Feeds

Online impersonations: no validation required

How do you know what's real and what's not?

Internet Security Threat Report 2014

Back when I lived in the Silicon Valley, there was an ongoing employment scam. Prospective employees would show up with perfect resumes and immediately get hired. It would not take long before it was clear that these people did not have the experience stated on their resumes. Within six months they would be fired.

However, now they had six months of legitimate experience with real companies that they could reference. Their next jobs might not be as good or glamorous, but it would be much better than if they started with their real resumes.

In order to combat false credentials and gain insight into potential candidates, hiring managers have turned to web search engines and social networking sites to augment their screening process. According to a survey last October, hiring managers claimed that up to a third of candidates lied about their qualifications.

In addition, about one in ten candidates had posted inappropriate messages or images in public forums, making them less desirable than candidates who always appear professional. The problems with having a less than stellar online persona were covered in a recent NPR story.

However, while resume padding has been around for years, online impersonation has only begun playing a role. What if your online profile included an inappropriate statement that you never made? In most online forums, anonymity and impersonations are trivially accomplished since you are never asked for verifiable information during enrolment. This becomes a two-stage problem. First, you must be able to identify that an impersonation is taking place. And second, you need to know how to take corrective actions.

Bad impersonations

When people think of impersonations, they usually think of identity theft and financial crimes. However, the impacts from online impersonations can be significant.

For example, one of my associates had a free email account similar to "john.doe@gmail.com". Someone with a grudge registered "john_doe@gmail.com" (underscore instead of a period) and began to send out emails that impersonated the individual. The emails were intended to undermine his credibility. Unless you looked very closely at the email sender's address, you would not realise that it was an imposter. As another example, in 2006 a police officer impersonated his ex-girlfriend and used the account to solicit dates. Men actually appeared at her house expecting a romantic interlude.

While financial impersonations may take years to rectify, information and false postings on the web may circulate indefinitely. Distinguishing fact from fiction and true actions from an imposter's can be virtually impossible. The requirements for removing an imposter vary from simple web forms to nightmarish runarounds.

Top 5 reasons to deploy VMware with Tegile

Next page: Hunting imposters

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.