According to Brian Krebs of the Krebs on Security newswire, all data relating to individuals now has a value – it may only be a few cents – but it all helps cybercriminals when it comes to identity theft.
The Superget.info website, he says, is a fraudster-friendly site that has been operating since July 2010, and markets the ability to look up social security numbers, birthdays and other sensitive information on millions of Americans.
“Registration is free, and accounts are funded via WebMoney and Liberty Reserve, virtual currencies that are popular in the cybercriminal underground”, he notes in his latest security posting.
Superget, he asserts, allows users search for specific individuals by name, city, and state. Each credit on the system costs a dollar and a successful hit on a social security number or date of birth costs three credits.
“The more credits you buy, the cheaper the searches are per credit: Six credits cost $4.99; 35 credits cost $20.99, and $100.99 buys you 230 credits. Customers with special needs to can avail themselves of the reseller plan, which promises 1,500 credits for $500.99, and 3,500 credits for $1000.99,” he says.
Customers, adds the security researcher, who are not choosy about the identities they are stealing can get a bargain as among the most trafficked commodities in the hacker underground are packages called 'fullz infos', which include the full identity information on dozens or hundreds of individuals.
Krebs says that it's not clear how many records that the Superget service has, but he notes that lookups on even less than common names produces hits.
Infosecurity notes that the data on Superget can be used to supplement other data, most notably card credentials, meaning that if the fraudsters wants to contact the card issuer for an address change, Superget will allow them to gain access to much of the authentication data that is requested. Not bad value for a shade over a dollar for bulk purchasers.