Re: Bare Social Social Security Numbers

["H. Morrow Long" <morrow.long () YALE EDU>]

On Mar 28, 2006, at 10:39 AM, Keith Schoenefeld wrote:
> I think it would be awfully tough for someone to actually put names
> to the SSNs.

The following are advertised on Google:

Social Security Numbers
Lookup SSN Number online.
Get instant access now.
www.SSN-Finder.com

Reverse SSN Lookup
Enter a name or SSN & get info.
Start with your preliminary search.
www.civilrecords.org

Find Annyone by SSN #
Money Back Guarantee
Locate Someone Today only $19.95
socialsecuritysearchusa.com

SSN #s Lookup.
Lookup SSN #. Verify People Info,
Contacts, Background Check, More.
www.check-ssn.com

SSN Verification
SSN Verification Solutions. Aliases
Addresses And Phone Numbers.
www.ewoss.com

There is also an interesting project involving SSNs at CMU:
        http://privacy.cs.cmu.edu/dataprivacy/projects/ssnwatch/
identitytheft.html

> On a side note, we had a recent scare on campus where a faculty
> member had created an example database using real student names
> combined with a set of SSNs, addresses, phone numbers, etc. that
> were made up.  ...

According to the SSA there are a few sample SSA's which can be openly
used and
displayed -- such as 123-45-6789 and 999-99-9999.

Webpage http://www.socialsecurity.gov/employer/stateweb.htm states
"Any number beginning with 000 will NEVER be a valid SSN."

No SSNs have apparently ever been issued beginning with a 9 either.

I found a bunch of test SSNs at; http://www.hawaii.edu/metadir/
attributes.html#uhSSN

In google searching I did find a # of other cases where SSNs had just
been
generated out of thin air and posted on the Web (where some still are
and
some are cached in Google) as part of college programming assignments.

Using other's potential or real SSNs should be a no-no. There is now
a rule
telephone #s in movies, television and music must start with exchange
555
-- remember 867-5309, customers in many exchanges had to change their
phone numbers after that song as pranksters all over the US started
calling
it looking for Jenny.

- H. Morrow Long, CISSP, CISM, CEH
  University Information Security Officer
  Director -- Information Security Office
  Yale University, ITS