Passport Leak

Image: Unsplash

The data behind every passport and ID card has been leaked. No one accepts them as valid ID anymore without question. “You'd like to open a bank account? Please come in to our office.”

For this blog I can still draw on notes I took earlier this year during Security (b)log LIVE, during our internal ‘Love for Your Profession’ week. The scenario above was sketched out there too. I sometimes say I get paid to think up doom scenarios – but you all contribute your fair share too…

Let's see whether this is actually a realistic scenario. The Netherlands has the Basisregistratie Personen (the Personal Records Database, kept per municipality). A copy of that data goes to the Rijksdienst voor Identiteitsgegevens (RvIG, the national Identity Data Agency). So yes, all the data you need to produce a passport sits in one place.

That data is included in the passport in two ways: optically and digitally. The first is what you see and can read; the second sits on a chip embedded in the document. That digital data is digitally signed by the government. That guarantees authenticity and means the data can't be altered without it being noticed.

Whether the leaked passport data can actually be used for identity fraud depends on the purpose. A criminal with the right resources and enough dedication will undoubtedly manage to produce a document convincing enough to, say, rent a car – especially if a scan of the original document has also leaked. Checks for that kind of application tend to be fairly superficial: no one looks at the security features of the document.

For more serious applications, such as opening a bank account online, the data on the chip is checked. That happens via Near Field Communication (NFC). The bank's app reads the chip directly when you hold your phone against the document. As the name NFC suggests, this only works over a (very) short distance. As mentioned, the data on the chip is digitally signed. A forged chip lacks that signature, so the document fails the check. That effectively debunks the scenario sketched above. But there is still “room” for abuse wherever checks rely on the naked eye alone.

Could you board a plane with such a forged document? That depends on where you're headed. Within most of Europe (the Schengen countries) you don't pass through passport control at all; for flights outside that area, the Royal Marechaussee (the Dutch military police responsible for border control) does check every traveller's passport. They do that with their own eyes, backed up by an optical scanner that reads the two lines of text at the bottom of the document and checks the security features. If you go through an automated gate instead of a desk, the chip gets read, and the gates also use facial recognition. The odds of someone slipping through with a fake Dutch passport are probably not that high.

After that you reach the gate, where your boarding pass is scanned and ground staff give your travel document a quick glance. I suspect they're mainly checking whether the name on both documents matches and whether the photo looks enough like you. The odds of getting away with a forged document there seem considerably higher to me.

Would the Netherlands grind to a halt if the RvIG had a data breach? Probably not immediately, but it would cause a lot of hassle – both for (legitimate) passport holders and for the authorities doing the checking: the former group would feel distrusted, the latter would need to deploy extra capacity for more thorough checks. At least in places where correctly establishing someone's identity actually matters. Fortunately, they know that all too well over at the RvIG.

 

And in the big bad world…

• a similar leak recently took place in North America.
• banks aren't immune to cybercriminals either.
• you can, of course, also hack an oil tanker.
• police released the audio recording of the call between Odido and the hacker. ShinyHunters is having a laugh about it. [DUTCH]
• that voice recording has already yielded 120 tips. [DUTCH]
• Nigerian scammers get spiritual support.
• ChatGPT, Reddit and Roblox now fall under the Digital Services Act, meaning they must comply with EU rules on matters such as the spread of illegal content.

Leaky cruise

Image: Unsplash

They had just completed yet another cruise. This time too, they had managed to keep their feet dry, but as it turned out afterwards, there had been a leak after all. A data leak. And just like in the days of the Titanic, everyone acted as if nothing had happened.

They had not received a personal notification that their data had been exposed. They only found out by pure chance. In Europe, our first reaction is often to start waving the GDPR around indignantly: surely they have to tell me if my data has been leaked?! But it is not quite that simple. To begin with, the organisation responsible for the leak must determine for itself whether the incident has to be reported to the Dutch Data Protection Authority (AP). That is not required if “it is unlikely that the personal data breach will result in a risk to the rights and freedoms of data subjects”, as the AP explains. The leaked information did contain personal data (including that of my seafaring colleague), so they would probably not get away with that argument.

The next step is for the leaking party to notify the victims, and here comes the catch: only if the breach is likely to result in a high risk to them. Once again, the organisation must make that assessment itself, of course based on the GDPR rules. If personal data has been stolen by a hacker, the risk is fairly obvious, according to the AP.

And that is exactly the situation we are dealing with here. Last month, Carnival Corporation, the parent company of Carnival Cruise Line, sent letters to customers about a cybersecurity incident (though not to all customers, obviously). A month earlier, an attacker had gained access to Carnival’s IT systems through social engineering and copied customers’ personal data. The information involved includes names, email addresses, dates of birth, gender, and several Carnival-specific data elements.

Carnival Corporation’s headquarters are located in Miami. Aha, I can hear you thinking gloomily, that is well outside the EU, so that wonderful GDPR is of no use to me. Wrong! The GDPR has what lawyers like to call extraterritorial effect: if a company outside the EU also targets the European market, it falls under the GDPR. And when I add everything up, it seems to me that a personal notification to the affected individuals would indeed be appropriate here.

Unless... Yes, unless the data was encrypted, the breach was stopped before anything could be done with the data, or informing all victims would require a disproportionate effort on the part of the company, for example because it no longer has their contact details. In that last case, publishing a notice in a newspaper or on social media is sufficient.

In short: it is not as straightforward as it may seem. We do know how this particular case played out: it didn't. That is why my data-breached colleague asked me what you can do yourself in such a situation. The AP has put together a useful overview (in Dutch). Among other things, it states that you should change any leaked passwords; that is indeed the very first thing you should do. They also recommend changing the passwords for other accounts and apps if they use the same password as the compromised one.

This immediately shows why you should never reuse passwords: after a breach, it creates a lot of extra work. Criminals will simply take the password from website A and try it on websites B through Z. And of course, you should already have enabled multi-factor authentication wherever possible.

After a breach, you should also be extra alert to phishing attempts. Those phishing messages may be far more sophisticated than the run-of-the-mill phishing emails, because the attackers now have much more than just your email address. With all that additional information, they can make their messages look highly personal.

According to the AP, a criminal cannot do much with just a bank account number (IBAN) or a citizen service number (BSN) on its own. But be careful with combinations of data — a copy of your identity document can be a real game changer when it comes to identity fraud.

In summary: stay alert...

And in the big bad world ...

• your fashion data has been leaked as well.
• Google itself is responsible for AI summaries.
• cybercriminals love schools.
• everyone could view all ServiceNow customer data without a password.
• Fable is the toned-down version of Mythos, with very tight guardrails.
• the ban on the American acquisition of DigiD hoster Solvinity is a tough legal nut to crack. [DUTCH]
• the Dutch Tax Administration reported a data breach caused by the use of Adobe Analytics. [DUTCH]
• the new Dutch VAT system will not end up entirely in American hands after all. [DUTCH]
• with Vlam on board, civil servants are set to blaze. [DUTCH]

Telco hacked

Image from Unsplash

Most data breaches and hacks are the kind of inconveniences that happen to other people. This time, however, if you live in the Netherlands, there’s a good chance you’re staring rather glumly at an email from your telecom provider. After all, Odido controls roughly one third of the Dutch mobile market. On top of that, they provide fixed internet connections to a million households. And if you’re a Ben customer, you’re out of luck too.

The news is receiving wide coverage in the media. Understandable, given the scale: 6.2 million accounts were stolen from Odido’s customer contact system. Some of those accounts belonged to people who hadn’t been customers for years. Odido discovered this when these individuals responded, puzzled, to the notification email the company sent them. But the sheer size isn’t the only reason to be concerned. The kind of leaked information matters too. It wasn’t just the “usual” personal data such as name, address and email address. This hack also exposed phone numbers, bank account numbers, passport information, citizen service numbers, and even records of payment arrears.

Roughly two million records – containing nearly 700,000 unique email addresses – have already been published, because Odido didn’t comply with the demand from the criminals, who call themselves ShinyHunters, to pay “a low seven‑figure amount” (that’s at least one million euros). And they’re threatening to leak even more data. Plenty of reasons for millions of people to be worried.

Media coverage of the incident mostly focuses on sympathy for Odido and its customers. What you hear much less about is how this could have happened. I do understand that journalists focus on the victims. But still: how did this happen?

Phishing, ladies and gentlemen. In every presentation I emphasize again and again how important it is that everyone is resilient against this form of cybercrime. At Odido, that resilience failed this time. The phish reached customer service employees (possibly at a call centre abroad), who fell for it and handed over their passwords. Even two‑factor authentication (2FA) wasn’t an obstacle: the criminals called the employees, pretended to be colleagues from IT, and obtained the second factor as well. ShinyHunters executed an impressive piece of social engineering here: they didn’t hack the computer system – they hacked the computer users.

They then proceeded to download data. A lot of data. There should have been an automatic emergency brake for that. It should never be possible for a customer service account to download such vast quantities of information at once. It appears that there was no monitoring in place. If that’s true, it means not only the organisational measures (training) failed, but also the technical ones. You can hardly blame anyone for the failure of training; carefully crafted phishing emails are almost indistinguishable from the real thing. Oh, how I would love to see that phish. Employees handing over their 2FA, however, is something that deserves extra attention.

Odido itself is being notably tight‑lipped. I expected a statement on the homepage of their website, but only after some digging I found the “Information page Odido cyber incident”. First, there’s an extremely short official statement. Underneath, in giant letters, they advertise the free protection against phishing and other threats that they offer to their customers (one wonders if they use it themselves…?). Only then comes a detailed explanation of what happened, and some do’s and don’t’s. The bottom line: criminals with access to the leaked data can impersonate you and carry out all sorts of actions at your expense. So, in the coming period, keep a close eye on the invoices you receive and check your bank account for unfamiliar direct debits.

In the FAQ they raise the question of whether Odido’s security was adequate. But they don’t really answer it. Instead, we get the usual platitudes: safety is our top priority, we continuously work on improvements, but yes, criminals are very clever too.

Whether Odido was, after all, still clever in securing its assets – personnel included – will undoubtedly be investigated thoroughly. But whether we’ll ever get to hear the answer is another matter.

 

And in the big bad world…

…I was unfortunately too busy with other matters today to fill this section.