Before we can meaningfully classify threats in this way we need to elaborate on each of these categories.
Let's start with identity's spoofing
the pictures in the slide tell us two stories as you can see in the real world obtaining a false ID
is not a problem.
The picture shows a bazaar in Bangkok.
The competition in this business is strong.
The order is filled on the spot.
Going about the streets of Bangkok you can become a Harvard graduate a qualified diver or an airline
pilot.
Unusual requests are done within 30 minutes.
The picture below shows identity forging as it's done in the virtual world of the Internet.
This is a profile of someone claiming to be John Davidson.
An author of a blog and the user of a Linked In profile.
The thing is he's not John Davidson.
His name is Marcus Miree.
He used a fake identity to prove how easy it is to impersonate others on the Internet.
How can you fake your identity.
It's not only impersonating somebody else.
You can come across a spoof Web site that looks just like the real one.
Thanks to programs that can download a Web site as a whole.
It's not complicated.
The downloaded index HVM file contains the local version of the Web site.
If we then send the file to our own server we have an exact copy of the Web site that we can manage
all by ourselves.
In other ways to impersonate the victim's friends and emails.
Very often this is how spam messages get circulated.
Such messages are no longer general but highly personalized.
For example the subject may read.
Hi Martin and the signature could be.
Regards Caroline.
We can also try to deceive technological security solutions using stolen certificates
we've already mentioned that you can't completely trust technological solutions.
Internet certificates have been repeatedly stolen and used to send malicious software.
The national census of 2011 could have become an opportunity for identity spoofing.
You can take part in the census via internet to sign in.
You had to give your full name social security number ID or driver's license number.
Place of birth or your mother's maiden name.
The thing is that as we know such information is widely available on the Internet I.D. numbers and Social
Security numbers are easy to obtain if a person owns a business or as a business partner.
A full name is widely available.
The mother's maiden name is harder to find but sometimes you can find it in the social networking profile
all of this has made it very easy to impersonate someone's identity.
It's interesting though that you can't file a yearly tax return via the internet.
Even though there is no possibility to fake the data here if someone filled out the form using personal
data there's no way we would know that unless we weren't going to file a tax return that year.
The solution wasn't implemented in the case where it would have been safe but it was used in the case
where the risk was much greater.
All the greater because virtually anyone can change somebody else's password using the person's personal
data.
The Census application stored passwords as plaintext anyone could call the census call center give someone
else's personal data and the consultant would tell the password.
This is one of the direct threats connected to identity impersonation.
No one should have the chance to read your password.
Even the application that stores it very often we use the same password for many accounts and systems.
So when somebody obtains a password they can get access to many services such as email Klan's or computer
systems.