Experian Vulnerability Shows Any Report with just SSN, DOB, ADR
infosec.exchange
infosec.exchange
I can understand (but not necessarily agree) with arguments for full disclosure when the consumer has a choice to avoid using the vendor .. but, in this case?
Additionally, Krebs has stated that Experian has yet another glaring security issue. He's not saying exactly how to do it, or dropping POC in the post.
Given the size and importance of Experian, there's nothing wrong with pointing out this issue, especially when after 4 days they can't even acknowledge an issue this serious.
Krebs stating a vulnerability exists, is more responsible than not disclosing it -- given their importance, and history of security screw-ups, the people have a right to know.
A malicious actor wouldn’t wait until business hours.
The older ongoing problem is that any person can create a new Experian account with a new email address, and answer a few credit-related quiz to take over somebody's credit file. When doing this Experian will helpfully even offer to unlock the credit file and you can reset security questions etc. All without the consent of the victim. All the "security" systems are bypassed.
This new vulnerability means you need even less information to take over somebody's credit/identity. You can get the answers to their quiz directly from Experian's own systems. That makes it a bigger deal.
Experian had 72.
You can check me on this here https://consumer.ftc.gov/articles/free-credit-reports
The big problem with asking for SSN+DOB or SSN+ZIP or even SSN+Name is these are highly correlated. SSNs are issued in order by date, in tranches given to each hospital, which gives you a fair chance of guessing a ZIP. Once you have a ZIP and a year you can also make informed guesses as to last name.
Anyway, according to that lookup table, I was born in 1927, a conclusion with which I strenuously disagree. Those methods may have been statistically useful in the year of publication but so many things have changed, and so many more people move between states than before the 80s, that I doubt its validity now. As a reference, the pandemic drastically slowed down American interstate household moves, but even so, 8% of the population moved states in 2020 -- including 18% of people between 20 and 29. (https://www.weforum.org/agenda/2021/12/american-relocation-h...)
In short, I think it may have been more feasible in the past to draw these correlations, and now it's less feasible. On the other hand, massive data leaks are de rigueur, so it's probably just easier to buy databases from criminals on the internet.
The difference is, this allows somebody to do a non-consensual credit check on you. Not to mention the whole other raft of problems brought on by the credit reporting industry.
TransUnion sold my info to every mortgage company out there and I guarantee you I got 100+ calls and text messages from companies I've never heard of asking me to apply with them.
They just sell any and all of our data over and over again.
Can't opt out and can't stop it. 100s of calls to my cell phone.
> All you needed was the person's name, address, SSN and DOB.
Yes, but you can change your SSN anytime, it is still considered confidential info and the US has no easily changeable national ID system.
Most banks let you take over an account with just SSN and knowledge of debitcard number (without cvv code) and sometimes dob.
If you think your ssn is exposed don't count on companies and government bureaus not relying on it. Change it.
No acct with that mail. Odd.
Tried signing up… “email already in use..”
…umm.
> Glad I checked, too, because the info in there is so completely wrong I don't even know where to start.
So a guy who holds himself out as a security expert hasn't even been monitoring his own credit report. I guess the Ubiquiti incident already made clear this guy is a charlatan.