The use of ficticious people as a tool of deception has occured since the dawn of man. A formal definition of the attack method is "impersonations or false identities that are used to bypass controls, manage perception, or create conditions amenable to attack" [2]. Creation of a ficticious person is quite easy due to the abudance of services that offer false identification cards, birth certificates, green cards, etc. Also, many web-based sites include user profiles that make it easy to create a ficticious identity. There are many incidents that have occured in the past few years that involve the use of ficticious people as an attack method. The events not only show the clear connection between information systems and the attack, but also showcase associations between this attack and other known threat/attack profiles. Effects on the victims of this type of attack can be devastating, particularly financially and/or psychologically. The Internet has aided the development of this attack by making it easy to create fictional identites using the profiles or services discussed above. Fictional identities may also be used for good, although that is often not the case. Finally, while the problem is continuing to escalate, there are some major efforts underway to help prevent these attacks from happening, particularly in the FBI.=20 [2]
Imagine a puppet on a stage, dancing, moving, talking, performing. It may seem almost lifelike, almost real, however it is controlled by the puppeteer, the one who holds the strings and manipulates the doll as he or she pleases. Fictional identities are very similar, those who adopt these identities control them and manipulate the characters to further their own goals or ideas. No matter how real they seem, one always has to remember that there is someone else behind them, pulling their strings. Using ficticious identities, people are able to cause confusion, damage, and other related problems wherever they go. The word ficticious means "Imaginary, something adopted or assumed in order to deceive, an assumed character or part" [1]. The negative connotations are clear from this definition, as ficticious people aim to deceive others. Ficticious people can be defined as, "impersonations or false identities that are used to bypass controls, manage perception, or create conditions amenable to attack." Examples of such people include spies, impersonators, network personae, fictional callers, and many other false and misleading identities [2].
Ficticious identities as a method of deception have been used for centuries. Spies, outlaws, people under persecution, and many others have changed their identities and their lives to gain information and destroy enemies, possibly even to survive. It is no different today, currently every year scam artists create over 700,000 false identities in the United States [3]. When considering the history of fictional identities, it's clear that not all cases involve malicious deceit or intent. In fact, during World War II, many master forgers provided false identity papers to Jewish families to escape the terrors of the Holocaust. The ficticious people discussed in this paper are not good samaritans though; their aim is deceit, their intentions are anything but noble, and they act to further their own selfish interests. Now the formal introduction has been made, and it's time to delve into the world of the ficticious person and learn about those behind the facade.=20
The creation of a ficticious identity may seem complex but in actuality it's not.=20 On the internet there are a number of services that offer the creation of fake identification, in the form of driver's licenses, birth certificates, etc [4]. In addition, there are entire websites devoted to the creation of a "new you" [5]. Many people make an illegitimate living by selling such ficticious identities.=20 In North Carolina, one well-known forger travels through the countryside in a nondescript van, churning out fake green cards. Technology has made his process easier, cheaper, and faster: Today, an "identity package" - green card, Social Security card, and driver's license - can cost as little as $100. Buying the equipment to make such identification cards is simple and relatively cheap. In effect, a forger needs little more than a photo on a colored background, a high-quality printer, a $15 laminate pouch, and a few other items to make a fake ID using $29 templates from the Internet. The machines that print out today's new generation of credit-card-style driver's licenses can be bought for a few thousand dollars [6].
The complexity of creating a fictional identity can also be much less invasive than described above. Fictional identities can be created with user profiles on popular sites such as those that provide email (Yahoo.com, Hotmail.com, MSN.com) or dating services. These fictional identities can be used to exploit trusted relationships, communicate to others, and gain information, all while concealing the true person's identity. The motives for creating ficticious people can vary. Ficiticious identities may be used to cover the real criminal's tracks, endorse products or services, gain access to privledged information or areas, gain entry into different countries, and create/exploit peer (or trusted) relationships. Clearly the motives are malicious in their intent. Often the ficticious person is employed to create or increase conditions that are amenable for attack by the perpetrator. Once again, the relationship can be described as puppet and puppeteer. Unfortunately for the criminals though, their alter-egos can't go to jail and so they must, if they are caught.
There are several recent incidents that involve the use of a ficticious persona by an attacker or attackers. Each event presents a unique case to discuss and analyze. In order to understand why the creation of ficticious people is such a useful tactic (and why these attacks are able further or cause vulnerabilities which make it easier for subsequent attacks), the connections between information systems and the attacks must be considered. It is also important to look at the attackers involved and their association with known threat profiles. Several of the articles discussed below focus on these associations.
Auction sites function primarily on a kind of honor system, with "feedback"--comments by each participant in a transaction about the other's behavior--playing a critical role.It is a system that can be abused, and auction sites try to ferret out criminals by using special software and other techniques to track suspicious activity like shill bidding, in which sellers inflate prices through accomplices who bid up items. But as episodes like Nordberg's experience show, the criminals are trying just as hard to stay ahead, becoming more technologically and financially sophisticated and moving beyond garden-variety fraud like the misrepresentation and non-delivery of goods. Defrauders now switch computers so their usage patterns cannot be as easily detected and build flashy Web sites to give their businesses the sheen of legitimacy. They steal credit card numbers to set up e-mail accounts on Internet service providers like America Online and then use them to set up fraudulent auctions. The defrauders may also create fictional characters to give positive feedback about the seller. Nordberg had been reassured to learn that 12 happy customers had given McGooch feedback like "a true Santa Claus online" and "Grade A-plus-plus-plus."But after the auction, Nordberg carefully reviewed the feedback and realized that all of it was submitted by users who created accounts around the same time and had reported no purchases other than the ones from McGooch2002. In other words, the 12 users were probably fictional creations of the person who created McGooch2002. McGooch2002 started his account six months in advance, built a clean reputation though such non-existent auctions and then began a series of auctions of high-end merchandise in the last week of December that all ended around the same time [8].
Without the advent of the Internet and such widely used services as online auctions and free email, the ability to use ficticious people to deceive others would be greatly limitied. The internet gives the criminals the advantage to create ficticious personae easily and with little scrutiny. Clearly, there is a strong connection between information systems and the use of ficticious people as an attack method. The attack method lives as a sort of parasite off the Internet and thetechnological advances made by it. As the Internet becomes more and more developed and sophisticated, so does the attack. As the Internet offers more and more services, attackers will find ways to use ficticious personae to exploit them. The effects of this parasitic relationship will be discussed further in the following section. There are several threat profiles that may be associated with ficticious people attacks. Fraudsters (people who defraud others [2]) are probably the major threat associated with this attack. Both of the cases involving online auctions involve fraudsters. Another threat associated with such attacks is deranged people, clearly a possibility in the Dennilfloss case discussed above. Ficticious people may also be involved with extortionists, as the Lowe's bomber case clearly demonstrates. The attack may also go hand and hand with other types of attacks. Traditional offline financial fraud and identity theft are being integrated into the online auction world, as well. Fraudulent sales were formerly dominated by hard-to-trace transactions involving cash or money orders. Now investigators say that perpetrators are increasingly using identity theft to set up bank accounts that allow wire transfers or transactions involving third-party online payment services like PayPal. Some criminals have turned to hijacking users' accounts and their good feedback instead of building their own identities [9]. The Lowe's bomber case also involves an extortion attack, as well. Identity theft is the most common attack used in conjunction with ficticious people, often the attackers will assume someone else's identity to open accounts, start businesses, steal money, etc. The ease with which one can obtain false documents such as driver's licenses, birth certificates, etc. makes the creation of ficticious people and the use of false identities extremely simple. It is perhaps due to this inherent simplicity that this attack is relatively common in the world.
The Internet has allowed the deception by ficticious people to become increasingly simple but sophisticated. The services the Internet offers allows ficticious people to be created by basically anyone. For example, Hotmail is a free Internet mail service used by many people, especially people who travel a lot. Anyone can establish an account with Hotmail in minutes, using a fictitious name and other fictitious information. While it is a legitimate service, it's also used by some people for purposes that are not legitimate, clearly [7]. Fraud has also been a problem since the first online auctions were conducted in the mid-1990s and has expanded as auction sites like eBay and Yahoo have become some of the most successful sites on the Internet [8]. It is, therefore, clear that the internet has had a great effect on the development of the ficticious person attack. There are also several ways in which this attack has effected the Internet and its victims. First, fictional identities may cause a great deal of emotional or psychological damage. In the Dennilfloss case many people became friends with the fictional "Nowheremom" and grieved when she died. Discovering she wasn't even a real person was a huge blow to many and caused a lot of pain. The use of this attack may cause signficant financial losses for many of the victims as well, this is clearly illustrated in several of the articles discussed above. Fictional people violate a victim's sense of trust, which may also have lasting and potentially devastating effects.
The Internet must come up with more and more sophisticated methods for identity verification to combat the problem, which may be difficult because there is only so much a computer system can do to check identity. Services that make it easy for fictional people to be created may also suffer as more and more controls are added. Those who wish to have anonymity may not be able to because it poses too big of a threat for such services and thus, such people may take their business elsewhere. When compared to attacks in which billions of dollars are stolen, computer systems fail or crash for days, and communication lines are disabled, this attack may seem minor in its effects, and in some cases it is. However, the complexity of this attack and how the ramifications may effect each and every victim must be considered. Deception is powerful and dangerous, and particularly hard to deal with if one has become a victim of it.
The use of ficticious people as an attack mechanism may be used to create system vulnerabilities, bypass controls, alter or manage human perceptions, and make it easier for further or subsequent attacks. Creating a ficticious persona is quite easy. User profiles are typically a simple way to create and maintain a fictional identity, while services offering false licenses, birth certificates or other identifying documents are cheap and easy to find, especially on the internet. There are many ways that criminals use ficticional identities. Online auctions are currently a very popular place for fraudsters to create profiles and collect money for merchandise that is never delivered. Fictional identities may also be used by extortionists and deranged people. The internet has allowed the creation of these false identities to become even easier than before its widespread use. The effects of fictional identities on the victims may range from emotional or psychological trauma, to feelings of embarassment and anger. These attacks may also necessitate the creation of additional identity controls on the Internet, including popular auction sites and email services.
There are several conclusions that can be made from the research provided above. Ficticious people used as a method of deception that can signficantly impact the victims involved. Most often these false identities are used with malicious intent, however occasionally they can be used for good. Undercover FBI agents may be involved in the FBI "Innocent Images" program, which targets people who use the Internet to sexually exploit children. Using false identities, the agents go into chat rooms as young children to track and hopefully identify potential pedofiles and pornographers [11]. The creation of fictional identities will continue to be simple as long as few identity controls are implemented on websites, particularly ones that involve the exchange of money or valuable information. Sites that offer services for the creation of false identities should be monitored or perhaps eliminated from the web, as they are major contributors to the problem. This is a fine line to walk however, because confidentiality and privacy need to be respected as well. Regardless, ways to combat this problem need to be implemented immediately as the attacks continue to rise each year: Auction fraud is now the most prevalent computer-related crime, according to the Internet Fraud Complaint Center, a joint program of the FBI and the National White Collar Crime Center. In 2000 the center referred 7,193 complaints of auction fraud involving a total loss of $5.4 million for investigation. The rate of complaints is gradually rising, and the assessment of losses has sharply increased as criminals focus on high-tech, big-ticket items. The fraud complaint center says that the median dollar loss per auction fraud was $225 in the first half of 2001 but jumped to $489 in the second half of the year [8]. In 2003, it is likely that the figure has increased substantially.
There are several specific ways that the problem is being dealt with currently. Law enforcement agencies are keeping up with the increased sophistication of identity fraud, particularly involving online auctions. This can be particularly difficult now that fraud has entered the automated stage. Over the last two months, eBay says, it has seen the emergence of software "bots" that scan accounts and then try to gain access to them by systematically guessing passwords. The goal is to hijack a trusted seller's account and use it to make fraudulent transactions [8]. The FBI has implemented a number of initiatives to address the various identity fraud schemes, especially those being utilized by terrorists to fund their terrorist activities. One involves targeting fraud schemes being committed by loosely organized groups to conduct criminal activity with a nexus to terrorist financing. The FBI has identified a number of such groups made up of members of varying ethnic backgrounds, which are engaged in widespread fraud activity. Members of these groups may not themselves be terrorists, but proceeds from their criminal fraud schemes have directly or indirectly been used to fund terrorist activity and/or terrorist groups. Prior to 9/11, this type of terrorist financing often avoided law enforcement scrutiny. Another initiative has been the development of a multi-phase project that seeks to identify potential terrorist related individuals through Social Security Number misusage analysis. The Terrorist Financing Operations Section of the FBI works with the Social Security Administration's Office of the Inspector General for SSN verification. Once the validity or non-validity of the number has been established, investigators look for misuse of the SSNs by checking immigration records, Department of Motor Vehicles records, and other military, government and fee-based data sources. Incidents of suspect SSN misusage are then separated according to type. Predicated investigative packages are then forwarded to the appropriate investigative and prosecutive entity for follow-up. The American Association for the Advancement of Science gives a warning about controlling concealment of identity on the Internet, however. They believe such regulations could prevent people from seeking counseling, expressing political opinions or engaging in financial transactions, and could impede the development of e-commerce and the World Wide Web [13]. Clearly, the issue of ficticious identities is a difficult and controversial one. The use of ficticious people has been a fact of life for centuries, and it is likely that even with controls the problem will still exist. As long as people exist, there will be ficticious people. After all, deception is not a 21st century invention, it has been around since the dawn of man.
[1] Dictionary.com, 2003. "Ficticious." http:/ /dictionary.reference.com/search?r=2&q=fictitious [This site offers dictionary services. The definition for ficticious includes entries from Webster's 1996 Revised Unabridged Dictionary, Wordnet Dictionary, and American Heritage Dictionary 4th Edition.]
=20[2] Cohen, Fred. All.net New Security Database www.all.net [This database includes all known attack profiles, and discusses each in detail along with examples and the complexities involved in each case.]
=20[3] Wallich, Paul. Scientific American.com. July, 2002. "Who's Who: Can digital technology really prevent identity theft?" http://www.sciam.com/article.cfm?articleID=00077B81-70EB-1D06-8E49809E C588EEDF [This article discusses the ease with which someone can make false identities and gives relatively current statistics on the creation of false identities. It also discusses ways in which this problem can be prevented.]
[4] Espionage Unlimited. 2003. "How you can get a New Identity quickly, safely and easily!" http://www.espionage-store. com/id.html [This site is devoted to creating an entirely new identity and new life. If offers services aimed at getting new ID documentation, complete relocation, ownership of a corporation, college degrees, etc.]
[5] EZ Info Store. "Learn How to Create A New Identity in the US and Canada." http://www.ezdiscountst ore.com/newyou.html [This site offers the sale of books aimed at the creation of "a new you." The books claim to offer sevices relating to new ID cards and other forms of identification, bank cards, and credit cards.]
[6] Jonsson, Patrik. Christian Science Monitor. August 29, 2001. "Teens Can Get Fake IDs in a Few Keystrokes on Web." http://www.csmon itor.com/2001/0829/p1s4-ussc.html [This article discusses the ease with which fake IDs can be obtained on the Internet and how inexpensive and easy it is for people to create entirely new identities for themselves. It also mentions the sanctions imposed for those caught carrying and using such false identification.]
[7] The Star News Article Archive. 1999. "E-mail locates accused bomber." http://www. shelbystar.com/news1999/_disc4/0000050c.htm [This article discusses the capture of an accused bomber and extortionist, who (of relevance) used a false identitiy on the hotmail service and to open an overseas bank account.]
=20=20 [8] Lee, Jennifer. The Orlando Sentinel. March 11,2002. "Web's Bloom a Garden for Sophisticated Scammers." http://www.orlandosentinel.com/ne ws/nationworld/chi-020311crime,0,3389506.story?coll=orl-home-headlines< /a> [This article discusses the current trend of using ficticious identities on internet auctions to set up accounts with high reliability ratings and sell items that never get delivered. It also discusses the story of one couple who lost 700 dollars through this scam.]
=20[9] McCarthy, Kieren. The Register. May 18, 2001. "Murderer Confesses on Anandtech Forum." http://www.there gister.co.uk/content/6/19045.html [This article discusses an incident where a member of a discussion forum created a fictional identity, began "dating" her, and then killed her off.]
=20[10] Sacremento Valley Hi-Tech Task Force. "Iinvestigations." http://www.sachite chcops.org/investigations.htm [The investigations page of the Sacremento Valley Hi-Tech Task Force discusses the types of cases they investigate and details some of the case highlights in recent history. Of relevance is the case of Bryant Alan Adams, who used fictional identities for online auctions, to rent cars, and to create seemingly legitimate businesses.]
[11] Frye, Cathy. Arkansas Democrat-Gazette. January 8, 2001. "Web of Deception." http://ww w.arkdemgaz.com/prev/childporn/A1Day2Main8.html [This article discusses the FBI's "innocent images" program to stop pedofilia and pornography on the Internet. It also discusses several cases that have been investigated by the officers involved.]
[12] Pistole, John S. Congressional Statement-Federal Bureau of Investigation. October 1, 2003. "Fraudulent Identification Documents and the Implications for Homeland Security." http://ww w.fbi.gov/congress/congress03/pistole100103.htm [This document discusses the use of false identifying documents by terrorists and (of relevance) the ways that the FBI and the federal government are starting to crack down on the terrorist use of false identification. Several of these preventative initiatives are discussed in detail in the document.]
[13] Science Daily. July 1, 1999. "AAAS Urges Caution In Regulating Anonymous Communication On The Internet." http ://www.sciencedaily.com/releases/1999/07/990701065214.htm [This article discusses the opinion of the American Association for the Advancement of Science that anonymity is more beneficial than harmful when it comes to communications on the Internet. It also discusses several of the reasons AAAS gives to support this opinion.]
=20 ------=_NextPart_000_0007_01C3A3C0.37375F90 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable