Srsly Risky Biz: America's Drivers Licence Breach is a National Security Disaster

Your weekly dose of Seriously Risky Business news is written by Tom Uren and edited by Amberleigh Jack. This week's edition is sponsored by Authentik.

You can hear a podcast discussion of this newsletter by searching for "Risky Business News" in your podcatcher or subscribing via this RSS feed.

Last week, Krebs On Security broke the story of a newly launched dark web service calling itself Nexus that was selling access to identity documents, including 153 million drivers licences from US and Canadian citizens. This is a huge breach that will not only be used for run-of-the-mill cybercrime, but will also feed the intelligence machines of America's adversaries.

Nexus claimed, in a cybercrime forum post, that it had access to a major identity verification company and had spent more than a year "continuously" exfiltrating new data into a private database. Krebs On Security noted in a single day the number of licences in the database increased by nearly 400,000, suggesting regular ingestion of new data.

Krebs On Security was able to verify that the drivers licences held by the service were genuine. In addition to his own, it contained licences from nine of his friends and family members. Secretary of War Pete Hegseth, an assistant director at the FBI and other high-ranking US government officials also had licences in the mix.

Based on a variety of circumstantial evidence, Krebs linked the incident to identity verification service IDScan. The service's website says it helps to reduce fraud by confirming that an ID is authentic and being presented by its legitimate owner and by detecting fraudulent documents. 

The FBI is looking into the incident and IDScan has confirmed it is investigating a data breach. The Nexus service also disappeared from the dark web shortly after Krebs published his story, although the people responsible do not claim to have deleted the data. Presumably they are laying low till the publicity dies down.  

Licences and identity documents can be used to facilitate identity theft and phishing attacks, but because the data can be used to inform intelligence operations, an incident like this also has national security implications. 

For the intelligence world licences are particularly valuable because they're key identity documents and licence numbers are often used in other databases. These databases, whether hacked or purchased, become much more valuable when records can be linked directly to a particular person with home address and photo included. 

And it's not a theoretical threat.

In the mid-2010s, Chinese cyber espionage actors stole complementary data from a variety of sources that, together, would be useful for analysing the US intelligence apparatus. Various Chinese APT groups stole information from the health insurance company Anthem, credit reporting company Equifax, Marriott hotels, United Airlines and, perhaps most significantly, security clearance information from the Office of Personnel Management. 

The US intelligence community is certain that stolen data was used to counter American intelligence efforts against China, as described in this series of Foreign Policy articles by Zach Dorfman. 

Of course, China itself isn't known for releasing detailed reports describing how it exploits its stolen data, but investigative research outfit Bellingcat has shown exactly how similar data can be used to uncover covert government activity.

In 2022 a hacked database provided a key piece of travel information that helped Bellingcat identify a deep cover GRU agent (Russian military intelligence) trying to infiltrate a NATO command post in Naples, Italy. And in another striking example these three Bellingcat reports from 2018 identified suspects in the attempted assasination of Sergei Skripal with the Novichok nerve agent. 

Clearly, leaked and hacked databases are incredibly useful for Bellingcat's Russia-related investigations. In 2020 it said it had "acquired dozens of leaked databases over the past few years, giving us a large number of data points to cross-reference and verify any new data we acquire". 

If a small investigative outfit is hoovering up Russian data when it is leaked, you can bet your bottom yuan that China's intelligence services are doing the same for any American data that pops up.

The IDScan breach is big. The number of US licences in the database is roughly 63 percent of the country's total licences. But breaches from identity verification companies occur depressingly frequently. In the last two years breaches have occurred at AU10TIX, Discord's age verification service provider 5CA, and at National Public Data. 

Identity verification services are necessary to help to prevent fraud, but are also a point of vulnerability when security is poorly done. The sheer volume of sensitive data these services handle means that they should be subject to strict regulation and oversight.

We're realists here at Seriously Risky Business, though, and recognise that there is no chance of swift government action. In the short term, we can only hope that significant financial consequences will help encourage these firms to shore up their security. Law firms are already lining up class action suits against IDScan, but a little federal government attention from the FTC wouldn't go astray either. 

The US Military's Ad Tracking Fig Leaf

Back in June Reuters reported that commercial location data was being used to target US military personnel in the Middle East. At the time we wrote that the Department of Defence's (DoD) existing policies regarding the issue, which already included disabling advertising identifiers on military-owned devices, did "not fill us with confidence". They simply weren't comprehensive enough.

It turns out that these policies weren't even being well implemented. 

This week, Reuters reported that some branches of the US military have finally gotten around to disabling some advertising identifiers on military-owned devices. 

The Air Force said it disabled Windows and Android advertising identifiers in late July, although they were already disabled on Apple devices. The Army told Reuters it disabled advertising identifiers on Android and Apple devices by default in February. And US Special Operations Command said that identifiers on Windows computers were "recently" disabled.  

Turning off these advertising identifiers is a fundamental mitigation that should have been implemented years ago. The US military was first briefed in 2016 about the potential for commercial location data to be used to track its people to sensitive locations. In a striking 2018 example, an Australian twitter user pointed out that Strava's global heat map could be used to identify US military bases and even servicepeople's jogging routes. 

Disabling advertising identifiers on military devices is also an incomplete solution. It makes it harder to track them, but not impossible. And as it happens, many US service people also use personal devices. Having a locked down work phone is step one, but having good policies for personal devices is equally important. 

Disabling advertising identifiers by default is the simplest short-term measure that might improve OPSEC, but it is impossible to know if it will make much of a difference without assessing the US military's OPSEC posture holistically. Does disabling advertising identifiers on government devices reduce risk to an acceptable level? Probably not. 

It's good that the US military is finally disabling advertising identifiers by default. But we’re concerned the military has no idea how effective it will be. 

"White Hats" Are Kidding Themselves

Over the weekend self-proclaimed white-hat hackers stole USD$320 million worth of Bitcoin stolen from the Liquid Network cryptocurrency platform. By Wednesday the hackers had returned 85% of the funds, but kept around $47 million. 

In recent years there has been a regular drumbeat of steal-first-claim-reward-later hacks. We begrudgingly categorise several of these as successes as the perpetrators have not (yet) been arrested or jailed. 

In 2021 a hacker stole USD$610 million worth of cryptocurrency from Poly Network. This was eventually returned in full, minus the  company's offer of $500,000 for the attacker it referred to as Mr White Hat. 

Hacks of Multichain (2022), Huobi (2023) and Tender.fi (2023) had similar outcomes: millions were stolen and returned, with the hackers  taking a cut of tens or hundreds of thousands in cryptocurrency as a "reward" or "bug bounty".

The standout example is the 2022 hack of Mango Markets, in which a hacker extracted $USD110 million from the decentralised exchange. The individual responsible, Avraham Eisenberg, described his actions at the time as a "highly profitable trading strategy". He claimed all his actions were legal and he used the protocol as designed, "even if the development team did not fully anticipate all the consequences of setting parameters the way they are".  

Eisenberg returned $67 million to Mango Markets to recapitalise it, and the Mango community voted to give him a cool $47 million for his time. Eisenberg was convicted of fraud in a 2024 jury trial, but those convictions were overturned by a US judge last year. 

In our view, the perpetrators of these hacks are deceiving themselves. By returning most of the money, they're deluding themselves into thinking they're acting responsibly. As for consequences, the law won't chase me down if I return the majority and the victim says it's fine… right? 

In Eisenberg's case, it did turn out to be right. But the FBI has been clear that victims cannot guarantee that perpetrators will not be prosecuted. 

One wrinkle in the Liquid Network case is, as far as we can tell, the company never agreed to allow the hacker to keep a 15% cut.

It feels possible that this self-proclaimed good guy might have to spend some of that $47 million on a good lawyer.

Watch James Wilson and Tom Uren discuss this edition of the newsletter:

Three Reasons to Be Cheerful This Week:

1. More options for trusted defenders: Last week Google launched Fairwind Program, its version of equivalent Anthropic's Project Glasswing and OpenAI's Trusted Access initiatives to limit more advanced AI cyber capabilities to vetted cyber defenders. On the same day it launched Gemini 3.8 Flash Cyber, a cyber specific version of its latest model that will be available through its Fairwind Program. Google says the model delivers "frontier-level" performance in vulnerability detection and patching, but is far cheaper than competitor models.  
2. Sality botnet takedown: Last week the US Department of Justice and Europol announced that an international operation had disrupted the Sality botnet. The botnet was first detected way back in 2003 and its peer-to-peer architecture meant there was no single point of failure that authorities could attack. CrowdStrike's blog on the takedown says that for the past eight years the botnet's primary payload, known as EggJagger, monitored the compromised host's clipboard for cryptocurrency wallet addresses and replaced them with addresses controlled by the malware operator. 
3. US, UK to collaborate on scam networks: British and American authorities have signed a Memorandum of Understanding to collaborate on efforts to tackle scam compounds. 

Sponsor Section

In this Risky Business sponsor interview, James Wilson chats with Authentik Security CEO Fletcher Heisler about how AI is driving a need for privileged access management to adapt.

Risky Biz Talks

You can find the audio edition of this newsletter and other fine podcasts and interviews in the Risky Biz News feed (RSS, iTunes or Spotify).  

In our last "Between Two Nerds" discussion Tom Uren and The Grugq 

Or watch it on YouTube!

From Risky Bulletin:

Ukraine's top prosecutor resigns amid scam call center scandal: Ukraine's top prosecutor Ruslan Kravchenko resigned on Monday over allegations that individuals in his office were taking bribes to protect scam call centers operating across the country.

His resignation comes after investigators from Ukraine's main anti-corruption body, the National Anti-Corruption Bureau (NABU), arrested Serhiy Kropyva, the Deputy Head of the Department of International Cooperation, a top lieutenant in Kravchenko's Office of the Prosecutor General.

In a report last week, NABU claimed it uncovered a major scheme in Kravchenko's office, where one of his department heads was taking bribes to look the other way when it came to a network of call centers that was calling Ukrainians and foreigners and luring them into fake investment platforms that stole their money.

[more on Risky Bulletin]

BEC campaign steals €35 million from French notaries: Hackers have stolen more than €35 million from French notaries in a massive campaign over the past four years.

The attackers breached companies via phishing, took over their networks, and slowly and silently modified transaction details to hijack wired payments.

According to French newspaper Le Monde, the campaign hit more than 500 victims, or about 7% of all French notary offices, France's notary supervisory agency, the Conseil Supérieur du Notariat (CSN).

[more on Risky Bulletin]

Russia tells data centers to deploy drone defenses: The Russian government has instructed data center operators to deploy protections against drone strikes and other physical threats as part of a national effort to boost defenses at critical infrastructure organizations.

Companies that fail to follow the Kremlin's instructions risk having their operations put under the state's administration.

Russian President Vladimir Putin signed a presidential decree last month allowing the state to temporarily take over the operations of critical infrastructure operators who fail to protect against Ukrainian hacks and drone strikes, or take too long to repair damage.

[more on Risky Bulletin]