<story><title>No, I did not hack your MS Exchange server</title><url>https://krebsonsecurity.com/2021/03/no-i-did-not-hack-your-ms-exchange-server/</url></story><parent_chain><item><author>bonzini</author><text>The problem is that it&amp;#x27;s a username that is used as a password. In Europe you&amp;#x27;d use some kind of tax identification number &lt;i&gt;plus&lt;/i&gt; a physical copy of an ID card or driving license.&lt;p&gt;My identification number is algorithmically derived from place and date of birth, first and last name and gender. Anybody who knows my address and has heard someone greeting me happy birthday can guess mine with two-three trials corresponding to the closest hospitals. But that doesn&amp;#x27;t worry me, because I don&amp;#x27;t fear identity theft, it just doesn&amp;#x27;t exist in Italy.&lt;p&gt;Instead, as a result of America&amp;#x27;s allergy to ID, they are essentially the only country where identity theft is a thing.</text></item><item><author>BrandoElFollito</author><text>It always amazes me that in the US there is such a weak identification system, relying on a single number.&lt;p&gt;Then it is apparently to the owner of said number to worry if it leaked.</text></item><item><author>fotta</author><text>&amp;gt; What was the subdomain I X’d out of his message? Just my Social Security number. I’d been doxed via DNS.&lt;p&gt;That would freak me the fuck out wow.</text></item></parent_chain><comment><author>liversage</author><text>I live in Denmark so also Europe. Our social security number (which can be guessed with enough information and a few tries) has been incorrectly used as a password instead of a key just like you describe. You make a call, provide this number and the clerk on the phone believes that you are who you claim to be.&lt;p&gt;Nowadays things are better because computers are used everywhere We have a national ID system using 2FA which is pretty safe. Unfortunately, identify theft is still a thing.&lt;p&gt;Recently someone installed keyloggers on public computers. The second factor in the 2FA is a cardboard card with a list of one time password codes. You use a code on each sign in.&lt;p&gt;The criminals were able to determine when there were only a few codes left on the card. You then get a new cardboard card sent to your home address. They would stalk their victim&amp;#x27;s mail box and steal the new card as soon as it arrived.&lt;p&gt;With user name (your social security number) and password from the key logger together with the 2FA codes they were able to perform identity theft.&lt;p&gt;It&amp;#x27;s not easy to guard against attacks like this.</text></comment>
<story><title>No, I did not hack your MS Exchange server</title><url>https://krebsonsecurity.com/2021/03/no-i-did-not-hack-your-ms-exchange-server/</url></story><parent_chain><item><author>bonzini</author><text>The problem is that it&amp;#x27;s a username that is used as a password. In Europe you&amp;#x27;d use some kind of tax identification number &lt;i&gt;plus&lt;/i&gt; a physical copy of an ID card or driving license.&lt;p&gt;My identification number is algorithmically derived from place and date of birth, first and last name and gender. Anybody who knows my address and has heard someone greeting me happy birthday can guess mine with two-three trials corresponding to the closest hospitals. But that doesn&amp;#x27;t worry me, because I don&amp;#x27;t fear identity theft, it just doesn&amp;#x27;t exist in Italy.&lt;p&gt;Instead, as a result of America&amp;#x27;s allergy to ID, they are essentially the only country where identity theft is a thing.</text></item><item><author>BrandoElFollito</author><text>It always amazes me that in the US there is such a weak identification system, relying on a single number.&lt;p&gt;Then it is apparently to the owner of said number to worry if it leaked.</text></item><item><author>fotta</author><text>&amp;gt; What was the subdomain I X’d out of his message? Just my Social Security number. I’d been doxed via DNS.&lt;p&gt;That would freak me the fuck out wow.</text></item></parent_chain><comment><author>toyg</author><text>&lt;i&gt;&amp;gt; identity theft [...] just doesn’t exist in Italy&lt;/i&gt;&lt;p&gt;Big lol. The country used to be famous for frauds and scams! &lt;i&gt;Of course&lt;/i&gt; identity fraud exists, but precisely &lt;i&gt;because&lt;/i&gt; everyone expects it, the majority of  systems errs on the side of caution and requires validation from multiple sources. The result is that fraud processes become so much harder to pull off that fewer and fewer bad guys attempt it, but on the other hand every validation step becomes a bureaucratic nightmare (“did you include certificate X from office A, Y from office B, and Z from office C, as well as your ID card, health card, tax card, and recent pictures? No? Sorry, no cookie for you.”)&lt;p&gt;This is also why the country has a pretty secure and advanced way to carry out official acts electronically (PEC) - because otherwise fraud would be even more rampant.&lt;p&gt;I do agree that the “anglo” hate for ID documents (“such Napoleonic constructs, so barbaric!”) leaves the door open to scammers, but it’s not like they don’t exist in Italy too.</text></comment>