海角大神

Anyone with a keyboard and a cause can have a living person declared legally dead听by taking advantage of security weaknesses in the online death registration process, says Chris Rock, chief executive officer of Australian-based security company Kustodian.

Mr. Rock used online databases to pose as a doctor 鈥� and even registered as a funeral director 鈥� to prove he could game the system and issue death certificates for friends or enemies.

Despite concerns his research may inspire a wave of fraud, Rock detailed a how-to guide to the process to a packed room at the famous DEF CON conference in Las Vegas last Friday. 鈥淚 have not contacted any vendor for fixes. Here is the definition of irresponsible disclosure,鈥� Rock told an overflowing room of hackers. Why go this route? Because, he says, 鈥渋t鈥檚 not so much a vulnerability 鈥� it鈥檚 a [mistake.] And it鈥檚 a global [mistake].鈥�

Rock also uncovered vulnerabilities in countries鈥� birth registration processes, which could allow people to create a totally new virtual baby 鈥� and use its identity as a cover for illegal activity such as drug trading. Rock says it鈥檚 a lot more convenient, in some ways, for criminal hackers to try to get a totally new Social Security Number than risk stealing someone else鈥檚 or buying one off the black market.

At DEF CON, Rock spoke with Passcode about how he discovered these flaws and why a fake death and birth market could change the cybercrime paradigm. Edited excerpts follow.

Passcode: Let鈥檚 start at the beginning. How did you get interested in this?

Rock: I鈥檓 a penetration tester [who is hired to attack clients鈥� networks to test their security] by trade. So, normally, I wouldn鈥檛 ever touch this process.

But I was watching the news one night in Australia, and saw Austin hospital [in Melbourne] actually sent out 200 death notices instead of discharge notices. I thought, "How could that possibly happen, if it鈥檚 a paper-based system? They鈥檝e obviously gone online and done it in a mass instance."

I then focused on the Australian system to see how it could happen, and was shocked to find [death registration] was an online system without any protection at all.

Passcode: Tell us how it works.

Rock: Essentially, when someone dies, the doctor gets called in. They鈥檒l check your pulse, fill out a certificate of death with what you actually died of 鈥� and obviously all your personal details, like your name and that sort of stuff. The certificate of death is a two-part document. It gets passed on to the funeral director to fill out his portion of the document.

The Americans have moved on to a system called EDRS [Electronic Death Registration System]. So doctors, on the Internet, can actually register a death online, and a funeral director can actually take that case and bury the body.

The Australian system is identical. The Canadian system is identical. They鈥檙e all following, now, an online presence because governments want accurate, centralized death records. Because believe it or not, when you鈥檙e dealing with doctors and handwriting, paper has to go back and forth. Also, if there鈥檚 a disaster 鈥� such as, say, Hurricane Sandy 鈥� someone can look up where the deaths occurred, and in what area. And someone can actually direct resources to the disaster zone. So it鈥檚 like a big lookup system for deaths.

Passcode: So what are the weak points?

搁辞肠办:听The vulnerable spots are both the doctor and the funeral director鈥檚 access to the online portal. They have a DIY [do-it-yourself] access.

And each country has a registration system for doctors. So if you鈥檙e a doctor, and you want to go from one hospital to another, the people at that hospital need to see you鈥檙e actually registered and verify [who] you are.

And it鈥檚 those details, from the license database, you can plug into the death registration form 鈥� and effectively become a doctor. You just take that [license] number, put in your own e-mail and cell number, and you become that doctor.

笔补蝉蝉肠辞诲别:听But there鈥檚 no verification?

Rock: Zero verification.

Passcode: So all you need is the websites of these places?

Rock: Yeah. You can kill somebody in about 10 minutes.

You can be a doctor within five minutes, a funeral director within five, and then complete the death certificates.

Just to prove it was possible, I became a funeral director in Australia. So I actually went through the process to do this in real life. I鈥檓 obviously not going to get a doctor鈥檚 degree to do the research, but I could become a funeral director.

Passcode: How long did that take you?

Rock: It took me about five days. But to do the actual work it required, it took me about five minutes. I filled out an online application, got access within a couple days, and then I was a registered funeral director so I could officially dispose of bodies.

The UK has no licensing at all. America has some licensing. In Colorado, for instance, there鈥檚 no licensing. Nevada has an exam and $375 fee to become a funeral director.

笔补蝉蝉肠辞诲别:听Why go through this? What would a person get from legally 鈥渒illing鈥� a person?

Rock: If I shut you down, I can get access to your bank accounts. Your real estate. I can sell all the stuff around you, to shut you down that way.
I can鈥檛 shut down your bank accounts without actually applying to the courts and saying I鈥檓 the executor of your will. You鈥檇 list yourself as the executor 鈥� then you go to the bank with your death certificate, fake will created online, petition of probate, Social Security Number, stuff like that.

听

Passcode: This seems to add a new dimension to identity theft. There are troves of Social Security Numbers are floating around 鈥� take the Anthem health insurance company breach, for example, that exposed personal information on as many as 80 million people. With that information, could someone could just, well, legally 鈥渒ill鈥� them all and steal the money from their bank accounts? 听

Rock: Yes. And there are many ways to get Social Security numbers without hacking into a database. So getting them is no hurdle.

Passcode: How could this change the cyberespionage calculus? The Office of Personnel Management breach, for instance, exposed millions of government and former government workers鈥� personal records. One common theory is that a nation-state, or someone with an incentive to try to blackmail to expose state secrets, had to be behind it. But if another country used that information to legally kill key people in the US government, that would also really problematic, no?

Rock: Oh yeah. A lot of people say to me, 鈥淭his is probably mischievous to release this sort of information.鈥� But we鈥檙e in the middle of cyberwars. And if the Chinese get this concept or idea, not only can they register deaths, or register births 鈥� which we鈥檒l get to later 鈥� they can also look at records themselves. It鈥檚 a system you don鈥檛 really want them looking at. So it鈥檚 better off protecting it now.

I鈥檝e looked at all the Western countries, and they all have the same problem. And if an idiot like me thought of it....

笔补蝉蝉肠辞诲别:听Who else might take advantage of this besides other countries?

Rock: You鈥檙e under subpoena. You can kill your subpoenaing officer. You kill your judge. You kill your [Internal Revenue Service] tax agent. You kill all these people who are after you to slow them down.

You and I both know, if you鈥檝e been a victim of social identity theft, you鈥檝e got a lot of work to get your identity back. And if you鈥檙e dead, that鈥檚 even worse.

笔补蝉蝉肠辞诲别:听Election season is coming up 鈥撎齧aybe you target a politician you don鈥檛 like? Could this be a totally different kind of digital hacktivism?

Rock: Can you be a dead president? Can you register as being dead? No one is safe.听And by killing you and taking your money, you鈥檙e the walking dead now.

笔补蝉蝉肠辞诲别:听That would be 鈥� annoying.

Rock: Yes, but not just annoying. The law doesn鈥檛 look after people like you.

笔补蝉蝉肠辞诲别:听Because they鈥檙e zombies?

Rock: Exactly. There was a guy . He skipped out on his family and his wife declared him dead so she could move on.

He then came back to the hometown years later and said, 鈥淚鈥檓 not dead.鈥�

The judge said, 鈥淲e have a statute of limitations. Once you鈥檝e been declared dead, and three years have passed, that鈥檚 it. I can鈥檛 bring you back to life. So I know you鈥檙e in front of me now, but you鈥檙e dead.鈥�

He鈥檚 now the walking dead. 听We talk about being stateless 鈥� but he鈥檚 body-less.

Passcode: So presumably people who are dead have no Social Security Number. Can鈥檛 get a driver鈥檚 license. Can鈥檛 travel anywhere. Probably can鈥檛 get a job. What鈥檚 the recourse for this?

Rock: I鈥檝e actually written a book about this in great detail to get around that, [" that's out this week]. The law says if you鈥檝e been misappropriated, you can actually take that to the Supreme Court to get that reversed. I got a lawyer in each of the countries 鈥� to walk me through what you鈥檇 need to do in each of the countries to bring you back to life. 听

Passcode: Yes, speaking of life: The other half of your talk 鈥� and subject of your book, too 鈥� is birth. Let鈥檚 talk about baby making.

Rock: Once I went through the death process, I wondered about the birth process. I鈥檝e got four children myself. Two were born in hospitals; two were home births. So I鈥檝e seen the process firsthand.

The doctor fills out part of the form; parents fill out the other part of the form. That goes into the registrar, and a birth certificate is issued. It鈥檚 a no brainer.

In Australia, and Canada, and in the US, [this process] is going online. It's called EBR, electronic birth registration. The parents and the doctor can put the details into the database to say, 鈥淭his is a new birth.鈥� You say what hospital, what license numbers 鈥� basically, the same license details of the doctors you can get from the database. So you can pretend to be the doctor or the midwife and register a virtual person.

Passcode: So after that, you just list a date, time, and hospital 鈥� and note that the baby weighs 8 pounds 鈥� and you have a fake birth certificate? It鈥檚 that easy?

搁辞肠办:听There鈥檚 a reason for that. Because people are not registering their babies. Where I鈥檓 from, in Victoria, some 2.5 percent of people don鈥檛 register their babies 鈥� people under drug or alcohol influence or Aboriginal [Australians]. So people even can retroactively get birth certificates for their children at age five.

Passcode: But what would be the point of this? It鈥檚 not like newborns have bank accounts.

Rock: I thought, 鈥淲hy can鈥檛 I birth a virtual person, wait 18 years, then kill that person off for life insurance?鈥�

You know what a shelf company is? A shelf company takes it a little bit further, where you actually pay taxes, look like you have staff members, [and can] build up financial characteristics used for money laundering and terrorist financing.

So I thought, 鈥淲hy can鈥檛 I make a shelf baby?鈥� It sits on the shelf, has social media profiles, looks like it鈥檚 a real person, but doesn鈥檛 exist. And when they鈥檙e 18, give them a virtual job but that鈥檚 really is for money laundering 鈥� then start doing things like life insurance fraud but also more advanced functions like share trading.

Let鈥檚 say you鈥檝e got two virtual people. One bets the US [dollar] is going to go up, one鈥檚 going to bet the Euro goes down. The one that wins, takes the profit. The one that loses, you just put into bankruptcy and put on the shelf. Because you don鈥檛 care. It takes the risk out of currency trading.

Passcode: So you could give birth to like, 1000 babies tomorrow, wait 18 years and be super rich?

Rock: Correct. Or have one 鈥� have multiple life insurance policies 鈥� and just knock him off using the death process.

Not only that, but there鈥檚 an anonymity aspect to it, too. You want to import drugs, firearms, whatever? Don鈥檛 use your ID. Use a virtual person鈥檚 ID.

A shelf company is a great asset for people who want to hide their identity. Having a virtual run a shelf company is an extra layer to prevent [law enforcement] from piecing together your true identity.

Passcode: And if this is a new identity altogether, it seems like that鈥檚 pretty hard for law enforcement to detect 鈥� maybe even a more difficult to trace crime than identity theft. People might even sell a fake baby鈥檚 identity on the black market.

Rock: You鈥檙e not stealing someone鈥檚 identity. This is a new identity; so there鈥檚 also no victim to say, 鈥淥h, my money鈥檚 gone down in my bank account,鈥� or, 鈥渟omeone鈥檚 using my medical insurance to claim for cancer treatment.鈥�

The government is making birth certificates harder to get for identity theft. They鈥檒l put holograms and things like that to make it a stronger document. Which actually suits the virtual babies even better 鈥� because having a stronger virtual birth certificate makes it stronger for criminals.

Passcode: Your talk at DEF CON was advertised with the idea that people should come if they want to get rid of their partner, boss, or arch nemesis. Are you worried about a lot of people suddenly 鈥渄ying鈥� tomorrow? 听

Rock: First of all, if you鈥檙e going to complete this task it鈥檚 illegal already. You鈥檙e committing fraud on both the doctor part and the funeral director part. Crime on crimes.

笔补蝉蝉肠辞诲别:听Has anyone from the government talked to you?

Rock: I鈥檝e kept my mouth shut until this speech. So I haven鈥檛 talked to media. Because I thought my speech could probably get cut.

Passcode: But why not just skip the talk and go straight to the source for a fix?

Rock: If it was an Australian-based system with a problem, I would just contact the Australian government and say, 鈥淗ere鈥檚 the problem.鈥�

But it鈥檚 not. It鈥檚 a worldwide problem. Everyone鈥檚 suffering from the same thing. Everyone wants centralized data records, and accurate records, and so they鈥檝e just gone, 鈥淟et鈥檚 skip the security and go straight to making it easier for doctors.鈥�

Passcode: So once everybody knows about this 鈥� what do you hope to happen?

Rock: The government first needs to look at it. If you鈥檙e going to unroll a system this large to doctors and funeral directors, you actually have to put some security controls around it. The message is: Before you roll something out, have some penetration testers look at it first.

I hope they shut down DIY registration for doctors and funeral directors. And I hope they have licensing requirements for funeral directors. I know the funeral industry will back exactly what I鈥檓 saying, because they鈥檙e trying to get a professional industry for body disposal 鈥� to clean up that industry and have licensing for all countries.

Passcode: What about just better verification?

Rock: A phone call would have been nice.

听