May 22nd, 2008
More Snake Oil: LifeLock spokesperson's stolen ID leads to lawsuits
Can you remember being a kid, when your parents first told you what your SSN was? I remember mine telling me to never give it to anyone. Of course, then as soon as I got my first job as a caddy at the local golf course I had to give it up, same with when I bought my first car, hell, my college username was my SSN for awhile, and after that changed, my password was based off of it (not my choice).
Somehow along the way, our government decided not to punish companies for using SSNs, which they should’ve. Now we’re stuck with this huge identity theft problem, and tons of products that apparently don’t work to fix the problem.
From Slashdot:
OrochimaruVoldemort writes “It seems as though LifeLock isn’t as secure as Todd Davis makes it out. According to a LifeLock spokesman, his identity has been stolen. For two years, Davis has been daring hackers to steal his ID. Looks like he got what he wanted. CNN reports: ‘Now, LifeLock customers in Maryland, New Jersey and West Virginia are suing Davis, claiming his service didn’t work as promised and he knew it wouldn’t, because the service had failed even him.’”
Wow, and to think I just about bought this service. Thing about this is, it’s just another example of snake oil being sold in this industry, just like HackerSafe, PCI, WAFs, scanning tools, etc. I wouldn’t take so much exception if these companies weren’t so damn bold and blatant with their advertising.
Honestly, in Info Sec, you have the perfect maelstrom of advertising… under educated consumers, tons of money, mass confusion , throw in a great product pitch like “Sick of worrying about security, just plug us into your network and you’ll be 100% safe”, or “LifeLock’s so great I can advertise my SSN on the side of this van in the middle of a city.” Seriously though, this guy got what he deserved and I think LifeLock should be facing law suits over this.
-Nate
Nathan McFeters is a Senior Security Advisor for Ernst & Young's Advanced Security Center in Chicago. The views and opinions expressed in this article are his own and do not represent the views and opinions of Ernst & Young Advanced Security Center or Ernst & Young, LLP. Nathan has performed web application, deep source code, Internet, Intranet, wireless, dial-up, and social engineering engagements for numerous clients in the Fortune 500 during his career at Ernst & Young and has spoken at a number of prestigious conferences, including Black Hat, DEFCON, ToorCon, and Hack in the Box. He can be found at his Pwn* blog and XS-Sniper, a blog with Billy Rios. See his full profile and disclosure of his industry affiliations.
