News for hackers. Stuff that matters.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by lifeisstillgood on Tuesday October 03, 2017 @08:41PM (#15397471)
Personal information is less valuable on the black market due to the difficulty in monetising and extracting the cash. If I have your bank account login details I can move cash out of your bank, but almost no hope of sending cash from a U.K. Domestic savings account to my friendly philapines bank over the web UI. That's why Nigerian Princes still send out emails - the find the one idiot willing to walk into his bank and move the 5million that just arrived in his account

Alternatively you need real criminal gangs - dozens of people willing to walk up and down a London street withdrawing 5k at a time from a 1000 Pre-prepared cards and put the money in their rucksacks. They don't come cheap. And its still cash and still in the U.K.

Get Amazon to send you two dozen laptops to the same address with two dozen cards. All as "gifts". Yeah right. Now you gotta sell them - fences run at 10% if you are lucky.

The lowest effort are simple impersonation for loans, but still you have to take the money and move it somewhere. Into cash? Into the phillipines? See above problems. Open a credit card account? How to intercept it and the PIN number sent by post?

All in all, it's actually pretty darn hard to take personal details and monetise at the "real money" level. These things stop being scalable. You could probably fund a student lifestyle off any combination of the above but millions - not really.

Cf interesting Microsoft paper on this a few years back

Re:Yahoo Triples Estimate of Breached Accounts to 3B by manigandham on Tuesday October 03, 2017 @09:50PM (#15397721)
I guess we have nothing to worry about with all these data breaches then, right? Might as well tell equifax that it’s no big deal too.

These criminals trade data because it makes them money, otherwise there wouldn’t be much of a makrket.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by _jal on Tuesday October 03, 2017 @10:59PM (#15397989)
You're correct, of course, but missing the implications raised by the parent poster, and they are important.

Sensitive personal data is necessary but not sufficient to rip someone off. And if you want to try to make a living ripping people off, there is even more business overhead, making the cost of sensitive personal data an even smaller portion of overall operational costs.

From the point of view of the thief, our personal data is a vital but cheap input into an operation that tends to have very high security costs, viciously expensive liquidity issues and terrible personnel problems, among other more quotidian business headaches.[1]

I suggest trying to think like a crook now and then. Trying to try on other people's lives is a useful way of shaking up one's thinking habits, empathy (don't confuse with sympathy) is always useful, and it can help you keep yourself more secure.

[1] I am leaving out things like several potential fates far worse than bankruptcy and related issues because they aren't opex-related, but they probably do effect retirement planning.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by midwife_cry_sys on Wednesday October 04, 2017 @07:14AM (#15399644)
The black market value is like 10-$15 dollars for a basic credit card number I believe. But gold cards and plat cards can be several times more. But drivers ID and ss# that's worth way more for what I believe are obvious reasons. My prices might be a little off, haven't checked in ages. You get the idea. Say 130 million cards at $10 each. Isn't that almost one and a half billion. Not chump change. Ad