Telegram has become a hotbed of black and ash production after the illegal transaction of personal privacy started.
Original title: "human flesh" industry game: personal privacy transaction in outer net space
The E law of finance and economics
By wang yong & NBSP; Editor: zhang qiang & NBSP;
Personal information trafficking has formed a complete industrial chain, and has been from domestic to foreign cyberspace. In this space, a person's important privacy information almost completely exposed, identity card number, home address, car license number, mobile phone number, accommodation record, all "on the shelf" for sale.
On March 19, one after another weibo users sent a message saying that there was a suspected leakage of users' personal information, which showed that many people's mobile phone Numbers had been leaked, according to the weibo account you can query their mobile phone Numbers.
In response, weibo said publicly that the data breach should date back to the end of 2018. At that time, users used the interface related to weibo to upload their address books in batches through their mobile phones, match millions of account nicknames, and sell them together with information obtained from other channels.
However, the caijing reporters' in-depth investigation revealed that the leakage of weibo users' information is only the tip of the iceberg in the network of personal information trafficking. Personal information trafficking has formed a complete industrial chain, and has been from domestic to foreign cyberspace.
In this cyberspace, almost all of a person's important private information is exposed. Sellers are all "magic", identity card number, home address, license plate number, mobile phone number, and even hotel accommodation records, all "on the shelf" for sale.
And the black chain's trading system has been upgraded from using traditional online platforms and tools to new online technologies represented by new digital currencies such as bitcoin.
Extranet platforms and virtual currency payments make the whole transaction more hidden and difficult to trace.
According to the survey, everyone's private information may be a commodity for sale, which is not alarmist.
Industry experts told caijing that personal information leakage is usually due to hacking and other technical means, and insiders take advantage of their positions to steal and leak out. The agencies that store the data take various precautions, but there is still no guarantee that there will be no vulnerabilities.
Black grey industrial chain transfer
In response to the leak of weibo users' information, weibo said it has been providing a service to search the nicknames of its friends based on their phone Numbers in their address books, and users can use the service after authorization. However, weibo does not provide information such as the user's gender and id number, nor does it provide a service to search for mobile phone Numbers based on users' nicknames. The data breach in March had no impact on the service.
At the same time, the microblog side stressed that the information matched by this illegal call to the microblog interface is only the nickname of the microblog account, and does not involve other private data such as id card and password. At present, weibo has timely strengthened the security policy, and will continue to strengthen.
On March 24th, the Ministry of Industry and Information Technology said in a news release, the ministry of industry and information network security administration on March 21, has carried on the information to the relevant person in charge of sina weibo interview, ask its according to the network security law "telecom and Internet users' personal information protection sets" such as laws and regulations requirements, control the ministry and other four departments to formulate the App illegal use of personal information collection behavior cognizance method, further take effective measures to eliminate data security hidden danger.
Authorities and companies have taken separate steps to bring the leak to a halt.
But caijing's reporters followed the leak and found that it was just the tip of the iceberg in the vast black and gray market for buying and selling personal information.
Those black and grey producers who used to appear on domestic online platforms have switched to foreign online platforms represented by Telegram, forming a new industrial chain that is more hidden and harder to trace.
A number of insiders told caijing that in the early days, personal information traffickers generally used QQ, WeChat, tieba and other domestic network platforms, mainly using WeChat payment, alipay and other payment tools. However, as tencent, alibaba and other platform enterprises continue to intensify the crackdown on black ash production, the black ash industry in China's traditional platform has become difficult to stand.
Moreover, on the original domestic platform, there are both traffickers who actually sell personal information and fraudsters who use it as a cover. "There are a lot of people who advertise that there is a huge amount of accurate personal information of all kinds, and they pay a fee and they get blocked." People familiar with the matter said. As a result, the industrial chain began to move outward. The overseas software represented by Telegram was easy to use, and "safe" payment methods such as virtual currency were introduced. As a result, the personal information trafficking industry was gradually transferred to the external network platform and gradually expanded and stabilized.
From domestic to foreign, the payment method is more secure and the provision of information and services is more and more reliable, which is a new form after the industrial chain transfer.
"This leak of weibo users' information is indeed a long-standing incident, and it is not new to search for such information in a group." "The person told caijing.
Personal information
Since March 27, caijing journalists have logged on to Telegram's account and found the robot used to sell personal information. Through the robot interface, you can join a group. On March 28, the group showed a population of about 40,000, and has been growing ever since.
In the group, has all kinds of sellers to sell all kinds of personal information in a news release, covers the personal account, family account, phone number check machine Lord, name card, taobao, weibo the check and accept the goods address WeChat pegging, express a single number query shipping address, accommodation, travel records, and so on all kinds of personal information, almost everything.
Figuratively speaking, the bots on the Telegram platform are actually many sellers who have turned their personal information into an auto-searchable database. If someone wants to buy or search for information, they usually sponsor the robot using BTC (bitcoin) or ETH digital currency, which is equivalent to topping up. The minimum sponsorship is 320 RMB, which is equivalent to 260 points. The conversion rate between the points indicated in the group and the digital currency is approximately 0.358ETH=260 points.
According to the rule, 10 integral can do a common query, about equal to 10 yuan yuan can query. If you don't have bitcoin, there is a special recharge service in the group.
Caijing found five other similar groups on Telegram. The information sold and inquired by the group was almost the same as the above groups. The price of personal information sold in the group ranged from tens of yuan to tens of thousands of yuan, and the size of data involved was often several grams.
So where does all this personal information, which can be accessed for a fee, come from?
When caijing asked some of the sellers, they said,Information is "collected" from all over the Internet. The people said they believed that much of the information had been consolidated from previous leaks and that hackers would continue to steal it, making the database ever larger.
Caijing reporter through personal experience found that the specific transaction process is not complicated, find the robot, the buyer recharge to get points, can directly use the points for automatic query.
The caijing reporter bought some bitcoin and paid the robot for points. To test the accuracy of the information, the caijing reporter sent the robot the mobile phone Numbers of 10 close relatives and friends and paid 10 or 20 credits for a "bound query." the robot provided the query results in about three seconds. Of the 10 Numbers, nine had the correct owner's name. There is one number to find the exact WeChat account name and weibo account name, and another number to accurately find a friend used email password and home address.
In groups like Telegram, the phone owner information is just an entry-level query. The caijing reporter used the robot's "monster search" (fuzzy search) function to send him the name of a friend or relative, and the robot prompted him to choose a man, a woman and a province. After paying 100 points, he got nearly 30 id card Numbers with the same name as his friends and relatives, including friends and relatives of the reporter, and the id card number is accurate.
The person familiar with the matter said that the "demon hunt query" could be used in a "human flesh search" by simply providing the name of the person being "human flesh" to pinpoint the target step by step with different information.
In addition to searching and selling, caijing contacted some of the sellers in the group. Reporter to a seller to provide id number, said want to inquire about the id number of the accommodation information. Sellers say such information is sold in the form of a single packet, which can range from tens of thousands to millions of messages at prices ranging from hundreds to thousands of yuan.
The bigger the packet, the more accurate the information, the seller said. In a packet bought, caijing reporter through the id number query, really get several accurate accommodation information. However, the accommodation time is not up to date and is basically information before 2018.
Because the robot ACTS as a third party, the accuracy and reliability of the information obtained through the robot inquiry and purchase are strong, and there is no such situation as payment on traditional platforms is blocked by the seller. This is undoubtedly a "high quality" and reliable service for many buyers.
The people told caijing that the new way of selling has made it easier for black-ash operators to "do business" and that the information traffickers are hiding behind platforms, making it harder to trace their origins. At the same time, personal information traffickers have purchased a large number of black ash production of "four sets" - identity CARDS, bank CARDS, mobile phone Numbers, U shields, to withdraw cash.
To ensure security, the "four sets" are not the user's personal information, but from another group of professional black ash from there. Thus, personal information traffickers have not a single chain development, has developed into an industrial network.
At the same time, the information peddler takes advantage of the digital currency transaction feature, and can generate a separate address for each seller, so as to facilitate the "security" of the transaction and conceal the traces of the transaction.
After several days of investigation, as well as information provided by some people familiar with the situation, caijing journalists have a preliminary grasp of this black ash industry chain, upstream for some hackers as a representative of the technical staff, they through a variety of means to obtain massive data. Midstream is an information trafficker who buys data from upstream and sells it in groups.
Buyers buy data and information based on their needs. According to people familiar with the matter, there are three main groups of buyers:Online loan practitioners, to buy personal information used to recover loans from borrowers; Private investigators who purchase enquiry information for investigation business; There is also a part of retail investors do not have a specific purpose, the purchase, inquiry they want to a certain individual information as a psychological demand.
Why does Telegram become a hotbed of black ash?
Ironically, Telegram, an online platform where many private information is traded, was originally created to protect users' privacy.
Pavel durov made his first fortune in 2006 when he and his brother started VKontakte, Russia's largest social networking site. Since then, many rebels have used VKontakte as a propaganda platform, which has led to complaints from the Russian government that the site should be censored.
In 2013, undeterred by government interference, the brothers left VKontakte for the United States, where they founded Telegram.
Simply put, Telegram is an encrypted social networking platform that provides such functions as secret chat, instant messaging and regular deletion of accounts.
At first, Telegram offered a feature that allowed users to upload phone Numbers to search for other users, allowing new users to quickly see if people in their phone's contacts were already using the software. The feature automatically matches the phone number with the user name in the group, and if law enforcement asks the local telecommunications service for the number's owner, they can find out the user's true identity.
Later, Telegram posted an update that allowed users to disable phone number matching. This makes it harder to lock in the identity of the user, thus enhancing privacy. Under such platform rules, Telegram's groups are freely accessible, but all user information is well hidden.
Telegram, by contrast, stresses that the two most important aspects of its privacy philosophy are protecting private conversations from prying eyes of third parties and protecting personal data from third parties.
Meeting users' expectation of the privacy concept, and providing safe and fast product experience, Telegram has developed rapidly. By August 2019, Telegram had more than 300 million users.
However, it is also because of such private features and the function of providing virtual currency transactions that a large number of illegal transactions have emerged in Telegram, including some arms and ammunition transactions, pornography industry transactions and even being used by terrorist organizations. It helps to understand why Telegram has become a haven for personal information traffickers.
Telegram was also involved in the recent "room N" incident that hit South Korea. The operators have set up live broadcast rooms and chat rooms on Telegram, coerced victims into taking photos and videos of rape and sexual abuse, and provided them to members for a fee. The two parties trade in virtual currency, and the chat content is regularly destroyed, making it difficult to collect evidence and track.
Telegram removed the illegal video at the request of south Korean police after the incident. In the end, however, police requests for personal information about the illegal video uploaders were not met.
Telegram was blocked in Russia in 2018 because it refused to accept government regulation in order to protect users' privacy. Several countries, including Iran, Indonesia and Pakistan, have banned Telegram.
The "human flesh" respondents
Lin tung, 29, has long been engaged in digital currency, network security and other businesses, familiar with these areas.
Around March 20, shortly after the release of the news of personal information leakage of weibo users, Lin tung immediately sneaked into the aforesaid Telegram group for public welfare purposes and observed the activity dynamics within the group.
Lin tung told caijing that he had already heard that the network black ash production from the domestic network platform to the foreign platform, this is not secret in the circle, just the general public has not been informed.
In the "latent" many days, and tried to trade with the seller, Lin tung will be published on his own series of this kind of situation on the media platform, very short time to get nearly 100,000 reading.
Lin tung continue to "lurk", he found a group called "Lin tung fans", he found after the group, he has been inside many sellers "human flesh". His name, telephone number, home address, work organization and other personal information was published accurately. Even the original picture of his identity card was posted. Someone also threatened to use phone, text message harassment software to his "indiscriminate bombing", completely "waste" him.
In the face of such retaliation, Lin tung did not choose silence, will be themselves "human flesh" continue to publish in the media, and according to their own Internet security experience, the general public in the use of the Internet, can take some measures to protect their personal information. For example,Minimize the use of the same password or password keywords; Use the strong password management tool to open the account for the second verification; Sign up for multiple mailboxes, sometimes one time, etc.
Lin tung told caijing that much of the personal information provided by the sellers in the Telegram group was used for "human flesh search". In these groups, the disclosure of real personal information is known as the "gateway". In Lin tung's view, the complete disclosure of their personal information, has meant that any individual may have lost their due privacy space.
Lin tung told caijing that since he has been "out", he is willing to use his own experience to these violations of personal information more widely known to the public. But one of the things he never understood was that the original photo of his identity card had also been leaked.
The caijing reporter noted in the above group that the members of the group responded very quickly to all kinds of reports revealing similar personal information trafficking. The reports were transferred to the group soon after publication, and the members of the group disapproved of the reports, published all kinds of taunts, and even claimed to be "human flesh" reporters.
Can the source of the leak be stopped?
Personal information leakage incidents have occurred frequently in recent years, has caused a nuisance to the general public, the most common is that many people often receive all kinds of precision marketing. Some of the more vicious incidents caused by telecom fraud cases have upset the public.
Many people have questions: how exactly was personal information leaked? Is there any way to prevent leaks?
He yanzhe, director of the censoring department at the principal security center of the China institute of electronics technology standardization, told caijing that personal information leaks in recent years generally come from three sources.First, "hackers" and other external forces attack the database, using technical means to steal the internal information; Second, the storage of mass data institutions, there are internal personnel using the system management authority to access the data after the outflow; Third, when using third-party online platforms, users submit their personal information to the platforms, but the protection measures of these platforms are not in place or the usage data is not stored as agreed, resulting in the disclosure.
In view of these three situations, in order to prevent data leakage, the organizations with large amounts of data should strengthen technical protection, formulate strict management system, and strictly guard against "internal ghosts". For the sake of data security, various agencies are also strengthening protection measures, but it is impossible to achieve complete vulnerability free in reality.
He told caijing that starting from 2019, the cac, the ministry of industry and information technology, the ministry of public security and the general administration of market regulation have jointly launched a campaign to protect App personal information, which has played a positive role in improving the protection level of App personal information. But as long as there is a "ghost", large-scale leakage immediately appear, can not be prevented.
Take hotel accommodation information for example, there have been several large-scale leaks in the past two years.
In August 2018, more than 500 million pieces of personal information were leaked by China living hotels group. Huazhong's hotel brands include hanting, mejue, orange, full season, ibis, etc., with thousands of stores.
In December 2018, international hotel giant marriott revealed that hundreds of millions of pieces of personal check-in and identity information had been compromised by hackers.
In late March 2020, marriott again announced that the data of about 5.2 million customers could be compromised. The reason for the leak is that someone may have used the log-in credentials of two employees at one of the group's franchised hotels to access a large number of customer information. Marriott found, has disabled the relevant login credentials, and notified the relevant departments to launch an investigation.
Search of the Chinese court documents network, sf express has occurred an internal staff leaked personal information case. This is a major case involving the disclosure of personal information in the express delivery industry in recent years.
According to a May 2018 judgment by the jingzhou intermediate court in hubei province, 11 sf express employees, including du liming and feng Dan, work for hebei sf express and jingzhou sf express, respectively.
Since 2015, du and feng have been seeking illegal profits by selling, providing and illegally obtaining the personal information of citizens in the express number and face number of sf express (that is, pictures containing the express number, address and telephone number of sf express) through WeChat, QQ and other software platforms. The case involved more than 10 million pieces of citizens' personal information, involving more than 2 million yuan. If converted into a single message, the price of each message is only about 0.2 yuan.
In addition to the hotel industry, the express industry, also hold a large amount of data some administrative staff also become personal information leakage "ghost."
In early April 2020, xiao, a former police officer from the fifth brigade of the criminal investigation branch of the hengyang public security bureau in hunan province, was sentenced to four and a half years in prison in his second trial. In March 2017, xiaomou found that selling citizens' personal information can make money, they began to take advantage of the position, selling personal information for profit.
Because xiaomou oneself digital certificate does not have advanced inquiry authority, he embezzled the digital certificate of colleague, through log on public security organization relevant information platform, the citizen census register information that will inquire to or track information sells. Xiao has sold personal information including household registration information, personal whereabouts of citizens track information, vehicle track information, accommodation information. The price he set was 300 yuan for each personal track information of citizens, 100 yuan for each vehicle track information and 100 yuan for each accommodation information.
In the process of trading, xiao had used domestic software for trading. For security reasons, he also USES some foreign software to communicate and trade. The court found that from March 2017 to December 2018, xiao stole citizens' personal information and sold it to others, with illegal gains totaling more than 1.8 million yuan.
It is precisely because of the country's crackdown on illegal activities such as information leakage and trafficking that black and grey practitioners have moved to foreign platforms such as Telegram to escape the crackdown.
As of press time, the participation of the Telegram group was still growing, and various personal information transactions were still active.
Source link:weixin.qq.com
Welcome to join the official BlockBeats community:
Telegram Subscription Group: https://t.me/theblockbeats
Telegram Discussion Group: https://t.me/BlockBeats_App
Official Twitter Account: https://twitter.com/BlockBeatsAsia
Related Articles
