Researchers Expose Security Flaw in Social Security Numbers

PC World — Have you posted your date of birth and birthplace on any of your social networks? If so, you may have provided enough information for hackers to figure out your Social Security number. Well, in theory, anyway. Researchers at Carnegie Mellon University have successfully devised a way to guess a person's Social Security number using statistical analysis.

Carnegie Mellon researchers Alessandro Acquisti and Ralph Gross say the Social Security numbering system combined with the widespread use of S.S.N's as an identifying number has created an "architecture of vulnerability," and is an unexpected consequence of the availability of basic personal information and modern computing power. The study will be presented on July 29 at this year's Black Hat security conference in Las Vegas.

Acquisti and Gross determined that the problem lies in how Social Security numbers are constructed. Every S.S.N. has three parts: area number (AN)-group number (GN)- serial number (SN). All three components can be predicted based on the probable location of your residence at the time your S.S.N. was applied for. This is possible since the sequence of ANs and GNs for each state are publicly available online, and SNs are assigned in consecutive order.

The researchers tested their theory of guessing S.S.N.'s against the Social Security Administrations Death Master File. The DMF is a publicly available database that lists the S.S.N.'s of people who have died.

While the success rate for predicting S.S.N.'s was relatively low, the researchers were able to correctly guess numbers nationwide for people born before 1989, 0.08 percent of the time in fewer than a hundred tries.

The simplest numbers to predict, however, were those assigned in smaller states and to people born after 1988. The reason is that as of 1989, Social Security numbers were assigned according to the Enumeration at Birth initiative, where people received their Social Security number at birth. The EAB increased the chance of identifying an S.S.N. dramatically since a person's birthplace and location at the time the S.S.N was applied for were guaranteed to be identical. In addition, a smaller state population automatically reduces the number of S.S.N.'s available making a correct guess more probable.

One striking finding for instance was that the Carnegie Mellon researchers were able to identify one out of twenty complete S.S.N.'s in less than ten attempts for people born in Delaware in 1996. The researchers also found they could correctly identify the first five digits of an S.S.N. of anyone in a single try 44 percent of the time for individuals born between 1989 and 2003.

Continue Reading