The deep web and the dark net that populates it, is the underbelly of the internet most people know.
Almost destined to be a place where people can market almost anything, you can buy anything there. From drugs, weapons, stolen identities of millions of people. And here, the latter has taken an interesting turn: personal information are being sold, identifiable with selfies.
According to a Israeli dark-web research firm Sixgill, a data dump for sale has been made on a large Russian-language dark web forum. The dump, while similar to previous dumps, have included selfie of the data owner.
"We came across an advertisement in a closed-access forum which is predominantly Russian where someone was selling 100,000 documents for $50,000," said Sixgill’s Aled Karlinsky. "These documents include their ID or passport, proof of address, and unusually, a selfie."
Usually, data dumps being sold on the deep web, were usually anonymous. While it's possible to pinpoint the records with the individuals who own them, they never if not extremely rarely, to have selfies on them.
This can be a huge privacy issue since each record being sold, are identifiable. Buyers can verify each and every records being sold. Combined with other traditional evidence of information, the buyers can scam the victim, and possibly open bank accounts or access credit cards under the victim's name.
Since the $50,000 price is expensive, according to Sixgill, the person selling the dump also offered the data in smaller but more affordable chunks. For example, for $70, buyers would be able to purchase ones individual ID documents, including the selfie.
"The easiest of obtaining a selfie is from phones that have contracted malware," Karlinsky said. "The other way would be to maintain a website that keeps private info from people, and/or to hack into such a website."
Regarding the issue, Karlinsky is not worried about people posting their selfies to social media networks. But he strongly recommends that people be more careful when proving who they are on the internet. Before handing any personal documents and identifiable photograph, Karlinsky recommends that people ask the following questions: "Who are you proving your identity to? Is it worth it?"
"I would go as far to not take selfies of yourself holding your ID," he said. "I would also refrain from having pictures of your ID on your phone, in case your phone contracts malware."