Will’s Web

Perhaps you’ve seen some likely victims already, but haven’t really paid much attention or even registered the fact because you’re not looking for them. Some businesses are much more susceptible to identitiy theft than others and it doesn’t take a genuis hacker to glean off more than enough information to make a social engineering attack seem much more likely to succeed.

Yes, you may have hardened locks, bullet-proof glass, CCTV, ninja guards, savage dogs or killer bees for protection from the bad element, but what protection do you have in place when it comes to disclosure policies in the workplace or even the home?

Depending on what circles you go around in, you might see regular occurrences of people opening themselves just wide enough for someone to apply some leverage. A prime example of victims in the waiting are Internet marketers who often emblazen their signatures on their websites for all to see as a symbolic gesture of endorsing one’s belief in the punted product and/or service.

If you’ve ever tried to register a domain name then you’ll probably already be aware of the WHOIS service. This is query that you can perform against any domain name in order to find out who is the legal registrant, their address, telephone numbers and email address. Did I mention that this service is freely accessible from countless websites? You can even run desktop applications that will perform WHOIS queries or install freely available scripts onto your website to do the same.

The point is that this information is easily accessible unless measures are taken to hide the registrant; e.g. Nominet, the registry for .uk domain names offers the ability to hide information about the registrant of a domain when a WHOIS enquery is executed against a .uk domain. Some domain registrars also provide a privacy service whereby they will hide the actual registration information by replacing it with their own. As the registrant, you could simply use false information to register your domain, but that just wouldn’t be right would it…

So, back to Internet marketers and their habit of signing their websites. Combine a true-to-life image of someone’s signature and combine it with their name, address, telephone/fax numbers, email addresses (perhaps even more if you’ve access to their personal blogs) and you’ve got yourself a recipe for identity theft. You can almost picture it like an epsiode of CSI!