#AxisOfEasy 466: You Handed Over Your Licence At The Counter. Now 153 Million Scans Are For sale

0:00that they were selling these high-resolution scans of 153 million drivers license from people around Canada and the United States. We're gonna capture some high-profile individuals. And it did, we got the US Defense Secretary some high-ranking FBI officials, and even funny enough, perhaps himself, Ryan Krabs is included in that. So. You cannot convince me that when digital ID comes down like a hammer from God on the modern world, governments are not gonna point to exactly this kind of thing and say this was preventable. If I've... Land, nothing is safe. I don't know if you've been paying attention to the world around you, but basically everything from your face to your driver's license to depending on what kind of bidet you have even the contents of your turds are being data-minded and stolen and sold on the dark web. Even, it's not like, it's not like this is uncommon, but you know what is uncommon? That you find out your driver's license is on the dark web

1:01and you're also the voice of cybersecurity on the internet, Ryan Krabs. Like what a disaster this is. Can you imagine this? I think my understanding, like I don't know if you have this in your research. My understanding is he found out because someone used his driver's license as the example of what kind of data was available in the dark web posting. I don't know if that's true, but I've seen that a few places now. That's wild stuff. Yeah. Yeah, well, this driver license data breach stuff is nutty and, but before we go deep into this story, we got to first establish this information, how it was obtained, right? Because it's not like the driver's license information is readily available, but to figure out exactly what happened here. And a lot of people, a lot of people, willingly hand over their driver's license when they rent a hotel, when they rent a car, since you want to try to prove your identification,

2:02there's a lot of different, even when you're trying to get a package at a weed shop, you got to provide information who you are and then you're able to get it, right? So even when you use X, joy, when you verify an X, you got to provide some sort of identification. A lot of people use driver's license. Well, each time those driver's license is scanned into a system and it's done in many, many different systems out there. And the likelihood of this getting leaked out, it increases and it could end up on a dark web and some marketplace in dark web, just like this one. And we're not just talking about some scan from a phone or some crappy camera, these are high res scans that are on there. And so it all goes back to what was discovered a few days ago, August 31st. And Krebs, he broke the story about this new service that was available and the service was advertising itself on the Russian cyber crime forum called exploit. Great name. Good SEO, good SEO with that name.

3:03Yeah, it's right to the point, there's no beating around the bush. You know what it's about. And I can't believe they were able to get that. But either way, exploit was a name. And so they were claiming that the guys were named Nexus. And Nexus were saying that they were selling these high res, resolution scans of 153 million drivers license from people around Canada and the United States. And it's not just the information that's typically found in a driver's license. You know, like the name, the date of birth, how tall you are, your address, no, no. It goes down. It's the information that is available, it's damning information because it includes the image scans, right? And that is not just the front, but the back of the driver's license as well. And they're getting these infrared images and ultraviolet scans as well. So everything that's embedded in there is now available for them to do. So it doesn't end there, because that's pretty bad as it is. So in addition to this 153 million drivers license,

4:05the marketplace claims to host 10 million ID cards, 3 million travel documents like passports, half a million medical cards, and even state issued medical marijuana cards. That last one I made me laugh. But either way, I'm going to pour some maple syrups and this to give it a little bit of a Canadian flavor, because there's roughly 1.1 million Canadian licenses included in a data and around 470,000 of which comes from Ontario alone. So the largest chunk of this data are from Americans, right? There's over 140 million records belonging to people living over there in the land of the brave and the home of the free. And even with that, you have a large number of people, it's going to capture some high profile individuals. And it did. We got the US Defense Secretary, some high ranking FBI officials, and even funny enough, perhaps himself, Ryan Krabs is included in that. So now goes to question, how it is 153 million records of drivers license and whatnot end up

5:06in a Russian crime forum database. It's an interesting question. And apparently these guys, they've been doing this for some time, getting this information. They're claiming that they've been secretly taking data for quite some time, a body year, over a year, in fact. And getting it from, quote, a major identity verification company. OK. So they say that this company is servicing Fortune 500 firms out there. And they are still doing stuff to this day. They say, even now they're adding another 400,000 new drivers license scans every 24 hours. Now you do the math. Numbers do add up because 400,000 new scans every day translate to 120 million a year. So based on what they have 153 million, kind of adds up to me, if we believe what they're saying. So Krabs did some analysis. He was tag teaming with the privacy researcher, researchers, Zach Edwards, and Larry Baldwin.

6:08And they did some cross referencing here with the timestamps that were attached to the images. Well, Krabs looked at his own driver's license in a database. And it was kind of interesting because what do you say were six raw images? And they had timestamps when the images were taken. He did the math. It was like in June of this year. That was a time he took a flight to Vegas. And you know, you did some digesting here. It wasn't from the TSA people at the airport. He used this passport there. So the TSA folks or the airline folks, they weren't the ones that leaked this information. No, man, he went to Hertz. And he rented a car. And so by doing that, renting a car, you got to provide driver's license. You got to prove that you could drive. I get it. But you know what? Hertz or Hertz is people who they used to store this information there to problem out here. And so that, to me, is the smoking gun. Zach Edwards found his license also in a dump too. And his timestamp matched a Defcom trip to Vegas.

7:12But Edwards went to Vegas and he did a scan at something called Planet 13. And that's a cannabis store. And dude had to provide his information as driver's license and boom. So they also use the same place. Planet 13 Hertz, they use idscan.net. But also target uses them, FedEx uses them, Motorola, Caesar's entertainment. A lot of big companies use idscan.net. So there we have potentially who pulled the gun here, who pulled the trigger and the gun. And idscans, they provide identity verification for a bunch of different companies out there. They say they specialize in scanners, capturing standard, color scans alongside infrared and ultraviolet images to take IDs. This is stuff that's getting kind of scary to me. OK. So we have an information. We know that who would potentially release it. The people that were impacted, well, we have the assistant FBI director,

8:14sorry, the assistant director and FBI, his ID was in the dump as well. OK. Interesting. And when something happens to the general public, it sucks. They say, oh, we'll look into, we'll do something. But you know, nothing's really done. But when it happens to one of their own, when one of the FBI's higher-ups can have something done, they will leave no stone unturned before they figure out what the hell happened here. And they're doing it now. So the FBI Cyber Division and the New Orleans field office, they launched a formal and urgent investigation into IDSKAN.net. And once this news hit the airwaves, Joey, the nexus people that were selling this stuff, their storefront simply vanished from a dark web. It wasn't there. It was then behind a message, this service is no longer available. All right. So they say, and so just because the information is not available through the storefront, it doesn't mean it's not available online. It didn't vanish.

9:14It's still available. So those 153 million records, they are still there. So the breach, if you think about it, it's far more dangerous than just the run-in-a-mill text stuff that you get your password username and crap like that. This is stuff that has your name, your address, your height, your picture, all this stuff. So when you're talking about a password or credit card, you could change those things. To paint in a butt, I get it, but you could change it. But you can't change your information on your driver's license. You can't change your picture. Even though we hear people say that men could get pregnant. But in reality, you are what you are. So this information is there, and it's terrible if it lands in the wrong people's hands. And so if you go further, the driver's license is like one of the documents you use to get other things. You got your password, your birth certificate, driver's license. Those are very important documents. So when you have to open up, say, a bank account, when you have to get medication, if they get anything, the driver's license is a key document.

10:15Now when somebody gets access to that, like these goons that have access to these high-res scans, the front and the back, well, they could go to town. And you know what? They can open bank accounts, those spatial recognition for the crypto exchanges, Joy, they could kind of use some sort of AI to trick this stuff, right? Totally. Credit card companies, this is stuff that could be just nasty stuff in the end. I'm sorry if I'm rambling here, Joy. Feel free to interrupt me if I'm going too long. But anyways, this is just that side. I'm not even talking about the physical safety side. You now know where people live. You now know what they look like. They're residential address. Potentially where they've been, because they have the timestamps on when this information was dumped, when it was scanned. These licenses were scanned. So with that, you could have stalkers, domestic abusers, foreign adversaries, all these people could potentially take advantage of this information and screw things up. And you know, if you really want to go into the weeds, imagine the AI, the matching tools out there,

11:17we have, what are those things that, forget the name of it, those cameras that are flock. That's it. Flux, yeah. Right, now you have flock out there. That's information to be nab, and they can sort of use that with facial recognition. This stuff is game over, man. Like, there's a question then that goes, like, who's behind all this? Who would want to get this information? Well, could it be Russian actors, Russian government? But you think about it. If they did, why would they want to sell this? It makes no sense. They would keep this and hide it. Unless they're playing 4D chess, and then who would heck knows what's going on? But really, this just highlights all the tech that's available to potentially screw people up. They talk about these new laws, these online safety acts, and stuff like that that's kind of protect kids, age verification. But in the end, we're going to get rugged. Why? Because we provided our information, because we rented a car, or we wanted to buy some weed, or we wanted to pick something up at Best Buy, whatever it may be.

12:19So these companies like ID scan down that, they should be hung out upside down, and the proverbial, I'm not saying they should, proverbial is shot in the chest. But man, this stuff is nasty, man, nasty. Can you remember when we talked on this show about the Equifax leak? It was probably, I don't know, a year, two years ago, something like that. It's a big, big leak at the time, million or so records, maybe a few more. They were sued for about $500 million and settled that lawsuit for, I think, just under $550, or something like that, I can't remember what the exact number was. But when you think about what value your identity carries in the legal marketplace, that's about $3 a person. You're in tire livelihood. You mentioned there protecting you from potential stalkers, abusers, people who just don't like you. You and me are publicly on the internet saying, sometimes not so kind things about certain people.

13:21And I don't think it's ever dishonest or spiteful, but truth telling sometimes puts a target on your back as we know from, all sorts of recent events, Charlie Kirk, the United Health CEO, there's been enough of these events now where if somebody doesn't like you, the likelihood that they'll kill you and then also not be persecuted or prosecuted and received widespread public support is pretty significant. That's problem number one. Problem number two is this KYC thing that you mentioned there, which should really stand for kill your customer at this point because the French are giving away your ID, the crypto thieves, now these guys are giving away your ID to basically anybody who wants it on the dark web and you're hearing all these stories about like, flock cameras being abused by police officers who want to chase down their ex-girlfriends. Like you and your safety are not the concern of these people. Their concern is how can we track you?

14:21How can we trace you? How can we make sure that we milk every dollar from building a set of habits around your daily activities that we can target ads to you with or do other stuff with. This is gonna continue to get worse and worse. Now I might sort of hot theory on this and you mentioned it during your summary there in your comments, who's responsible? The who's responsible question is one question. But how about who's going to benefit from this? You cannot convince me that when digital ID comes down like a hammer from God on the modern world, governments are not gonna point to exactly this kind of thing and say this was preventable if everyone just had a digital ID card that you didn't have to put into a database that you didn't have to do whatever it was on your phone. We're working with device manufacturers. These are device manufacturers that you've trusted for decades at this point, right? Like everyone's had an iPhone for 15 years or a pixel for 15 years or whatever. Samsung Galaxy, I don't even know what model they're on now. But like these things are not new to people.

15:22And so if the technology that you already have can add a layer of security and prevent you from having to go through, for example, KYC processes with crypto exchanges or casinos or read shops, people are gonna, they're gonna embrace it. They are going to embrace it. They're gonna embrace every bit of this panopheicon that's gonna come down the pipeline. And it's gonna be on the back of stuff like this. ID scan trusted service gets hacked somehow because they're not thinking they're security seriously. And before you know it, you're on this road to digital ID and everyone loves it. And your scene is a sort of conspiracy. Why are you so anti? You're still using a plastic card. And then soon enough, Len, what is it? We actually don't accept plastic IDs at this establishment. We don't accept plastic IDs to get on this airplane. We don't accept plastic IDs to get pulled over by the police, whatever. This is gonna get harder and harder and harder. On the sort of broader surveillance angle,

16:25which will come down as a result of this. And this is sort of part of the surveillance regime. What is the thing we always hear about why we need more surveillance? What is- For your protection. For your protection. Lot of cameras are needed because there's too much crime. We need cell phone surveillance or police at the body cams on for your protection. I will just point out, okay? That I see videos of gangs of kids beating the piss out of all sorts of people every day on Twitter. Videos clear as day, 4K video. There's no arrest made. No criminal action taken against these guys. About a year ago, there was a crystal clear video of a deranged immigrant slashing the throat of a Ukrainian girl and I think South Carolina on a bus. Crystal clear. That guy went through a four month mental rehabilitation program or six month mental rehabilitation program. I think he's finishing up shortly. That video is clear as day. We've all seen the video or Charlie Kirk, okay?

17:27Getting shot in the neck. We've all seen video of Luigi Mangio and at this point. We've all seen video of all these guys. Video and surveillance is not the problem. The problem has never been that we don't know who's committing the crime. The problem has always been there are too many people operating too close to anonymously in the day-to-day life for the state's control to really be able to take hold. And you're seeing this more and more thanks to electronics, thanks to anti-surveillance tools. And honestly, thanks to I think just the freedom of information that's being passed on places like Twitter, places like this podcast where we talk a lot about dig googling your phone and anonymizing your data, VPNs, protecting your online prizes, protecting your online footprint, all this stuff that we take seriously. And you have to take it seriously. Because if you don't, the government will either pardon my French, they will either fuck it up or give it away and put you in danger. This is the only two possible outcomes. We've done this show now for four years, I think. Three years or four years, longer probably. How many times have we done a story

18:29about the government thwarting a KYC honeypot that prevented the violent criminal activity being directed toward people who are part of that data set, zero times, the answer's zero times. But boy, oh boy, have we done the opposite story? I mentioned one in France already. There's been multiple examples, hospitals, schools, car dealerships. You name it. Your information, everywhere that you give your information, just one more attack factor. And none of these people take your data as security seriously, none of them. Zero people do. If you don't take it seriously, man, you're asking for trouble at this point. You really gotta be careful with what you say and what you give, for sure. That's it, let's get out of here. My name is Joey, that's Len. If you like the video, make sure you drop us a thumbs up. YouTube loves two things, okay? Three things. They love when you watch the whole video, so thank you for me at this far. They love when you leave a like on the video and they love when you leave a comment. So say something in the comments and help us get to the top of the algo.

19:31accessiv easy dot com for this story and other stories from the week. You'll latest and greatest in data breaching and overreaching. Easy DNS dot com for all your registrar needs, CanadianBaconers dot com, see more of Len and I, and of course, ready dot CA. If you're maybe a little worried that someone's gonna show up at your front door with a wrench because you rented a car last year. That's all I got to say. Until next time, everybody, take care yourselves. Take care.