Bazzell - Personal Digital Security

Introduction

The Problem

Idoubt that I need to convince you that there is a problem known as cyber-crime,also commonly called computer crime. You probably know someone (maybe it isyou!) that has been the victim of this constantly growing problem. Varieties ofthis include identity theft, debit card fraud, forgery, computer intrusion,phishing, harassment, cyber stalking, cyber terrorism, and online bullying. Thescale of damage can be minimal to devastating. During my time as a cyber-crimeinvestigator, I have seen hundreds of victims file reports of these incidents.Four specific incidents that describe four very different levels ofinconvenience are described below.

Avictim was contacted by her credit card company and advised that severalsuspicious charges recently appeared on her account. The woman confirmed thatthe charges were not authorized and the account was closed. She was sent a newcard with a new number. This minimal intrusion into her life required her tochange a few auto-pay options and enter new credit card details into her onlineshopping accounts. Overall, she lost no money and has probably since forgottenabout the incident. She was not required to report the incident to lawenforcement authorities and therefore it was never included in publiclyavailable internet crime statistics. The chances are high that you knowmultiple people that this has happened to.

Another victim was shopping for a new automobile and eventually decided on avehicle perfect for him. He had been at the same job for many years, had verylittle debt, and was confident that he would qualify for a low interest loan.The loan officer in the sales office advised the victim that he did not qualifyfor a loan due to multiple delinquent accounts. Someone had used his personalinformation to open new accounts for household utilities and did not followthrough on payment. Additionally, a used car was purchased in the victims namethat was six months overdue for a payment. This victim spent several weekscontacting credit bureaus and lenders trying to clear his name. His creditreport is permanently scarred and he is constantly bothered by bill collectorsthat have purchased the bad debt. The impact on his daily life is minimal, buthe will never forget the invasion of privacy incident.

Thethird victim, a technology reporter from a popular online and print magazine,had his world turned upside down in a matter of minutes. His name is Mat Honan,and he works for Wired magazine. A hacker decided to attack Mats Twitteraccount, but did not know the password. The suspect contacted Amazon and addeda random credit card number to the victims account. This did not requireverification at the time since no personal information was requested. Theattacker then re-contacted Amazon to have the victims password reset. Amazonnow wanted verification, which required the suspect to know a credit cardnumber on file. It was easy for the suspect to provide the fabricated number hepreviously added, which in turn gave him complete access to the victims Amazonaccount. From there, the hacker completed a similar process on the victimsApple account by knowing the last four digits of the real credit card on file(which he could now see on the Amazon account). This gave access to thevictims Apple Care account and email account. The attacker then reset thevictims Gmail account password and finally accessed the original target, theTwitter account. Just for spite, the hacker used Apples remote wipe feature tocompletely and permanently erase all of the content from the victims iPhoneand Macbook Pro laptop. This included all of the digital photos of the victimsyoung child, which unfortunately were not backed up. All of this was completedwhile the victim sat at home with possession of these devices. Mat documentedhis story in articles still available on Wireds website. He has moved on fromthis experience and created great awareness for the public.

Finally,the last victim was in a mentally and physically abusive relationship with atech savvy man that worked in the information technology field. She bravelydecided to end the relationship and moved to a neighboring city to start a newchapter of her life. Since he did not approve of the breakup, he beganharassing her in the way that he knew best. He had previously installed ahardware key logger onto the plug of her keyboard that collected all of thepasswords to her online accounts. This gave him unlimited access to her dataand communications. He could then send embarrassing messages to her friendsthat appeared to be sent by her. He could also identify new relationshipinterests and harass them. After she changed the password to her email account,he used a password reset feature through another network to obtain the newpassword. He then changed all of her passwords and she could no longer accessany of her accounts. From there, he accessed her cellular telephone account toview the details of her telephone calls to identify new victims. He remotelyinstalled a phone location app to her Android cellular telephone whichidentified her GPS coordinates at all times. He knew enough personal detailsabout her that he successfully obtained her credit report and cancelled allopen accounts. He then opened several new accounts which resulted in new creditcards sent to his address. These actions took months to clear up, and shecontinued to play cat and mouse with his antics. Finally, she opened newaccounts and abandon the old. She had finally seen the possibility ofeliminating him from her digital life. But then he broke into her wirelessnetwork and it started all over again. She will probably never fully recoverfrom this disturbing experience.