{"id":10431,"date":"2017-11-12T04:45:38","date_gmt":"2017-11-12T12:45:38","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/11\/12\/news-4204\/"},"modified":"2017-11-12T04:45:38","modified_gmt":"2017-11-12T12:45:38","slug":"news-4204","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/11\/12\/news-4204\/","title":{"rendered":"Donald Trump\u2019s Taxes Have Probably Already Been Hacked"},"content":{"rendered":"

Credit to Author: John Powers| Date: Sun, 12 Nov 2017 12:00:00 +0000<\/strong><\/p>\n

A private investigator <\/span>named Jordan Hamlett is heading to trial<\/a> next month in Louisiana for allegedly attempting to illegally obtain President Trump\u2019s income tax returns. Hamlett's defense attorney says he\u2019s a well-intentioned white hat hacker engaged in ethical acts, who was trying to notify the IRS that its system was vulnerable. He now faces up to five years in prison.<\/p>\n

John Powers (@johnpowerspi<\/a>) is president of Hudson Intelligence<\/a>, an investigative firm in New York specializing in complex fraud and financial investigations.<\/p>\n

Whether his motivation was good or bad, Hamlett's hacking skills apparently weren\u2019t great. Court records suggest he disregarded basic lessons of Hacking 101: First, don\u2019t use your personal cell phone when penetration-testing the federal government; and second, don\u2019t immediately confess when FBI and IRS agents engage you in a conversation in the lobby of an Embassy Suites hotel in Baton Rouge. Despite his rookie mistakes, Hamlett reportedly came close to getting the president\u2019s personal tax information. And that says a lot.<\/p>\n

Considering Trump\u2019s risk profile<\/a>, the determination of his detractors, and the current state of cybersecurity, it\u2019s almost inconceivable his tax returns haven\u2019t been hacked\u2014successfully\u2014by someone with more experience and expertise.<\/p>\n

After all, American taxpayers should assume their personally identifying information is already\u00a0in the hands of criminals and then act accordingly, as former IRS commissioner John Koskinen recently told<\/a> reporters.<\/p>\n

For Trump, this is a no-brainer. After he declined to disclose his tax filings during the presidential campaign, the hacker collective Anonymous<\/a> released his (unconfirmed) Social Security Number, birth date, and cell phone number and vowed to expose his financial entanglements. Would-be whistleblowers were rallied by WikiLeaks, while one high-profile Democrat offered a $5 million reward<\/a> for anyone who legally leaked Trump\u2019s financials.<\/p>\n

The IRS isn\u2019t an impenetrable fortress. Hamlett, the private investigator in Louisiana, allegedly targeted a vulnerability in an online IRS tool for students applying for financial aid. Fraudsters used the same system to steal the data<\/a> of up to 100,000 taxpayers. Previously, vulnerabilities in the IRS's Get Transcript service led to unauthorized access to 724,000 taxpayer accounts. After these security lapses the IRS awarded a no-bid contract (now suspended) to Equifax<\/a> for fraud protection services, soon after the credit bureau breached data<\/a> of 145 million people.<\/p>\n

Any sophisticated hacking operation would also focus on affiliated companies, associates, and third parties. Trump\u2019s tax filings have passed through many, many hands\u2014and every contact represents an attack vector. Consider the number of accountants, lawyers, ex-wives, banks, lenders, and business partners Trump has had in the past 20 years. How many have requested and inspected a portion of his personal finances? Those records may now be stored unencrypted in the cloud; they may be sitting on an insecure email server, or locked in a drawer and available for review by an after-hours cleaning crew.<\/p>\n

As that fellow from Anonymous<\/a> in the Guy Fawkes mask put it: \u201cInformation doesn't\u00a0vanish, it is all out there.\u201d So why hasn\u2019t it been leaked?<\/p>\n

Equifax Deserves the Corporate Death Penalty<\/p>\n

He Perfected a Password-Hacking Tool—Then the Russians Came Calling<\/p>\n

Yahoo's 2013 Email Hack Actually Compromised Three Billion Accounts<\/p>\n

Conspiracy theorists have suggested Putin\u2019s cyberbullies hacked the returns, and are using them as kompromat<\/em>\u2014compromising material\u2014for\u00a0blackmail<\/a>. But if you\u2019ve already given the information to the IRS, in writing, what\u2019s left to expose? It\u2019s not as if Trump prepared his returns by turning on TurboTax and rummaging through a shoebox of crumpled receipts. His filings have been professionally prepared and vetted by teams of accountants and attorneys. His tax counsel issued a memorandum<\/a> earlier this year stating a review of Trump\u2019s tax returns for the past decade did not show income from Russian sources, save for a few exceptions.<\/p>\n

Of course, the same boilerplate assurance probably could have been made for commerce secretary Wilbur L. Ross Jr., until his financial ties to Putin\u2019s family and associates were leaked in the\u00a0Paradise Papers<\/a>, revealing connections previously obscured by a chain of offshore companies in the Cayman Islands.<\/p>\n

If foreign intelligence services have obtained Trump\u2019s financial records, we might never learn what they found. Cyberattacks of the US Office of Personnel Management<\/a> lasted a full year before being detected in 2015. By then, hackers had obtained confidential records on 19.7 million applicants for security clearances, required for the most sensitive jobs in the federal government. US officials have privately blamed China, but the stolen information was never publicly leaked. The perpetrators didn\u2019t design and deploy an advanced persistent threat because they wanted to publish their findings.<\/p>\n

In the end, how damaging could Trump's taxes be? Among the few scoops on the subject,\u00a0The New York Times<\/em>\u00a0last year published pages<\/a> from his state tax returns from 1995, which showed a $916 million loss. Hardly a stellar year\u2014but not a secret, either. Trump\u2019s wealth spiral was well documented in the 1990s, when four of his businesses filed for bankruptcy<\/a>. His supporters aren\u2019t bothered by the revelation that he\u2019d lost nearly a billion dollars, because they admire his huge appetite for risk.<\/p>\n

And when Rachel Maddow released a summary of Trump\u2019s federal tax filing from 2005\u2014showing he paid $38 million in taxes on income of more than $150 million\u2014the MSNBC journalist was lambasted<\/a> by liberals and conservatives for overhyping an inconsequential story. There was no sign of anything improper or illegal. No company names in Cyrillic, no income recorded in rubles. Maybe the tax returns just aren\u2019t that juicy.<\/p>\n

WIRED Opinion publishes pieces written by outside contributors and represents a wide range of viewpoints. Read more opinions here<\/a>.<\/em><\/p>\n

Phishing scams are getting more and more sophisticated, to the point where they\u2019re fooling even security experts. Here's how to avoid them.<\/p>\n

https:\/\/www.wired.com\/category\/security\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Credit to Author: John Powers| Date: Sun, 12 Nov 2017 12:00:00 +0000<\/strong><\/p>\n

Opinion: The IRS isn\u2019t an impenetrable fortress. Someone has Trump’s taxes; the question is, who?<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10378,10607],"tags":[234,714],"class_list":["post-10431","post","type-post","status-publish","format-standard","hentry","category-security","category-wired","tag-opinion","tag-security"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/10431","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=10431"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/10431\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=10431"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=10431"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=10431"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}