Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Interview with the Guy Who Tried to Frame Me for Heroin Possession

krebsonsecurity.com

Post reply on HN
Print view View original

71–80 of 95 posts

Re: Interview with the Guy Who Tried to Frame Me for Heroin Possession

#71

Post by ryanlol »

greedo wrote: post #68
ryanlol wrote: post #58

Earlier quoted context omitted.

Easy, you just lie when people ask. Apply for store loyalty cards and similar with fake information to get that associated with your data broker profiles. You could also open phone lines with fake information, ISP accounts and so on. A good investigator with expensive access will still be able to track you down, but automatically exploiting your data will be much more difficult if it's a mess.

I'm pretty sure this would qualify as fraud in most jurisdictions.

Why? You aren't deceiving anyone for a benefit, nor are you causing any injury.

Re: Interview with the Guy Who Tried to Frame Me for Heroin Possession

#72

Post by michaelmrose »

yardie wrote: post #16
creditReport1 wrote: post #12

Earlier quoted context omitted.

I work at one of the big 3 credit bureaus so thought I’d chime in - It is entirely possible to report inaccurate information to the bureaus. Although more often than not it’s on accident, not malicious. Additionally bureaus collect a lot of information from other sources. Some public some private. It’s possible for these datasets to be error prone themselves. There are however official procedures for disputing/correc…

Our son (10 yo) had a delinquent medical bill for reasons we don't understand. The creditor can't tell us who sent the bill because we aren't the named party and I'll be damned if I put him on the phone with them, because he is a minor. So, we're at an impasse and no one can tell us anything. Someone managed to get his name and address and did not realize he was a minor. Brilliant system you have!

We can legislate his company out of businesses and replace them with someone accountable to citizens.

Re: Interview with the Guy Who Tried to Frame Me for Heroin Possession

#73

Post by burtonator »

coldcode wrote: post #10

It's interesting that the "hacker" himself was caught via hackery. When I worked on anti-cheating stuff for a game company, I was able to stop the seller of the cheat because their cheat had been stolen and resold so they had to put anti cheating tech in their cheating tech and it opened a hole I was able to exploit to detect them.

Live by the sword, die by the sword. I low how they cheat steal and are upset when other people cheat and steal.

Re: Interview with the Guy Who Tried to Frame Me for Heroin Possession

#74

Post by dotancohen »

yellowarchangel wrote: post #65
celim307 wrote: post #63

So this guy picked OP completely at random? I wonder why he was initially targeted

The most important and missing information at the start of the article is _why_ the OP had their information posted on the forum, why they were getting sent this package.

OP is a very well known security researcher. Here is his self-bio:

https://krebsonsecurity.com/about/

Re: Interview with the Guy Who Tried to Frame Me for Heroin Possession

#75

Post by smogcutter »

ryanlol wrote: post #69
kerkeslager wrote: post #67

Earlier quoted context omitted.

We're not talking about just any data brokers though, the parent comment mentioned credit bureaus specifically. I'm not a lawyer, but if you're applying for a line of credit with false information, I'm pretty sure that's a crime. If you're not applying for a line of credit, I don't think credit bureaus such as Equifax or "Transperian" (which I assume is a portmanteau of TransUnion and Experian) will base anything on…

>I'm not a lawyer, but if you're applying for a line of credit with false information, I'm pretty sure that's a crime. I'm definitely not a lawyer, but unless your intent is to defraud I wouldn't be so sure about that. I also don't see how you'd ever end up getting prosecuted for this unless you really piss someone off, in which case I guess you could get prosecuted for just about anything. In any case, whether or no…

“Honestly your honor, I wasn’t going to use the loan I applied for with false information, I was just trying to briefly confuse hackers and advertisers!”

But I really don’t know, because I’m also not a lawyer and therefore do not give people legal advice on the internet.

Re: Interview with the Guy Who Tried to Frame Me for Heroin Possession

#77

Post by kerkeslager »

ryanlol wrote: post #69
kerkeslager wrote: post #67

Earlier quoted context omitted.

We're not talking about just any data brokers though, the parent comment mentioned credit bureaus specifically. I'm not a lawyer, but if you're applying for a line of credit with false information, I'm pretty sure that's a crime. If you're not applying for a line of credit, I don't think credit bureaus such as Equifax or "Transperian" (which I assume is a portmanteau of TransUnion and Experian) will base anything on…

>I'm not a lawyer, but if you're applying for a line of credit with false information, I'm pretty sure that's a crime. I'm definitely not a lawyer, but unless your intent is to defraud I wouldn't be so sure about that. I also don't see how you'd ever end up getting prosecuted for this unless you really piss someone off, in which case I guess you could get prosecuted for just about anything. In any case, whether or no…

> > If you're not applying for a line of credit, I don't think credit bureaus such as Equifax or "Transperian" (which I assume is a portmanteau of TransUnion and Experian) will base anything on that data, since it's so obviously easy to manipulate.

> You would be wrong. That'd be an awful way to maintain up-to-date address data on people.

Okay, could you cite this, please? I've been very clear that I'm just speculating, but if you're so sure maybe you have some insider information I don't?

My credit reports don't have my up-to-date address, so whatever they are doing is an awful way to maintain an up-to-date address.

Re: Interview with the Guy Who Tried to Frame Me for Heroin Possession

#78

Post by ryanlol »

smogcutter wrote: post #75
ryanlol wrote: post #69

Earlier quoted context omitted.

>I'm not a lawyer, but if you're applying for a line of credit with false information, I'm pretty sure that's a crime. I'm definitely not a lawyer, but unless your intent is to defraud I wouldn't be so sure about that. I also don't see how you'd ever end up getting prosecuted for this unless you really piss someone off, in which case I guess you could get prosecuted for just about anything. In any case, whether or no…

“Honestly your honor, I wasn’t going to use the loan I applied for with false information, I was just trying to briefly confuse hackers and advertisers!” But I really don’t know, because I’m also not a lawyer and therefore do not give people legal advice on the internet.

The idea is that you'd use the loan, and pay it just like you normally would. But instead of giving the lender your actual address you give them some other address, essentially indistinguishable from a regular data entry error.

I can't see anyone getting in trouble for this unless they're creating fake credit profiles or not paying their debts, the credit bureau dbs are chock-full of garbage data from garbage sources.

How would you even get caught in the first place?

Re: Interview with the Guy Who Tried to Frame Me for Heroin Possession

#79

Post by ryanlol »

kerkeslager wrote: post #77
ryanlol wrote: post #69

Earlier quoted context omitted.

>I'm not a lawyer, but if you're applying for a line of credit with false information, I'm pretty sure that's a crime. I'm definitely not a lawyer, but unless your intent is to defraud I wouldn't be so sure about that. I also don't see how you'd ever end up getting prosecuted for this unless you really piss someone off, in which case I guess you could get prosecuted for just about anything. In any case, whether or no…

> > If you're not applying for a line of credit, I don't think credit bureaus such as Equifax or "Transperian" (which I assume is a portmanteau of TransUnion and Experian) will base anything on that data, since it's so obviously easy to manipulate. > You would be wrong. That'd be an awful way to maintain up-to-date address data on people. Okay, could you cite this, please? I've been very clear that I'm just speculati…

>Okay, could you cite this, please? I've been very clear that I'm just speculating, but if you're so sure maybe you have some insider information I don't?

I don't know of public sources to cite, but I've seen the data. If there exists good public material about how these companies source their data, I haven't seen it.

These companies will accept data from essentially anywhere they can get it, not all of that will affect your credit score but it'll certainly affect your person profile. Name(s!),addresses,ssn(s!),dob(s!) and whatnot associated with an individual "person" id.

FWIW, the credit bureaus are not just credit bureaus:

https://www.tlo.com/law-enforcement

https://www.experian.com/consumer-information/right-party-co...

https://www.equifax.com/business/firstsearch/

Re: Interview with the Guy Who Tried to Frame Me for Heroin Possession

#80

Post by smogcutter »

ryanlol wrote: post #78
smogcutter wrote: post #75

Earlier quoted context omitted.

“Honestly your honor, I wasn’t going to use the loan I applied for with false information, I was just trying to briefly confuse hackers and advertisers!” But I really don’t know, because I’m also not a lawyer and therefore do not give people legal advice on the internet.

The idea is that you'd use the loan, and pay it just like you normally would. But instead of giving the lender your actual address you give them some other address, essentially indistinguishable from a regular data entry error. I can't see anyone getting in trouble for this unless they're creating fake credit profiles or not paying their debts, the credit bureau dbs are chock-full of garbage data from garbage sources…

I mean, go for it, but you’re still talking about falsifying loan documents. That’s gotta be a good way to gin up trouble, even if it doesn’t come to prosecution.

I just can’t see a scenario where some info is fake and other info is real (necessary bc you’re using and paying the loan) that’s both kosher with the bank and gives you the obscurity you’re looking for. Is this something you can actually speak to from experience, or are we both spitballing? Because I’m happy to be wrong, but if we’re both making this up as we go then the conversation is pretty pointless.

Post reply on HN