Hello, World!
There’s been a disturbing rise in Telegram bots, which claim they’re able to dox anyone.
All it takes is something as basic as someone’s name and state, or just their phone number
- and the bot will locate their address, identify their relatives, uncover their driving license
information - and a hell of a lot more.
All for just $15.
But b efore we go any further I just want to speak briefly to the YouTube mods, and
the people that clicked on this video expecting some kind of tutorial… this isn’t that
- sorry to disappoint you.
I just want to know how is possible, what kind of people are using these tools, and
can you even stop yourself from becoming a victim?
Because chances are you are vulnerable to these Telegram bots, if you have a credit
card, or if you’ve paid a utility bill, rented an apartment, or taken out a phone
contract - then credit bureaus (companies like Experian, Equifax and TransUnion) are
going to have a credit file on you - which is where these Telegram bots often get their
information from, well - kinda, it’s complicated.
So, your credit file contains details on your bank accounts, and your debt - which credit
bureaus of course feed into their voodoo algorithm to come up with your credit score.
But the bit we’re interested in is right at the top - it’s called a “credit header",
it contains your name, all the addresses you’ve ever lived at, social security number, your
date of birth, and even your relatives.
It’s often pretty extensive, and the bad news is that whilst there are some pretty
strong laws regulating who can access the financial part of the file, when it comes
to the credit header… not so much.
Which has led to credit bureaus monetising these juicy morsels of information, in the
form of tools…
like TLOxp - which is owned by TransUnion, one of the largest credit bureaus in America.
TLOxp’s Advanced People search function is the best way to initiate a search on any
given subject.
It features advances query capabilities, allowing you to search by name, address, community,
date range seen at an address, date of birth, age range, email or even a partial social
security number, the more data you plug in the more targeted your search results, and
it doesn’t take much to get started, when you find your subject you’ll get our available
comprehensive information, items such as contact data, including possible phone numbers ranked
by the projected usefulness of each number, and information on possible relatives and
associates Pretty dystopian, right?.
But there is a shred of good news, thankfully it’s not like just anyone can just sign
up for and access tools like TLOxp… these things are only available to certain industries
like insurance companies and law enforcement agencies.
But of course cyber criminals often have a habit of finding a way around the rules
How?
Well, 404media recently ran an investigation on this - they found one such tool data-trac
was accessed after someone stole the “identity of a former law enforcement officer and private
investigator”.
I have a hunch they were probably just phished, but regardless - you’d think that to give
someone access to a godlike doxxing tool, regardless of who they say they are would
require some kind of in person verification, other than just filling out forms on the internet?
Well - “Data-Trac … said that at the time of the criminal gaining access, the company
only performed “remote confirmation,”” - I’m guessing this is probably just a case
of covid being used as an excuse to suspend their usual checks.
Once a cyber bad guy has gained access to a tool like TLOxp they’ll either monetise
it themselves, like in the case of the FreeBandz Gang - a group of wannabe rappers of which
some of their members made millions of dollars through identity theft, using TLO.
Other cyber criminals will opt to create some kind of Doxxing as a service tool, like in
the case of these Telegram bots, which they’ll then advertise in telegram groups which are,
shall we say - less than wholesome.
I think it’s a bad idea to point out the specific groups I’ve seen, but to give you
a flavour - other than just doxxing, the groups focus heavily on swatting, with some users
even advertising their own swatting services that kids can use to shut down their schools
- and, this is a whole problem in of itself, nowadays the bad guys are using AI generated
voices - and will often publicly post the recordings for clout.
[ring] Hello, I’ve just committed a crime and I want to confess … You’ve did a crime
and you want to confess?
I placed explosives in a local school.
You did what?!
It’s also common for these kinds of Telegram groups to deal in physical violence.
You might not have heard of it before, but ‘violence as a service’ is a thing - with
competing cyber crime groups hiring people to put bricks through the windows of their
rivals homes - and just like with the swatting, the perpetrators often record and post evidence
of it to boost their reputation.
So yea, I think you get the idea - these Telegram groups are like - if you took a modern warfare
2 lobby from back in the day, but gave everyone in it the ability to ability to dox, swat
and put bricks through each other’s windows - it’s all really pretty grim.
However luckily these groups aren’t all that easy to find, you can’t just Google
this stuff - a good portion of them are invite only.
But it’s not just depraved Telegram groups which have a use for doxing tools, there’s
also foreign intelligence agencies, I mean - if you’re a Chinese government spy, who’s
tasked with hunting someone down, why go to the effort of trying of trying to do that
yourself when you can just hire a US based private investigator who already has access
to godlike doxxing tools.
And…
back in March the FBI warned that this is happening, with one case involving Iranian
intelligence trying to kidnap a critic of their regime, and there was also a case of
an “illegal agent of the Chinese government” trying to do something similar.
So, at this point I think you’re probably convinced that you’d rather not be in these
databases, so what can be done?
Firstly, this all seems to be mainly a US problem, I haven’t seen any Telegram bots
selling access to the data of Europeans, probably due to our more stringent data protection
laws.
But for our American friends, there is good news - maybe.
The government agency tasked with regulating all of this stuff, earlier this year launched
an investigation into what’s going on with data brokers - whether that’ll lead to meaningful
changes, who knows.
But in the meantime there are services that claim to be able to remove you from a good
chunk of people finder tools, but these really just can’t do anything about the root of
the problem - the credit headers themselves.
If you want to read more about how easily doxxable you are, and why there isn’t much
you can do about it - I’ll leave a link to 404media’s article in the description
- their investigation is what turned me on to all of this, so I highly recommend you
give it a read.
As always thanks for watching and I’ll see you in the next video, have a good one.