Drug Smuggling Scheme Teaches Database Security Lesson

PC Mag, July 25, 2011

An NPR story describes how Ana Isela Martinez Amaya, an innocent Mexican who commuted across the border to the US to teach school, was used unwittingly to smuggle marijuana in her car. She spent more than a month in jail before being cleared by a separate police investigation of the gang that framed her. The smugglers had a clever methodology with a tech angle: They would look at the border crossing, and specifically for those who used the SENTRI (Secure Electronic Network for Travelers Rapid Inspection) Express Lane and who drove Fords. (SENTRI is “Customs and Border Protection’s trusted traveler program for approved frequent border crossers. SENTRI allows members access to a dedicated commuter lane that expedites crossing between the U.S. and Mexico.”). The smugglers would follow the mark and get their VIN (Vehicle Identification Number) off of the dashboard. They had the cooperation of a corrupt locksmith with access to Ford’s key/VIN database who would then supply them with a key. They used this key to stash drugs in the victim’s car.  Hat tip to Bruce Schneier. As Schneier says, This attack works because 1) there’s a database of keys available to lots of people, and 2) both the SENTRI system and the victims are predictable. The predictability of SENTRI is a problem, but the easy access to the Ford database strikes me as a much more disturbing vulnerability. Then again, the problem of corrupt locksmiths is a longstanding one. Such people have long been able to get away with things.  http://blogs.pcmag.com/securitywatch/2011/07/drug_smuggling_scheme_teaches.php

Advertisements
  1. Leave a comment

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: