Tech-Ex: Facebook and facial recognition can be used to hack your SSN
It’s been known since 2009 that the Social Security system has a huge security flaw: social security numbers are predictable if you know a person’s hometown and date of birth (it’s even used as a selling point by LifeLock). Now a new study by Carnegie Mellon University has determined that facial recognition software along with social media profile can be used in another end-run around the “randomness” of your social security number.
Alessandro Acquisti, the CMU professor who pointed out the 2009 security hole, headed up the team that found the new one. Acquisti’s research team, which included CMU postdoctoral fellows Ralph Gross and Fred Stutzman, used off-the-shelf facial recognition software (PittPatt, recently acquired by Google), cloud computing and publicly available information from social network sites to break through the security in social security.
The results of the study will be discussed in detail at Black Hat Security Conference in Las Vegas, later this week.
The key, it seems, is a searchable Facebook profile with a photo. If the profile from that profile had a person’s hometown and date of birth, they could then exploit the 2009 security hole, which relies on a change made by the Social Security Administration after 1987 that made it easier to predict SSNs.
In one test, the researchers used a set of data mined from Facebook, as well as PittPatt to search “anonymous singles” on a dating website. They were able to match 15 percent of the “singles.”
In a second test the researchers used a webcam to take photos of CMU students, and then asked the 93 who were participating in that part of the study to take an online survey. 42 percent of those participants were linked to their Facebook profiles.
Once again, with a link to their Facebook profile, given the hometown and date of birth information in their profile, the researchers could use the 2009 SSN security hole.
Acquisti and his team were able to predict the first five digits of a subject’s nine-digit Social Security numbers 27 percent of the time, in just four tries. “The chain of inferences comes from one single piece of anonymous information—somebody’s face.”
In addition, the CMU researchers built a smartphone application which demonstrated the ability to make the same personal “inferences” in real-time. The application uses online and offline data along with “augmented reality” technology to overlay personal and private information over the subject’s face on a device’s screen.
In a press release, Acquisti said, “Ultimately, all this access is going to force us to reconsider our notions of privacy. It may also affect how we interact with each other. Through natural evolution, human beings have evolved mechanisms to assign and manage trust in face-to-face interactions. Will we rely on our instincts or on our devices, when mobile phones can predict personal and sensitive information about a person?”
