Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

5/5/2014
11:00 AM
Lysa Myers
Lysa Myers
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

Defending Against Identity Theft In The Military

Our military troops are twice as likely to be victims of identity theft as the general population. The reason is in the structure of military culture.

People in the military knowingly agree to put their lives in danger when they enlist, but there’s something else they’re putting on the line that they have not agreed to risk. More people reporting identity theft are members of the military than of any other demographic in the US. While this is shocking, upon further analysis, it is not particularly surprising.

According to a 2013 Federal Trade Commission study, people in the military report identity thefts at twice the rate of the rest of the population. Why is it that their identities are at greater risk? The answer is in the structure of military culture itself.

Peril is all in a day’s work
Historically, the military has had a culture of identifying each soldier by an assigned service number as much as with a given name. Since 1974, this number has ceased to be a separate, assigned service number; it was changed to be the Social Security Number (SSN) by all branches of the military.

In 2008, the federal government acknowledged the danger of the overuse of SSNs for the civilian population, yet this practice is still very much in place for members of the military. It wasn’t until two years later that the government even acknowledged the issue for service members. While most people are becoming increasingly sensitive about the use of this identifier, in the military, people are still trained to give their SSNs in the course of daily life.

My own awareness of this culture began while researching the use of SSNs in the context of healthcare: Federal interactions are some of the last remaining places where SSNs are still required for identity verification. This means that people who are dependent on the government for employment or financial assistance are required to provide their SSNs, to people and on forms, much more frequently than the general population. 

And government ID is far from the only time military members are obligated to disclose parts of their SSNs: If they want to get their laundry done, or even check out sports equipment at the gym, it’s customary to offer up the last four digits of their SSNs like a sort of password or a membership number. This all leads to a culture of devaluing this identifier in the minds of service members, which is very much at odds with its value to cyber criminals.

The silver lining here is that use of the SSN as an ID number is slowly being phased out both in visible data on ID cards and on their magnetic stripes. But identification “dog” tags for various branches of the military still visibly display this data.

Extra criminal motivation
Aside from the ID theft buffet created by the rampant overuse of SSNs in military culture, cyber criminals also have an extra advantage to help them put the screws to service members: Having bad credit can
seriously limit soldiers' careers, whether it’s due to their own mistakes, predatory lenders, or ID fraud.

Criminals have historically viewed soldiers (especially those who are new, young, or about to deploy overseas) as "money delivery machines." Laws have been enacted to try to curb some of the more egregious instances of criminals taking advantage of soldiers, especially around so-called “payday loans.” But the unfortunate fact is, because creditors can report delinquent credit to commanding officers and put a soldier’s future career at risk, those creditors have more leverage to compel payment, regardless of how sketchy the terms of the loan are. Online loan scams in particular can be a big source of military identity theft.

In recent years, a number of sites have also sprung up offering “group ID verification”, for different groups with their own unique membership numbers, such as military members and students. It is common for these sites to offer deep discounts to these groups in exchange for their ID numbers. Those ID verification sites can frequently be a data grab, where criminals turn right around and use the data for ID theft and fraud.

Service members can protect themselves
While service members are at greater risk for identity theft, they also have extra means to protect themselves. In a document specific to military personnel, the FTC website has a number of great resources for how to tell if an ID has been stolen and what to do if it is. Note in particular that service members, when deployed, can make use of an “Active Duty Alert” that can help prevent unauthorized accounts from being created.

The single best thing service men and women can do to protect their credit is to regularly run a free credit check report. Beyond that, they should secure any documents or files that display their SSNs, and shred those documents they do not need to keep. While the system as it currently exists is imperfect, our military can still protect and defend individual identities.

Lysa Myers began her tenure in malware research labs in the weeks before the Melissa virus outbreak in 1999. She has watched both the malware landscape and the security technologies used to prevent threats from growing and changing dramatically. Because keeping up with all ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
LysaMyers
50%
50%
LysaMyers,
User Rank: Author
5/6/2014 | 1:28:09 PM
Re: Away from home.
I wasn't able to find any indication either way, aside from some online Military-focused articles. Maybe someone out there reading this has some more insight?
Randy Naramore
100%
0%
Randy Naramore,
User Rank: Ninja
5/5/2014 | 3:37:41 PM
Re: Away from home.
Agree totally, protecting our military servicemen and servicewomen's livelihood while they are deployed is the least we can do for all they do for us.
Robert McDougal
100%
0%
Robert McDougal,
User Rank: Ninja
5/5/2014 | 2:39:37 PM
Re: Away from home.
Do you happen to know what if any security awareness training is offered to our soldiers?  Personally, other than in your article, I have never heard of the "Active Duty" credit freeze.  If there isn't any training, on this all too important topic, offered to our soldiers then I am ashamed of our government.

 
LysaMyers
50%
50%
LysaMyers,
User Rank: Author
5/5/2014 | 12:40:30 PM
Re: Away from home.
With the "Active Duty" alert, they get something stronger to protect themselves, as it not just monitors but freezes credit. But right now, it's "opt-in" rather than "opt-out" and many service members may not know about the option at all. I heartily agree it would be beneficial to all of us if there was something stronger available to protect people in the military. At least more education and encouragement to use the options that are already out there.
Robert McDougal
100%
0%
Robert McDougal,
User Rank: Ninja
5/5/2014 | 11:54:28 AM
Away from home.
Another issue that makes it easier for a soldiers identity to be stolen is the fact that many of them are outside the country for months at a time.  During this time an attacker can use the soldiers identity to perform a large variety of fraud that could go undetected for months or even years.

As a result, I propose that the federal government enlist the services of credit monitoring services for our deployed service men and women.  I know this is a cost, but what is the cost of not protecting them when they are out of the country?
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-16275
PUBLISHED: 2020-08-10
A cross-site scripting (XSS) vulnerability in the Credential Manager component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link.
CVE-2020-16276
PUBLISHED: 2020-08-10
An SQL injection vulnerability in the Assets component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, authenticated attacker to gain unauthorized access to the database.
CVE-2020-16277
PUBLISHED: 2020-08-10
An SQL injection vulnerability in the Analytics component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, authenticated attacker to gain unauthorized access to the database.
CVE-2020-16278
PUBLISHED: 2020-08-10
A cross-site scripting (XSS) vulnerability in the Permissions component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link.
CVE-2020-15139
PUBLISHED: 2020-08-10
In MyBB before version 1.8.24, the custom MyCode (BBCode) for the visual editor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. The weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as a post or Private Mes...