The Secret Weapon Hackers Can Use to Dox Nearly Anyone in America for $15

Re:The Secret Weapon Hackers Can Use to Dox Nearly Anyone in... by michaelt on Tuesday August 22, 2023 @01:16PM (#37225790)

> Your grievance is misguided.

I'm not sure what makes you think that, given you don't know any of the details involved.

In my case, TransUnion received credit checks for me with dates of birth 1 Jan, 2 Jan, 3 Jan, 4 Jan and so on until they hit upon my date of birth, then a credit account was opened that same day, then later in the day a third party credit monitoring agency accessed my credit report and they were allowed to pass 'knowledge based authentication' using their knowledge of that credit account.

I am completely sure TransUnion could have detected and foiled this incredibly obvious attack. I'm also completely sure they could have identified other victims of the same attackers and informed them, but they chose not to.

[ Parent | on HN ]

Re:The Secret Weapon Hackers Can Use to Dox Nearly Anyone in... by ajmurmann on Tuesday August 22, 2023 @01:35PM (#37226036)

TransUnion also has full control over what authentication mechanism they use. On the extreme end, they could require a Yubikey to be used. However, they deem the hassle to implement better auth not to be worth it while it's users who carry the cost of TransUnion's inability to properly authenticate people.

[ Parent | on HN ]

Re:The Secret Weapon Hackers Can Use to Dox Nearly Anyone in... by mrguyorama on Tuesday August 22, 2023 @01:52PM (#37226293)

They also see zero reason to spend even a dime on better security of processes when they saw that the entire company could be pwned and distributed on the dark web and you end up losing zero revenue, maybe a million bucks in a class action suit.

[ Parent | on HN ]

Re:The Secret Weapon Hackers Can Use to Dox Nearly Anyone in... by NoZebra120vClip on Tuesday August 22, 2023 @02:06PM (#37226488)

Are they vulnerable to SSPR Abuse? I'm having great fun reporting to Very Large Services and being rebuffed because they don't understand or care.

[ Parent | on HN ]

Re:The Secret Weapon Hackers Can Use to Dox Nearly Anyone in... by cognaitiv on Tuesday August 22, 2023 @01:32PM (#37225998)

KBA must die.

[ Parent | on HN ]

Re:The Secret Weapon Hackers Can Use to Dox Nearly Anyone in... by gopher_space on Tuesday August 22, 2023 @02:23PM (#37226680)

> I am completely sure TransUnion could have detected and foiled this incredibly obvious attack. I'm also completely sure they could have identified other victims of the same attackers and informed them, but they chose not to.

It's entirely possible that nobody at TransUnion knows how to achieve this given the state of their databases' and/or staff. For example, maybe their system was set up before constraints were a thing and they stopped development once it started printing money, so the only person "working" on it does light maintenance as a portion of their other duties.

[ Parent | on HN ]