Srsly Risky Biz: America's drivers licence breach is a national security disaster

0:04James Wilson: Hey everyone, I'm James Wilson and welcome to this week's Seriously Risky Biz. This is our cybersecurity policy and intelligence podcast and it is based on the awesome newsletter that my colleague Tom Uren writes. You can find Tom's newsletter, Seriously Risky Business, over at our website, risky.biz, where you can read the newsletter and also subscribe to it so that it lands in your inbox every week. Tom will, of course, be along shortly to chat with me about the newsletter but first a big thanks to the sponsor for this week which is Authentic. They make an open source IDP and I published an interview this week with their CEO Fletcher Heisler about how having a really good identity story for AI agents actually begins with a very flexible privileged access management system.

0:48James Wilson: So do check that out if that's something of interest to you. But back to Tom's newsletter, three topics for this week. The first one is this just gigantic breach of US and Canadian driver's licenses that was uncovered and reported by Brian Krebs of Krebs on Security this week. We then talk about how the US military has finally, finally done far too little, far too late to prevent ad tracking from being able to allow adversaries to track troop movements. But then we also talk about how this incredible event this week with a hacker making off with $320 million worth of Bitcoin from the Liquid Network Exchange.

1:31James Wilson: But it's okay. They're a white hat. They returned 85 % of it. Does that allow them to get away with it? Will they get away with it? Will they ever be able to spend a cent of that? We'll go into this as well. But I'm going to drop you in here where Tom starts to talk about this incredible breach of an identity database that contained just an eye-watering number of driver's licenses for US and Canadian individuals, and not just the scale of it, but how it was uncovered by Brian Krebs. But more importantly, what does this mean from a national security point of view? Enjoy. Brian Krebs, who runs Krebs on Security, he was tipped off that someone was selling a breach

2:19Tom Uren: or access to identity documents on the dark web. He had a look. The site purports to have 150 odd million driver's licenses. And it said that it was getting it by basically kind of scraping from a top tier identity verification service. And he observed that over the course of a day, it added, I think, an extra 400 ,000 records.

2:48James Wilson: That's a hell of a scrape. That's huge.

2:50Tom Uren: Yeah. And so it seems like they had real-time access to whatever the system was doing. And each time, maybe not real-time, but at least regular access. And each time a license was submitted, it was hoovering it up. And so the driver's licenses were the most significant part. The vast majority of them were American. There was some Canadian as well. And he did a bit of sleuthing and figured out, I think it's this service. and you know I think based on talking to people he knew this is the way that it's happening and it's you know some people had gone to Hertz show a driver's license boom end up in the database that that day and so this is I think the scale of the hack is huge or the breach and the group responsible who call themselves nexus they said that they'd sucked it all up into a private database so it wasn't as if they were querying the corporate database they they set it aside

3:55James Wilson: so the data is gone yeah it doesn't this doesn't seem like a an open api that they're just querying on demand this seems like this is a um you know persistent connection into this that they are downloading you know almost in real time as you said these these databases these credentials and have stockpiled them. And just one thing I want to mention there, Tom, you mentioned that Hertz was involved here. And yes, that's one of the correlation points that Brian Krebs found was that he and his mom had scanned their licenses at Hertz and that sort of, they ended up in this data set, but it's not Hertz that was breached.

4:28James Wilson: It's actually this identity provider ID scan. Is that your understanding as well?

4:32Tom Uren: Yeah, yeah. So it seems like there's a variety of firms that do identity verification. And it's like this kind of vicious circle where so many licenses have been leaked that it's easy for people to make up fraudulent ones. So you need a service to check that they're okay. But the service that checks it's okay has turned out to be, looks like it's vulnerable. So there's even more driver's licenses that are out there.

4:58James Wilson: So the virtuous cycle of fake IDs is no doubt set to continue. But there's more to this, You made the point in the newsletter here. You began with explaining that what the real value here, particularly for an adversary or from, I guess, a national security perspective is the linking of these identifiers. And I found that fascinating because I hadn't sort of put two and two together here as to just how interesting, important, and I guess expansionary this data set could be to the intelligence community. So talk us through that. So there's, I guess, a history here.

5:33Tom Uren: In the mid-2010s, the Chinese state went on a kind of data rampage, I would describe it as. So they stole data from the most sensationally from the Office of Personnel Management, which manages US government security clearances. So that's got a wealth of information about people in the intelligence community. So that is really bad. But then they also, in the years surrounding that, stole data from places like Marriott, hotel bookings, United Airlines, flights, Anthem, which is a health insurance company. And if you combine those data sets, you can really go a lot further. and there's reporting from Zach Dorfman who says that everyone in the intelligence community is completely convinced that the Chinese used this data to wrap up a whole lot of intelligence networks that the CIA in particular was running and so working or being an agent for the CIA became very very difficult around that time.

6:40Tom Uren: So there's not been another string of similar hacks that's been attributed to China since then. So a question is, why would you not continue to get that data? One hypothesis is that you just buy it from data brokers and you've got a historical repository and you can just keep adding to it. That would make sense. Another is that you just snaffle up these databases when they appear on the dark web. So in the piece I talk about Bellingcat. So the CIA people have told reporters they think the Chinese are using this. Bellingcat is an investigative research outfit that takes the same sort of data in Russia and figures out what the Russians have been up to.

7:25James Wilson: Right.

7:26Tom Uren: And they've got published over the years some really interesting stories about how they've pivoted from one database to another and looked at people like identifying the suspects in the poisoning of Sergei Skripal, who was a former, he is a defector from the Russian KGB. I believe it was the KGB. Ended up in Britain. Was poisoned by three individuals with Novichok nerve agent. and Ballycap also used the same sorts of data to find a Russian deep cover agent trying to penetrate a NATO headquarters in Naples and so they go through the mechanics of how you pivot from one database to another. Now licenses are particularly good because they're a key identity document.

8:14Tom Uren: You use them all the time to sign up for other services so often the license number is kind of a key that you can pivot from one database to another. and by combining and pivoting off those databases you get a really complete picture of

8:29James Wilson: what someone has been up to how useful is it now that they've got a i guess a photo of this person as well right it's one thing to have identifies that you can pivot around but it is there is this really like the next level of usefulness to an adversary because it's now they can put a face to

8:43Tom Uren: the name as well i think that's particularly useful nowadays like maybe 10 years ago it would have been, okay, it's nice to have a photo, but how can we use it? Nowadays, there's a lot of really good facial recognition technology. So I think that does make a difference as well. And Bellingcat's talked about things like people who weren't in databases before, that can be an indicator. And so this is a very comprehensive database. It gives you a lot of room to do that kind of analysis and you can imagine that the people who are staying in hotels booking rental cars they're the sort of people who are actually of interest to intelligence agencies if you stay at home and you never go anywhere never book into a hotel never visit a rental car company probably you're not doing anything that is of interest to an intelligence agency so in a way it's kind of self-selected for people who are interesting, higher value.

9:42Tom Uren: And so I think it becomes quite a valuable data set. And because it can be used for linking, and because it was so comprehensive, I think I figured out maybe 60 odd percent of the US population.

9:56James Wilson: Yeah, I saw that in the newsletter, 60 % of all, I think, licenses you mentioned, which is just, it's staggering in terms of coverage. But also, you also mentioned the newsletter, this is not, I mean, it's huge, but it's not an isolated thing. You document a couple of the other breaches. And so I guess before we move on to the next story, what's the so what of this? What happens now? Do we get to see some sweeping regulation? Do we see government intervention? Or do we just get to see more breaches, Tom?

10:20Tom Uren: Well, my initial thought was there are some industries in the States that are regulated because they contain or deal with sensitive data. So there's health regulation about how you handle health information. there's stuff around the financial services industry because of for the same reason and it seems to me that like there is a justification for for having tighter regulation around identity verification because of the sensitivity of the data and because it affects so many people I'm realistic though this current government and congress is not going to do anything about it I think it's all in the too hard basket so the only positive news is that there's been the whole suite of lawsuits already announced without even having confirmed proof that IDScan is the company that's been breached.

11:12Tom Uren: I think it's good to highlight that there are financial costs to having poor security. I'm also hopeful that maybe the FTC might do something. They've continued to look at data brokers who have been dealing with information very, very loosely. and putting a bit of pressure there. So it's something that FTC might take up, the Federal Trade Commission.

11:38James Wilson: All right, let's wait and see what happens. Let's move on now to the US's sudden implementation of a measure around ad tracking. But I remember talking with you about this around June. I think that was when Reuters confirmed that there was commercial location data being used to target US personnel in the Middle East. And at the time, I think they talked about some of the measures they were going to put in place. and we all collectively just sort of rolled our eyes and said, that does not sound particularly convincing. But now it turns out they weren't even doing the basics. Tom, what happened here?

12:10Tom Uren: Yeah, so at the time of that story, which was a couple of months ago, I looked at Department of Defence Policy and it said, you know, we should remove advertising identifiers from our devices. So the story is that by default, some operating systems have an advertising identifier that is permanent and attached to the machine. And that gets databased all the time when you're dealing with the internet. And so Apple's iPhone doesn't, but Google's does. It's a thing you can switch off. And the policy said we should switch it off. But it turns out they weren't switching it off because the latest letter we've got is that at least for some elements of the military, they only just switched them off recently in the last couple of months.

13:03Tom Uren: So they had a policy that seemed to me to be the bare minimum and they weren't necessarily implementing that. So Reuters has a story where it says, you know, the Air Force turned them off a couple of months ago, the Army turned them off particular devices within the last couple of months. So it's a very mixed picture. And so basically, as a whole, the US military was not robustly implementing the policy they already had, is my takeaway.

13:29James Wilson: But even when you say that's the bare minimums, let's be clear, this is not the bare minimum in terms of a viable measure that will meaningfully or materially impact tracking of people, right? Because this is just one identifier. Isn't the whole ad tech ecosystem like almost at this stage designed to be resilient to these identifiers already being

13:47Tom Uren: turned off by users yeah yeah so i think it is uh like it's a complicated picture so the identifiers existed because they were really helpful for advertisers everyone wants to make money like that's the point of the internet if you've got a certain point of view and so there are i guess you would call them compensating controls for advertisers where they can use different techniques and the big companies like Google, Facebook play this game where they appear to have protections that they kind of know don't necessarily work or their workarounds. And so I'm not convinced that just switching off those identifiers is all that effective.

14:34Tom Uren: Having said that, when you've got them, it's really like super easy analysis. So it is making things harder because you've got to do more steps to overcome that if you're an adversary i mean in this case we're talking about iran right um and i think the picture is also complicated because it's not necessarily the only way that you would do things and so um like if you're the u.s military you're deployed in the middle east it is obvious that you've got bases yeah so like so in a sense removing identifiers like doesn't hide the bases it doesn't make them magically disappear so it's a holistic picture of what are the things that are really revealed by this the example we had was a particular the story at least was that a particular demountable had been struck and that makes sense as a place you'd want to try and hide because it wasn't I don't believe it was on a military base and so it was away from air defence, I suppose.

15:40Tom Uren: And so you would want to keep that secret. I think probably removing the identifier would make it harder to identify that particular facility as a target.

15:52James Wilson: But the difficulty created in that is only going to run up against how incentivised the adversary is, right? And an advertiser has shown they've got no problem at all overcoming this to make a buck. So I would imagine an adversary is also going to have not too much trouble overcoming this if the goal here is to successfully put warheads on foreheads in a battle space.

16:12Tom Uren: Yeah, I think it's really problematic. And I think my overall takeaway is that if they had taken the problem seriously five years ago, they would not be in this situation now. I think it takes some effort to figure out what is the right mix of controls between military-owned devices, personal devices, where bases are, you know. So maybe for that demandable, it is no phones whatsoever anywhere nearby. Like maybe that is the sensible approach. And when the potential is for missiles to land on you, I think that's a reasonable mitigation, right? Yeah. But you've got to do the work to figure out if that's what you want to do.

16:56Tom Uren: And they haven't done that. And that's evidence because they just only switched them off in the last couple of months when it's like, OMG, there's these reports that that's how we're being targeted. That's not good. Let's do something about it now.

17:10James Wilson: Yeah, but just so incredible to see so little being done so incredibly late. You mentioned there the internet's purpose is to make money, at least in some people's view let's talk about the last story here which is an incredible way that an individual has made quite a sum of money on the internet and on the blockchains in particular this week we're talking about the uh liquid attack on uh or the liquid network i guess it is um cryptocurrency platform where there was a theft of 320 million dollars worth of bitcoin but it's all right tom they're white hat hackers and they returned it, right?

17:46Tom Uren: So they've returned 85%. And this triggered discussion at RiskyBids HQ, like returning 85 % and keeping what,$40,$50 million. That's not white hat hacking. That's not a bug bounty. That's just stealing a whole lot. And I actually looked at the history of this and there's actually a pretty successful track record of people stealing vast amounts of money, returning most of it, and then at least so far getting away scot-free as far as I can tell. Like there's no reports of arrests subsequently. And so this particular case, it's not necessarily done yet in the sense that they've returned 85%. There could well be a negotiation about, you know, I'm going to return more.

18:32Tom Uren: How much am I going to get to keep? Now, the FBI in previous cases has said, look, it's not up to the victim to decide whether we, whether they've committed a crime and whether they can get away scot-free. Like we have, the FBI is its own agency. Law is, you know, notionally independent.

18:51James Wilson: Yeah. But is there a point in time when there could be an actual legally binding document created between the attacker and the victim here where they do actually nominate this as, yes, we contractually now ended into an agreement where we are paying this individual, I don't know, 5%.

19:09Tom Uren: So one of the stories is, I think it was three years ago, this individual called Abraham Eisenberg, he executed what he called a trading strategy. A highly profitable trading strategy. On this system called Mango Networks. And he took out, through some sort of market manipulation, I think it was 120 million US dollars worth of cryptocurrency. That drove the entire exchange broke. He returned 67 million dollars worth. And that basically recapitalized it. And the governance mechanism of the exchange voted to give him 47 million dollars worth of cryptocurrency.

19:59James Wilson: Wow.

20:00Tom Uren: And so he was like, yeah, everything was legit. I followed the rules. It just so happens that the creators of the exchange didn't understand the implications of their rules. And so he was charged and prosecuted by the FBI, found guilty of market manipulation and fraud. And then a judge subsequently overturned that and basically agreed with his premise that he didn't convince anyone of anything. He just looked at the rules and took advantage of the rules.

20:35James Wilson: Well, this is the fascinating thing about all of these defis and blockchains is there's this notion of the code is the law and therefore does that not make all trades legal?

20:48Tom Uren: Yeah, so I think I'm more of a realist and I think that the whole point of judicial systems is to prevent people making off with hundreds of millions of dollars that doesn't belong to them, no matter what the code says. Pragmatist, maybe realist, I don't know. But then I don't work in Wall Street or cryptocurrency, where it seems like occasionally this kind of thing does happen, it is lawful, on you go. But to me, most of the advantage of claiming you're a white hat is actually in the self-deception. I think if you're a North Korean criminal, cyber criminal, used to stealing cryptocurrency, you've got a kind of pathway of, I get the crypto, I launder it, job done.

21:35Tom Uren: There's no need to deceive myself and think I'm a white hacker. Right, I'm just doing my job is what I do. I think in these cases, a lot of the people don't have that pathway of what am I going to do once I've got it? How do I launder it? How do I not ever get caught? And I think this gives them the belief that maybe I can steal$600 million and get away with some of it and live my life peacefully ever afterwards without worrying about being hounded by the police.

22:03James Wilson: Well, that's the thing I was curious about. Like, it's all good and well to have kept this, you know,$50 odd million. But are they ever going to get to spend a cent of that?

22:11Tom Uren: I think that historically what has happened is that they've often kept quite a large amount. and then they've, I think, you know, the first return, the first tranche is like here's the Goodwill tranche. Now let's get down to brass tacks and negotiate what I actually get to keep out of the rest. And so that has happened I think with Poly Networks was one of the other ones I looked at. The hacker initially returned quite a large amount, kept I think$33 million and that was eventually like negotiated down to we'll give you a$500 ,000 reward. So still a pretty good payday. And I think it's small enough that, like let's be real, everyone who's working in this industry wants to make out like a bandit and get super rich.

23:02Tom Uren: And so no one is incentivised to actually find the culprit and punish them. They all just want to move on so that they can also become super rich somehow through some scheme.

23:13James Wilson: You can't be the next bandit if you're going to go and chase the bandits down.

23:16Tom Uren: That's right. It's a waste of time to chase another bandit when you've got your own scheme.

23:21James Wilson: Amazing. I mean, look, it'd be utterly farcical if it weren't just for the sheer volumes of money involved. Oh, no, it still is farcical. Yeah, but it's farcical with big dollar signs on it, which just makes it even more difficult to comprehend. But, Tom, I will say it's funny that we were talking about this and the actual use of the money and how to launder it. I actually caught up this week with Jeff White, who's an investigative journalist who's done series on the Lazarus Heist and also now the Conti Files. And he and I recorded a feature episode about exactly how the ransomwares in particular paid by Bitcoin are being converted into hard cash and how this is not actually just benefiting the ransomware actors, but also it actually sets up this interesting bilateral trade where street crime and drug dealers actually benefit out of this conversion of Bitcoin into hard cash because they similarly want hard cash into Bitcoin.

24:13James Wilson: So that'll drop into the features feed next week. So do check that out as well if you're interested in how this becomes cash.

24:19Tom Uren: Sounds interesting.

24:21James Wilson: All right, Tom, great newsletter. This was a really cracking read. Thanks so much for dropping by, mate. I'll see you next week.

24:25Tom Uren: Thanks, James.