The security researcher Brian Krebs he discovered that Nexusa new service born on the dark web, has put it up for sale 153 million driving licenses Americans and Canadians. Krebs said he received the report on August 31stafter identifying an ad on the Russian Exploit forum, and also finding his driving license among the archives, scanned a few months earlier by an employee while renting an SUV.
The files for each card for sale on Nexus include images of the front and back of the license, plus the same shots in the infrared spectrum and in that ultraviolet. Multispectral scans are used to overcome hologram-based anti-forgery checks, allowing the production of cloned documents difficult to unmask to physical checks.
The Nexus catalog, according to the researcher, also offers identity cardstravel and international documents, health cards, Common Access Cards (the cards that give access to US government buildings), residence permits and work authorizations. They even appear cannabis dispensary cards: one of the victims interviewed by Krebs recognized a document attributable to a Planet13 store in Las Vegas.
Documents and driving licenses for sale online, difficult to unmask
The source of the material appears to be attributable to a security flaw in IDScan.netan identity verification company based in New Orleans, Louisiana, whose scanners are used by car rental companies, stores and establishments that perform population checks. The file upload times on Nexus and the presence of infrared and ultraviolet scans, a typical format of those devices, point precisely in that direction, as the original investigation reconstructed, even if an official connection has not yet been confirmed.
Those who manage Nexus have declared that they have been exfiltrating data continuously for over a year, feeding a database that has grown by almost 400,000 records in just 24 hours of observation by Krebs. A rhythm that suggests still active access to the source, not a static archive put together one-off. THE’FBIthrough its New Orleans office, has opened an investigation into the source of the data leak.
Among the people whose documents were found for sale were Krebs himself, his mother, an assistant director of the FBI and several other security researchers interviewed during the investigation. A sample that suggests how the data pool involves common users and institutional figures transversally, without any selection.
At the time of publication of the investigation, the Nexus it had already been removed from the dark web. The removal, however, does not erase the copies already sold nor does it clarify how many have already been circulated: a database with high resolution scans, complete with infrared and ultraviolet spectrum, remains a precious material for anyone who wants to build false documents capable of passing the most sophisticated checks.
