were selling high-quality fake driver's licenses. If one looks long enough, one can find online criminals selling stolen-identity passports in other countries.
To answer your question: The starting point, a birth certificate is sort of easy, since so many are issued. The difficult part is evidence of existence, that one is a past and continuing consumer. A large part of this comes from one's parents: Education records and child vaccination records and possibly a bank account. This usually allows one to get a SSN. Then a legal identity is needed: Utility and municipal services in the desired name, which can usually be bought with minimal evidence of identity. This leads to a driver's license and a passport.
So building a historical fake identity takes time. There's a criminal opportunity: Creating fake children and selling them once they're old enough. Or if one is suitably paranoid, do it for one's own children.
Making fake identities for long enough would be a way to hack an election
people are very well documented in Europe at both national and local level.
I suspect there are loopholes. For instance if you loose your ID card, you are asked a birth certificate to establish a new one. Obtaining the birth certificate of someone else is not difficult, and it does not have a picture on it (even if there was one, it would a be a toddler). Therefore I do not see what prevent someone from obtaining an ID card with someone else's identity.
Security ALWAYS takes a backseat to immediate gratification. And there are few consequences for failure or incompetence. 60 minutes did an episode about living people declared dead and how it devastates them financially. You are deemed an identity thief. Your bank accounts are closed and new ones can't be opened. Good luck retaining employment.
Two docs by two different people to be dead. Seems simple enough by someone in the know. In terms of life, all I can think of is the scenes from The Shawshank Redemption. Randall Stevens was created through the mail, but one needs a birth cert, a social security number, a bank account, a driver's license. As far as I can tell, that's the minimum to live a real life here in the US. How can one hack all of the above today? A DL in NJ required "six points of ID" presented in person. So... How can one hack a new life after hacking the death of an old one?
A driver's license functions as legal photo ID in the US--the DMV will issue for people who can't drive for various reasons what's basically a non-driver's license, sometimes listed on the signs as such. It takes the same pieces of ID to obtain (the first) one, however, and the birth certificate and social security number in my experience are required (first time only)...and the Feds won't issue you a social security card without a valid photo ID. If you can get an official copy of your birth certificate without a valid photo ID may vary by state, but at least in the state I was born in...because my original one was lost, I had to go with the fiction that my mom (who, as my parent, is on the short list of people who they will give an official copy to) wanted it.
Oh, and yeah, a driver's license or non-driver's license is pretty much essential to getting any other form of what will count as valid photo ID once you're an adult. It might be possibly to parlay a minor's passport or the ilk into a (non-)driver's license, but I wouldn't want to have to test that.
As for the historical records--those don't always get looked at too closely. The bulk of mine from before I was around 16 got misplaced in what is politely described as a very inept paper-to-electronic records transfer effort by the country; of the ones that are known to have survived, it was because somebody else was maintaining them. This is apparently a common enough issue that nobody's batted an eye, since I've also done nothing that'd have my background investigated much.
If someone did this to you?
Obtaining the birth certificate of someone else is not difficult, and it does not have a picture on it (even if there was one, it would a be a toddler).
You were born as a toddler? :-)
Birth certificates used to have a footprint on them, but I haven't seen any recently that have that.
Death tax
The old rule used to be that there are so many people that die as children that you just go get a certificate of live birth for someone near your name. From there you get a SSN (one may have been issued, just get the card). Then you can get a photo ID or a license in most states. Then a passport...
I have not spent must time with that sort of person in a while so I do not know if they are still doing it. I may have had a license and been old enough to drink long before I was of legal age but that would have been a long long time ago, a lifetime away, if it, you know, happened.
"So long and thanks for all the fish."
You only need a birth certificate and some other form of ID to get a social security card and you can mail to get your birth certificate anywhere that I know of - contact the Office of Records (or some other ominous named office).
Requirements:
https://www.socialsecurity.gov...
My daughter's apartment was broken into and her ID was all stolen along with her birth certificate - the true copy and the only copy. It took a bit but we were able to replace it all. I seem to recall a path for those who do not have a photo ID as well. I think she had to go to the State, get an attested copy of some paper that indicated she needed her social security card, and was then able to submit that. Much of it was done with the assistance of a local attorney that my lawyer knew and hired for her. I can call her and ask if need be though it probably is not that important.
"So long and thanks for all the fish."
They don't ask you, they query the hospital or the municipal government office, where the master of the certificate is stored in some mouldy binder in the basement.
In my experience, they do ask you to get the document. But it does not make any difference, as if they fetch the document on their own, you can still give them someonelse's identity.