Here's What Your Identity Sells For On The Dark Web

Millions of Americans who trusted Equifax with sensitive personal and financial data, including social security numbers and credit-card information, are now nervously wondering whether they will be among the unlucky minority of affected customers whose identities are successfully “repurposed” by online criminal groups.

One researcher from security firm SecureWorks shared some details about today’s burgeoning marketplace for stolen data with Bloomberg, and the conclusion is clear: It is now easier – and cheaper – for criminals to access and abuse illicit data than ever before. In fact, a high-limit American express card with a high chance of working can be purchased online for less than $20. Criminals can buy files with thousands of low-limit card numbers for pennies on the dollar.

According to Bloomberg, “verified” high-limit credit cards from developed countries like the US, Japan, and South Korea are selling on the dark web for the bitcoin equivalent of about $10 to $20.

“Verified” means the seller has tested out transactions on the card and found it hasn’t been canceled yet. For scammers on a budget, there’s unverified stolen credit card data, which comes out to pennies a card when bought in bulk.

Here’s a screengrab from one dark-web marketplace.

Luckily for criminals, cards generally aren’t selling any cheaper on the dark web these days, said Alex Tilley, a researcher at Secureworks. Today’s buyers are more likely to get higher-quality cards, ones with sizable limits that can be used fraudulently with ease. It isn’t as hit-or-miss as it used to be, a welcome change for criminals, chilling news for most of us.

Criminals have even set up sophisticated “rating systems” to help value the data. Business cards are preferred, Tilley said, because they don’t have a limit. Those and high-end personal cards—say, a Platinum American Express that has been verified and has an 85 percent rating (judged by the seller to have an 85 percent chance of being successfully used in a fraud)—will go for $15 to $20. A regular Mastercard that doesn’t have a high limit might go for $9.

One underground hacker market inexplicably called Trump’s Dumps is selling full identities of individuals just like you for as little as $10 apiece. They’re called fullz, “dossiers that provide enough financial, geographic and biographical information on a victim to facilitate identity theft or other impersonation-based fraud.” Fullz can help a criminal get past those irritating “secret questions” that sites ask to verify your identity.

Recently, Secureworks’ researchers have seen more offers of bulk pre-verified card details, along with more identifying information about the owners. In some cases, offers even include the cardholder’s mother’s maiden name. Still, they cost just $10 to $12. Below is a fullz offer with a lot of personal identification on a Korean consumer.

In a massive breach like Equifax, hackers can easily walk away with hundreds of millions of dollars in profits from selling the data. Meanwhile, the identity thieves who purchased it can reap their own fortune running their scams.

Congress, the FTC and Equifax customers – enraged by both the company’s reluctance to initially disclose the breach and its carelessness (some would say tight-fistedness) concerning its cybersecurity defenses – have buried the company in lawsuits and official inquiries.

As USA Today revealed yesterday, hackers took advantage of an Equifax security vulnerability two months after an industry group discovered the coding flaw and shared a fix for it, raising questions about why Equifax didn"t update its software successfully when the danger became known.

We’re looking forward to hearing the whole story from CEO Rick Smith when he testifies before Congress early next month. Whether Smith manages to hang on to his job remains to be seen - calls for his resignation after a 12-year-long scandal-free tenure are mounting. CNBC"s Jim Cramer said last night that Smith "should be fired today."

But perhaps more worrying for Smith and his C-Suite companions are calls from North Dakota Sen. Heidi Heitkamp, who has demanded a criminal investigation into whether the company"s executives - several of whom sold stock during the period between when the company first learned about the hack and when it disclosed it to the public - commited securities fraud.

"If that happened, then somebody needs to go to jail," she said.

As Millions Of Venezuelans Try To Flee The Country They Run Into A Problem

While shortages of basic foods, medicines, and toilet paper may be a major societal problem, the people of Venezuela face an even more existential problem: the nation now lacks the materials to meet the soaring demand for new passports – making it almost impossible to leave the socialist utopia.

"People used to move to Venezuela from all over the Americas, Europe and Asia and now they are all trying to leave," Sonia Schott, the former Washington, D.C., correspondent for Venezuelan news network Globovisión, told Fox News.

While estimates of how many passport requests the socialist government received last year vary from between 1.8 million to 3 million, only 300,000 of the elusive documents were doled out.

Everyday, hundreds of people line up outside the passport agency, known as Saime, in the capital of Caracas in the hopes of obtaining one.

It’s an ironic, and yet sad situation, for a country that used to be one of Latin America’s wealthiest and one that was used to seeing people flock to, not away from.

Tomás Páez – author of “The Voice of the Venezuelan Diaspora” – told Bloomberg that since Chávez took power in 1999 nearly 2 million Venezuelans have fled the country and hundreds of thousands are marking their time until they obtains the funds and the passport that will allow them to leave.

Maduro has acknowledged the issue of the chronic shortages in passports and last week launched a new “online” option that will rush a passport to customers within 72 hours for about double the price of waiting in line. The website, however, has crashed numerous times and it is unclear how many passports have been expedited through this process. Saime has stated that the backup in processing passport applications is because the agency lacks enough “materials,” but did not specify what that means. Observers say that while the government may not be able to afford the paper to make the passport. Paper products in the country, including toilet paper, are in short supply in Venezuela. But skeptics think the Maduro government may also be trying to keep people from leaving the beleaguered nation.

“People with the means to get out want to, but the problem is you need a passport and you can’t get it,” Cynthia Arnson, the director of the Latin American Program at the Woodrow Wilson Center told Fox News.

“It’s kind of an excuse by the Venezuelan government that they don’t have materials, because they know the real reason people want a passport is to leave the country.”

Most of Venezuela’s 30 million resident, however, don’t have that kind of money as the monthly minimum wage in the country comes to less than $30 a month on the black market.

"Privacy Experts" Blast John Kelly Proposal For Immigrants To Turn Over Social Media Passwords

During the 2016 campaigning cycle, then presidential candidate Trump coined the term "extreme vetting" to suggest that additional measures should be taken to vet refugees and immigrants coming from volatile areas of the world that have a history of harboring and funding terrorist organizations.  Not surprisingly, the liberal media latched onto the term and exploited it to paint Trump as an unhinged candidate that would undoubtedly look to waterboard every British citizen making a 2-day business trip across the pond.

Then, a few weeks ago during a Congressional hearing, Department of Homeland Security Secretary John Kelly provided a glimpse of what "extreme vetting" may look like.  Among other things, Kelly suggested that refugees and visa applicants may be required to hand over social media passwords before being allowed into the country.  Per NBC, here are some of Kelly"s exact quotes:

"We want to get on their social media, with passwords: What do you do, what do you say?" he told the House Homeland Security Committee. "If they don"t want to cooperate then you don"t come in."

"When someone says, "I"m from this town and this was my occupation," [officials] essentially have to take the word of the individual," he said. "I frankly don"t think that"s enough, certainly President Trump doesn"t think that"s enough. So we"ve got to maybe add some additional layers."

As well as asking people for their passwords, Kelly said he was looking at trying to obtain people"s financial records.

"We can follow the money, so to speak. How are you living, who"s sending you money?" he said. "It applies under certain circumstances, to individuals who may be involved in on the payroll of terrorist organizations."

But apparently the mere suggestion that DHS would take the "extreme" precaution of reviewing a refugee"s social media content, which is mostly public anyway mind you, was just enough to "trigger" liberal civil liberties lawyers all around the country. 

Now, the Center for Democracy and Technology, a self-described champion of global online civil liberties and human rights, has formed a coalition of over 150 "human rights and civil liberties organizations, trade associations, and experts in security, technology, and the law" which have drafted a letter blasting Kelly"s social media vetting proposal.

The undersigned coalition of human rights and civil liberties organizations, trade associations, and experts in security, technology, and the law expresses deep concern about the comments made by Secretary John Kelly at the House Homeland Security Committee hearing on February 7th, 2017, suggesting the Department of Homeland Security could require non-citizens to provide the passwords to their social media accounts as a condition of entering the country.

Demands from U.S. border officials for passwords to social media accounts will also set a precedent that may ultimately affect all travelers around the world. This demand is likely to be mirrored by foreign governments, which will demand passwords from U.S. citizens when they seek entry to foreign countries. This would compromise U.S. economic security, cybersecurity, and national security, as well as damage the U.S.’s relationships with foreign governments and their citizenry.

Policies to demand passwords as a condition of travel, as well as more general efforts to force individuals to disclose their online activity, including potentially years’ worth of private and public communications, create an intense chilling effect on individuals. Freedom of expression and press rights, access to information, rights of association, and religious liberty are all put at risk by these policies.

The first rule of online security is simple: Do not share your passwords. No government agency should undermine security, privacy, and other rights with a blanket policy of demanding passwords from individuals.

Who knew that asking refugees and visa applicants to turn over mostly public information could result in so much international destruction...Ironically, it didn"t seem like that big of a deal when Obama did it...