Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
How Underground Groups Use Stolen Identities and Deepfakes (trendmicro.com)
110 points by rntn on Sept 28, 2022 | hide | past | favorite | 56 comments


This is one of the "new" ways that stolen identities are used.

About a decade ago, there were a number of raids by Immigration on meat packing plants across the Midwestern US. What kicked the raids off was when one Hispanic woman who worked at Immigration was being dinged by the IRS for not paying some $160k in delinquent taxes. Upon investigation, it turned out that her name & SSN were being used simultaneously by more than 50 different workers in the meatpacking industry.

Several newspapers in the Denver metro area reported on the raids. Some of the raids happened in Greeley [0]. I remember one of the papers reporting that the only signs in English in the entire plant were the emergency Exit signs over doors. Also mentioned in the papers were that a valid name & SSN combination was worth about $50 if the name was Hispanic, and about $5 otherwise. Some of the name & SSN combinations were used simultaneously more than 100 times, with some repeats being at the same employer simultaneously. Several of the companies raided by Immigration knew that the workers were in the country illegally but didn't care as long as the name & SSN combo made it through some verification process [1].

Notes: 0 - Greeley is about 60 miles north of Denver. When the wind is "right", one can smell the feedlots. Normally, when you drive out of the mountains, you can see a huge brown cloud floating over the Denver metro area. When the wind is "right", you can see a sharp termination of that cloud. The chemicals in the cloud (mostly nitrates and nitrites from exhaust) react with the chemicals from the feedlots (mostly ammonia from cow urine & feces) to form ammonium nitrate (frequently used in fertilizer & explosives) to precipitate out of the air (leaving clear sky).

1 - This clip from Hogan's Heroes displays the willful ignorance. https://www.youtube.com/watch?v=HblPucwN-m0


> Upon investigation, it turned out that her name & SSN were being used simultaneously by more than 50 different workers in the meatpacking industry.

How the fark does the IRS not notice when a single SSN gets W-2s from 50 different employers, each with a different payee name?

All this stuff is completely computerized. Unlike tax returns, it is no longer possible to file W-2s on paper. You must file them electronically.


>> her name & SSN were being used

> each with a different payee name?

Everyone was using the same name. There's no rule that says you can't be on 50 different payrolls.


The IRS & USCIS only get to do what Congress allows them to do.

When corporate lobbyists want the IRS to crack down on illegal immigrant workers, then there will be an effective crackdown. Until then, it will be possible to (cheaply) use stolen identities to get jobs past online verification.

Equifax - one of the huge credit reporting agencies - is trying to squeeze in to this space.

https://theworknumber.com/

Until then, Form I-9 gets filed on paper and that paper is kept in the employer's office. After 3 years, they can discard it.

Nova Law Review article with some background of my original post: https://nsuworks.nova.edu/nlr/vol32/iss2/6/

Department of Labor is upset that one of the consent decrees with Walmart gives them 15 day notice before any investigation of wages: https://www.oig.dol.gov/public/reports/oa/2006/04-06-001-04-...

I can't find the consent decree where Walmart gets advance notice of Immigration investigations. All of the primary links are dead. 30 or 60 day advance notice - this will prevent SWAT-style raids like those at the Swift meatpacking plants. Like the above one, if Walmart is "in compliance" when Immigration is allowed in the door, then they are exempt from fines & penalties. Walmart paid $11M in penalties for this one. Several of the blog posts reporting on the consent decree imply that the no-jail plus advance notice were a result of large campaign contributions to one political party along with political appointees interfering with enforcement actions.

> Not a RICO case, but illustrates ICE efforts to hold companies responsible for their subcontractor’s violations.

https://www.mondaq.com/unitedstates/work-visas/50104/immigra...

https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3345232

> At the time of the raids, the government said they had wiretaps showing that Wal-Mart executives knew the company was using illegal workers. However, as part of the settlement the company will not admit any wrongdoing or liability.

https://money.cnn.com/2005/03/18/news/fortune500/wal_mart_se...


Interesting! That reminds me of a similar arrangement I dealt with in Fast Food.

Back in 2008 I was working at a Wendy's where the majority of the staff would routinely "resubmit" their applications. I don't know the intricacies of the process, but the way it was explained to me was roughly something like this:

1) Illegal fills out application using a fake SSN

2) (Physical) Paperwork gets reviewed by manager, to make sure everything is filled out. Wait on sending it until they are bugged by corporate to submit the "new" employee applications

3) Send it to corporate

4) Corporate goes through a stack of however many "new" employee applications they have received across the region. Let's assume it's 10,000+

5) After corporate reviews the "new" employee applications, they gather up the names and SSNs, which are sent off to some sort of verification system

6) An error is thrown out and sent back to corporate saying that the name and address doesn't match the SSN provided. Corporate waits to send this information for a few days/weeks, depending on how many they are processing at a given time

7) The store receives a rejection notification sometime later

8) Wait about 1 week or so until corporate starts complaining, return to step 1

Some of the guys I was working with had gone through this process for - no joke - at least 2 to 3 years. Since they were continually seen as "new" employees, there was no sort of issue with firing previous employees or anything like that. It also didn't hurt that different information was being provided each time. After all, corporate had no way of claiming that Jose Guzman at 123 fake street, with SSN 123-45-6789 was the same Jose Guzman at 123 fake street, with SSN 987-65-4321, since they didn't want to be accused of racism.

It wasn't so much a problem to be resolved, as it is a "discrepancy" to be "corrected". The only correction needed was to have the "new" employee resubmit their application.

On a side-note, I'm not exactly sure how any of this worked, but it also led to the "new" employees making about $3 per hour. I accidentally left a paycheck out at one point, and one of the Spanish guys saw it and flipped out, yelled to the other guys, and they all started flipping out too. I guess they were under the impression that minimum wage was whatever the managers told them it was? I felt bad for them, in a way, since they were working extremely long days, but they were also not paying any taxes, sleeping on the job, and would flee the country once their home was built back in their home country. Basically, they were treated poorly, but they were also standing to save up about a full decades worth of money by stealing from the country they broke into illegally. I don't really hold any hostility over them doing that, I just don't hold much sympathy either.


You lost me at "stealing from the country they broke into illegally." I see people working hard to try to improve their and their families' lives.

Surely the employer is deducting for income tax, SS tax, and medicare tax from their paychecks, and they will not see an income tax "refund" next April nor will they ever collect SS nor Medicare benefits.

And if the employer is not making these deductions then who is doing the "stealing" exactly?


The people not paying the taxes after committing tax fraud? Also all the corp employees who facilities this fraud.


Wage workers generally have taxes withheld involuntarily, at least unless someone makes them manually override it.

Interestingly, that seems to trigger the taxman to start looking, which is when folks get busted. It’s in some mentioned anecdotes and articles here.

Even more interesting? If they instead just abandon the withheld taxes, no one seems interested in actually fixing the problem.

It would be trivial to mandate employers do realtime submissions of the employment eligibility paperwork for instance, but it’s actually illegal to send it to anyone, or attempt to do anything more with that information (like have a service somewhere that tracks these things and notifies employers of obviously invalid cases like a SSN being used across 5 states for 50 different job applications at different employers at once).

A cynical person would say it’s because as long as the people who need to be paid are getting paid, unskilled labor is cheap and easy to scare/boss around, illegal immigration is not actually a problem, but an opportunity for them.


Wouldn't it put them in tax exempt bracket if they are making $3/hr? Not an accountant so really not sure about these things, but thought under a certain amount, you don't pay taxes.


I'll try to answer this as clearly and honestly as I can, based off of what I witnessed. I hope it doesn't come off as "snippy" or whatever. I know it's a topic that a lot of people get very passionate about. I don't really have any sort of passion either way, I just know what I've seen.

>You lost me at "stealing from the country they broke into illegally."

Sorry about that, I'll clarify: Illegals do not pay state or federal taxes in exchange for the services they benefit from. The validity of taxes themselves is an issue itself that can be debated, but the refusal to pay taxes at all is a form of theft. There's a general attitude of something roughly like, "The more money I save now, the quicker I can get back home." This means not paying for things, stealing food, etc. You learn to lock your car up and not leave your cellphone laying around real quick.

> I see people working hard to try to improve their and their families' lives.

Irrelevant.

Again, sorry if this sounds snippy, but it's true. We could presume that about literally anyone. It does not justify a cop taking a bribe, or a CEO lying to customers to get ahead. There is no justification for breaking into a country illegally. A good deed after committing a crime makes a criminal both naive and poorer for the effort.

More to the point, in the situation that I was speaking of their actions, in my understanding, nothing to do with "their families' lives". The purpose was to save money, in order to build houses so that they themselves would not need to work for a number of years. The men that I worked with were not married, did not have children, and never mentioned their extended families over the course of the years that I worked with them. You can assume that they may have been sending money to relatives, but there is nothing to support that assertion. Honestly, I strongly doubt that assumption in the way that it's written, based on the behavior that I witnessed on a routine basis.

Consider this, in the image of illegals that you have in your mind: do you see them beating homosexuals in the back because they felt like it? Do you see them driving to work drunk? These are the sorts of things I saw regularly. I did not see anything approaching some valiant hero, "just tryin' to provide for the lil' ones back home". I saw drunk, paranoid, irrationally violent men who were going to do whatever they wanted to while they could get away with it. I had little reason to believe that the men I worked with weren't complete sociopaths, let alone believe that they had any sort of duty to provide for some distant relative.

Are there some that do send money back? Maybe the stupid ones. But if they do, they're going to be "stuck" in America longer than they would otherwise. The illegals that I worked with had zero intention of staying in America for any extended length of time. It was just a way to make money and get out. The "I'm gonna get mine, hope you get yours" type mindset.

>Surely the employer is deducting for income tax, SS tax, and medicare tax from their paychecks, and they will not see an income tax "refund" next April nor will they ever collect SS nor Medicare benefits.

I wasn't privy to reading the details of each of their paychecks, but I would assume that they were paying income tax, SS tax, and medicare. If you're attempting to assert that by paying into those things that they were automatically paying for, that it somehow justified or lessened their crimes, you are mistaken. I pay into medicare. I pay into SSN. I have no expectation of ever receiving access to either service being available by the time I would be eligible to use them. I do not, however, then assume that I am somehow being "stolen" from, or "donating" that money. I pay it because I have no choice in the matter. I have already come to terms with that. I have accepted that neither service could possibly be sustainable for the next several decades. That fact however, does not mean that I have some right or choice to not pay into it.

>And if the employer is not making these deductions then who is doing the "stealing" exactly?

Given the points covered above, again, it is the illegals that are stealing. The company, without question, absolutely knew what was going on. They were complicit, a form of accomplice, sure. But the active process of stealing? That was on the part of the illegals - the company simply capitalized on the "great opportunity" and stood to benefit by working with thieves; birds of a feather and all of that.

Again, I don't really have any hatred for these people. They do it because they can get away with it, and there is very little incentive to stop them from doing it. I simply don't feel much in the way of sympathy when the people taking advantage of the country, are in turn, being taken advantage of by scummy corporations that exist within that country. When criminals work with criminals, should it come as a surprise when one rips off another? No one is going to call the cops over receiving a bad batch of heroin, it's simply the cost of doing business with that sort of person.


that's a fine example of capitalism driving costs down and making things cheaper.


I don't think it's the employer's legal duty to verify the validity of the SSN, just that it is provided. That kind of makes sense but it's a shame we have no system to actually validate that. It's probably on purpose so we can have immigration and workers for the jobs American's don't want to do but not seem like we're pro immigration on the political front


I don't think it's unreasonable to expect employers to not hire tens or hundreds of people using identical names and social security numbers. If it can be shown that an employer knew, or reasonably should have known, that they were employing illegal immigrants we should be throwing the book at them with full force.

There are no jobs that Americans don't want to do. There are only jobs that Americans don't want to do at exploitative wages.


I didn't mean morally -- I meant legally they do not have to verify the authenticity of the numbers.

And I agree with you about the exploitative wages mostly, but I don't know what to do about it.

So we pay real wages to migrant farm workers -- Even if we double subsidies for corn and whatnot, beef now costs 3X at the supermarket.

In Texas, 1 in 5 children are hungry every day[1]. How do you do it so that more children aren't made less food safe and you don't cause riots/social unrest from exploding inflation?

Sigh.... I wish we could at least all work on the problems instead of all the sloganeering always going on. Not to say you're doing that, it just feels like we can never have any kind of real conversation about what to do anymore -- Maybe it's just that no one is driving the bus anymore.

Have a good day!

[1]:https://www.feedingamerica.org/hunger-in-america/texas


Mark my words: this narrative will be used to deepen global surveillance, further centralize our communication systems and greenlight various large-scale manipulations (e.g. censorship).

Kind of like 2FA is currently "solved" by requiring mobile numbers instead of something like Ubikey, even though SMS is insecure and awful for privacy.


One minor correction: mobile numbers are used for spam and bot prevention.

You can't have a discord or signal account without a valid phone number. Think about that for a second.

But yeah, not being able to use proper 2FA devices annoys the bejeesus out of me


No need to phone verify for Discord. SERVERS can turn it on as a requirement. to prevent spam probably.


Depending on where you're signing up from, sometimes they do demand a phone number on signup.


My discord is fine without a phone number.


No doubt that's what will happen, although it's clear to me that less centralization, not more, would be better for countering this sort of stuff.


But you are accepting the narrative. To me, these stories are akin to 'parallel construction' - they provide the justification for the implementation that our overlords have already determined would be expedient for their goals. This way of looking at things simplifies understanding of the news we are presented with. So: what is required by the technocracy?... aaand here's the news story/stories to support that. The presented reality is not unfolding naturally (if it even occurred).


I hope you occasionally consider the opposite perspective. Starting with a predetermination of conspiracy is just as bad (actually worse, IMO) as starting with a predetermination of honest behavior.

Alex Jones used the same reasoning to declare the Sandy Hook shooting a false flag intended to move the conversation about gun control. I encourage you to watch the coverage of the ongoing hearing where the very real people who lost their very real loved ones are testifying.


It's beyond conception I guess that some trials are actually made for television events.


Is it also beyond conception that it isn't?


How is that the case ? How can SMS be exploited?


Crooks can trick cell carriers' under-resourced customer support reps into transferring your phone number to a different SIM card. https://www.issms2fasecure.com/


SMS, as well as app-based TOTP, are commonly phished (even with automated processes in some cases). SMS in particular is vulnerable to a SIM swap as well.


I always wondered. Does anyone actually know of legitimate useful applications of deepfakes (and related AI tech that manipulates videos)? All I can think of is lipsyncing translations of shows/movies (and to be honest, that's at best a gimmick).

I see dozens of problematic uses of the tech everywhere in the news. But, other than "it's cool that we can do this" demos, I have not yet seen 1 application of this that I'd actually want.


Deleting f-words from a movie (post-production editing):

https://www.breitbart.com/entertainment/2022/08/12/lionsgate...


Alright I agree. Sounds like a realistic use.

Still feels like a gimmick. Particularly because most of the value you get out of processing the audio, not the video. And video is the part of deepfakes that I feel never should have been developed (but was inevitable, someone was eventually going to make it happen).


I'm not sure censorship is a better use of the tech. In terms of hollywood films I imagine it might be used to help make stunt/body doubles less obvious though


Making fake FB accounts -- they have an identity verification stage IIRC, not sure if it's a static photo or a short video clip these days.

If you need to access the walled garden but would prefer to keep your identity from them, thispersondoesntexist + deepfakes could be one way to do it.


With mature deep fakes you could theoretically select your favorite actors for whatever you want to watch. This could be done at the studio level, hiring cheap actors for the manual work and then using deepfakes to replace with big name actors. It could be done after production by the consumer. Both methods could possibly be done legitimately although proper payment and credit for acting would be a nightmare.

I don't endorse the idea, but it with the correct implementation it could be a legitimate use.


There was recently a case of this in a recent video of Joueur du Grenier (a French video game Youtuber).

They couldn't quite him on set on time for a particular scene, so at some point some guy on set said "Hey, this guy is roughly the same build as the JdG, why not have him put the costume for this scene and stand here, and deepfake the JdG's face later?". It's still a bit visible in the video though.


Probably right. Can definitely save some production costs at times, even though you'd prefer the actor to be there. And I believe deep faking actor faces over stunt crew faces is a thing sometimes.

You could still get a movie shipped without using the tech tho. Feels slightly gimmicky, but legitimate indeed. Cheers!


> legitimate useful applications of deepfakes

De-aging actors such as Luke Skywalker in the Book of Boba Fett.


Dang! I missed that. On point. I never thought of that as "deepfake" but the tech is definitely related and I think you are right.


> Does anyone actually know of legitimate useful applications of deepfakes (and related AI tech that manipulates videos)?

Hiding your real appearance on video calls (like that famous cat filter, but a normal-looking human instead of a cat)? I think the usual reasons I hear are either people with stalkers or people who have issues with their appearance.


Does anyone have pointers to the forums where these services are discussed?

Blackhatworld is the only one I know of, any others?


Telegram, discord.

Don't expect HN-level discourse though, it's a mess.


What's the discovery process for these channels? The only way I've found useful discords/telegram channels is word of mouth from people I know IRL.


That is exactly how it goes. More often, it is also hidden on deep web forums.

Typically, there are different tiers and the higher your reputation, the more content and channels you have access to.


Always thought that Blackhatworld was just a forum about unethical SEO.

There used to be raidforums as a big one before being seized by LE but it's not hard to imagine that another forum sprung up to fill the void that RF left behind.

Krebsonsecurity blogs about transactions on some of these (often in Russian language) forums although I don't know if he mentions them by name.


Breached.to is the replacement domain, FYI.


xss.is exploit.in if you don’t speak Russian you will probably have a hard time.


Why is it so Russia dominated? This was also visible in the article. Any particular reason or just coincidence?


I’m not Russian but it’s probably a combination of being a high IQ technically savvy country, having law enforcement that doesn’t care as long as the victims are foreign, and an opportunistic mindset many people got in the 90s.


The first part certainly raises the question of why ads are so poorly monitored. Having deepfaked celebrities promoting any product, even a legitimate one, should not be legal. It's misleading at the very least.


Most likely because it's the advertising dollars that pay for 80% of the internet.


Everyone involved would rather get paid than slow things down over minor details like legality or it being misleading, at least until it becomes a scandal.

So far it isn’t common enough to be a scandal.


People who buy based on celebrity endorsement earned their fate.


So far, ad networks/platforms don't care as long as the check clears.

I think the lack of action with FaceBook & Cambridge Analytica shows exactly where this is going in the future.


This made me think of one of the top posts yesterday:

> Someone is pretending to be me https://news.ycombinator.com/item?id=32996953

It would be trivial to create a deepfake model to represent the author in interviews and meetings. If your picture is available online, anyone could pretend to be you. Pretty scary.


Been using fake photo for some time.

Because I am too ugly.


You are beautiful and unique. I’ll fight anyone who says otherwise.


Are you his mom lol




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: