Deriving Mothers Maiden Names Using Public Records

1
Deriving Mothers Maiden Names Using Public
Records
Virgil Griffith Undergraduate Research
AssistantIndiana University griffitd_at_indiana.edu
DIMACS Security WorkshopRutgers University
2
Our Approach

• Data-mine online public records databases which
  are required by law to be public
• Use heuristics to deduce maiden names
• On a large enough scale, even the easiest cases
  lead to massive compromise.
• Could be applied anywhere, for simplicity we
  focused only on Texas.

3
Why Texas?

• Large population
• Significant in of itself
• Closer to national averages than California.
• Large states have good online records.

4
Surveying Potentially Useful Public Records

• US National Census
• Voter Registration Records
• Property Records
• Phonebooks
• Newspaper Obituaries
• Social Security Death Index
• Marriage Records
• Birth Records

• ?
• ?
• ?
• ?
• ?
• ?
• ? ?
• ? ?

5
Searching for Free Birth/Marriage Records

Add 4,499 Texans Fully Compromised 4,499
6
Texas Dept. of Vital Stats

• State archive for all vital information
• 1966-2002 Marriage index Online
• 1968-2002 Divorce index Online
• 6,174,968 Marriage Records
• Informs us that
• In Oct. 2000 Birth indexes taken offline
• In June 2002 Death indexes also taken offline
• 2,431,967 Birth Records

Texans Fully Compromised 4,499
7
Low Hanging Fruit in Birth Records

• 1923-1949 Births have MMN in plaintext!
• 1,114,680 Males Auto-compromised
• 1,069,448 Females in records
• Connecting females born 1923-1949 to Marriages
  1966-2002 gives 288,751 compromises (27).
• 1950-1995 has 40,697 hyphenated last names

1,114,680288,751Texans Fully Compromised
1,407,930
8
Analysis Work So Far

• Children will have same last name as their
  parents
• Suffixed Children will have same first and last
  name as parents
• Children often born shortly after parents
  marriage
• Children born shortly after parents marriage
  often born in same county.
• Attackers dont have to pick the correct
  parents,just the correct MMN!

Texans Fully Compromised 1,407,930
9
Example 1
Ernest AAKQUANAHANN Dionne COX
Mothers Maiden Name COX Entropy 0 bits
Texans Fully Compromised 1,407,930
10
Example 2
Shawn ZUTTER Lisa MENDOZA
Chad ZUTTER Lauren LANDGREBE
Mothers Maiden Name ? Entropy 1 bit
Texans Fully Compromised 1,407,930
11
Example 3
Robert STUGON Duarte STURNER
Jim STUGON Luann STURNER
Mothers Maiden Name STURNER Entropy 0 bits
Texans Fully Compromised 1,407,930
12
Results Knowing Victims Lastname
Texans Compromised 1,407,930
13
Results Marriages Compromised via Last Name
82,272 Texans Fully Compromised 1,490,202
14
Results Suffixed Children
344,463Texans Fully Compromised 1,834,655
15
Results Knowing Victims Lastname Age
Texans Fully Compromised 1,834,655
16
Work In Progress Assuming born 5 years from
Marriage Same County
2,355,828Texans Fully Compromised 4,190,493
17
Future Work

• Add more birth records to see if birth
  compromises goes up.
• Parents names often repeated in their childrens
  names.
• Factor in Grooms suffix when looking for Suffix
  Children
• Factor in Divorce Records
• Factor in SSDI/State Death Records

FINAL Texans Compromised 4,190,493
20.09 of state population
18
End
Work further described in V. Griffith, M.
Jakobsson (2005) Messin with Texas Deriving
Mothers Maiden Names Using Public Records