I rented a car, and within hours, my driver’s license was for sale

我租了一辆车，几小时内我的驾照就被挂在网上售卖了

Not long ago, I rented an SUV from a well-known car rental company. Within hours of an employee scanning my driver’s license, a high-resolution scan of my ID was available for sale on the dark web. 不久前，我从一家知名租车公司租了一辆 SUV。在员工扫描我驾照后的几个小时内，我身份证件的高清扫描件就已经在暗网上公开售卖了。

An exposé published Tuesday by KrebsOnSecurity reports that my license was one of more than 153 million that were available through Nexus, the name of the new ID theft service. Like other driver’s licenses available there—including some belonging to journalist Brian Krebs, his mother, an FBI assistant director, and several security researchers—my license was purported to include multiple image files showing both the front and back of the ID. KrebsOnSecurity 周二发布的一篇调查报道指出，我的驾照是 Nexus（一个新型身份盗窃服务平台）所提供的超过 1.53 亿份证件之一。与该平台上其他可用的驾照一样——其中包括记者 Brian Krebs 本人、他的母亲、一位 FBI 助理局长以及多名安全研究人员的证件——我的驾照据称包含了显示证件正反面的多个图像文件。

Besides a basic image scan, the files also captured the images in the infrared and ultraviolet spectrums. Presumably, the additional formats may allow cloned-based counterfeit IDs to pass hologram tests. 除了基础的图像扫描外，这些文件还捕捉了红外和紫外光谱下的图像。据推测，这些额外的格式可能使克隆的伪造证件能够通过全息防伪检测。

Growing by the day

规模与日俱增

Besides advertising the availability of driver’s licenses, Nexus offered to sell a bevy of other forms of ID. They included: Identification cards, Travel cards, International DL/ID, Medical cards, Common Access Cards, Residence cards, and Employment authorizations. 除了宣传驾照的可用性外，Nexus 还兜售多种其他类型的证件，包括：身份证、旅行证件、国际驾照/身份证、医疗卡、通用门禁卡（CAC）、居留证以及就业许可证明。

Krebs said the FBI is investigating. Some of the records Krebs observed listed their “source” as “CDL,” which may be short for “commercial driver’s license.” Other records identified the source notation as “CAC,” which may refer to Common Access Cards, which Krebs said are “government issued identity cards that grant physical access to government buildings and secure rooms.” Krebs 表示 FBI 正在进行调查。Krebs 观察到的一些记录将其“来源”标注为“CDL”，这可能是“商用驾照”的缩写。其他记录则将来源标注为“CAC”，这可能指代通用门禁卡。Krebs 称这些是“政府签发的身份卡，用于准许进入政府大楼和安全房间”。

Nexus also claimed to provide scans of marijuana dispensary cards. One of the victims he talked to reported visiting a Las Vegas outlet of Planet13, a multi-state dispensary chain. Nexus 还声称提供大麻药房会员卡的扫描件。他采访的一名受害者表示，曾去过跨州大麻药房连锁店 Planet13 的拉斯维加斯分店。

The timing of newly available scans—typically within a day, if not hours, of me and a small sample of other victims presenting them at rental companies or others—likely means that Nexus has near real-time access to data flowing through the third-party scanning service these businesses are using. 新扫描件出现的时间点——通常在我及其他少数受害者在租车公司或其他机构出示证件后的几小时甚至一天内——很可能意味着 Nexus 能够近乎实时地访问这些企业所使用的第三方扫描服务中的数据流。

Over a span of 24 hours, Krebs said the number of driver’s licenses listed as available grew by almost 400,000. That’s another indication that the breach has been ongoing and new cards become available shortly after they’re harvested. Krebs 表示，在 24 小时内，可供出售的驾照数量增加了近 40 万份。这进一步表明数据泄露一直在持续，且新证件在被窃取后很快就会上线。

Using publicly available information, Krebs found that IDScan.net, a New Orleans-based ID scanning service, has announced an exclusive arrangement with Planet13. It also listed Hertz and 11 other companies as using its services. IDScan.net went on to say that its scans capture both infrared and ultraviolet spectra. Representatives from IDScan didn’t immediately answer questions sent by email. An IDScan.net spokesperson told Krebs the company is investigating. My car rental company representatives also didn’t immediately answer questions. 通过公开信息，Krebs 发现总部位于新奥尔良的身份扫描服务商 IDScan.net 宣布与 Planet13 达成了独家合作。该公司还列出 Hertz 及其他 11 家公司作为其客户。IDScan.net 此前曾表示其扫描件能够捕捉红外和紫外光谱。IDScan 的代表未立即回复电子邮件询问。IDScan.net 的发言人告诉 Krebs，公司正在进行调查。我所租车的公司代表也未立即回应提问。

The availability of my driver’s license to anyone willing to cough up a fee isn’t exactly a comforting thought. Yes, my personal details—including current and former addresses, Social Security number, demographics, and more—have been breached before, just as they have for millions, if not billions, of others around the world. This dump is more troubling because of the purported availability of scans in ultraviolet and infrared. 我的驾照可以被任何愿意付费的人获取，这实在令人不安。诚然，我的个人信息——包括现住址和曾用地址、社会安全号码、人口统计学信息等——此前也曾遭到泄露，就像全球数百万甚至数十亿人一样。但这次泄露更令人担忧，因为其中包含了据称是紫外和红外光谱的扫描件。

Fortunately, Nexus went dark within hours of the KrebsOnSecurity scoop, although that also means there’s no way for people to check if their IDs are included. Also somewhat consoling is the ongoing investigation by the FBI. 幸运的是，在 KrebsOnSecurity 曝光后，Nexus 在几小时内就下线了，尽管这也意味着人们无法核实自己的证件是否在泄露之列。FBI 正在进行的调查也算是一种慰藉。