Arizona laptop farmer pleads guilty for funneling $17M to Kim Jong Un An Arizona woman who created a "laptop farm" in her home to help fake IT workers pose as US-based employees has pleaded guilty in a scheme that generated over $17 million for herself... and North Korea. Christina Marie Chapman pleaded guilty to conspiracy to commit wire fraud, aggravated identity theft, and conspiracy to …
These middlemen (or women in this case) are disposable. The malware has probably already been planted and might be nigh impossible to detect if done properly. The only way to be sure is to rip out everything and start rebuilding the IT infrastructure from scratch. Only DATA can be restored, not complete software installations which have turned toxic.
It's a lot of work, but it's the only way to be sure.
For having gone through an extensive job search a few years ago, all I can say is - serves them (companies) well.
The hiring processes are insane, very similar to climbing through phone support to get to a human, then to a competent human.
The automatic sorting and resume optimization requirements to break through to a human reviewer are debilitating, and the interviews are a process which in many cases is painful for both sides. I'm ready to bet that at least a few of these hires were strongly suspected come interview time and didn't pass the sniff test, but were let through by sheer fatigue or out of spite. And that for the companies that don't have confidential intellectual property it was probably not the worst deal of the century in the short term to hire a maniacally trained worker, and who cares about the long term nowadays.
If there's one thing that is cutely refreshing, it's to apply for a position at 1am and to receive a "After careful review and consideration it's a nope" reply email at 1:04am.
Be human, hire like a human, and you'll hire the right human.
Many companies demand you supply personal and resume information in a certain fixed format or enter it into a website so some AI can evaluate you. It wouldn't surprise me in the least that in a couple of months or years there will be no human in the loop to hire you. It will all be A.I.
Gaming the A.I. will become the next prerequisite skill.
I didn't see anything about that. Getting lists of SSNs is pretty easy, no need to use the same one for them all.
If the government (of either party) was ever really serious about preventing illegal immigration, they would have attacked it at the source. Jail time for employers who hire illegals if you don't use the e-verify system to verify their credentials, or pay them without filing the proper tax forms and withholding. Just about every reputable small business owner does all this. I did when I owned a small business. The only reason to not do it is because you want pay below minimum wage, or pocket the taxes you have "withheld" from them.
Even Trump and his merry band of MAGA loonies are afraid of the farm lobby so with all their tough talk about deporting everyone they're afraid to do anything against the farmers who hire illegals and give them a financial incentive to come here and stay here.
I'm sure e-verify isn't foolproof, but it would catch the common stuff like fake SSNs or SSNs of deceased or imprisoned people.
The simple way to fix this would be a national ID. SSNs are being used as semi-IDs; they were not intended to be IDs, and when I got my first SSN card it had printed on it in big red bold print "Not for use as an ID". If there was a real national ID, with, say, a 15-digit alphanumeric or at least numeric code not a 9-digit code numeric restricted by state and year, faking this kind of thing would be a lot harder. Link the DL to the ID, link the passport to the ID, hell link the SSN to the ID... but have an ID. Except that it's not going to happen, the only thing which will cause more frothing at the mouth than attempting to grab guns is attempting to set up a national ID. Even the half-hearted Real ID star in DLs is causing screaming and shouting.
How would that fix anything? If you have to submit it to anyone for a job, opening a bank account etc. then it becomes just as vulnerable to be being stolen/re-used as an SSN. If you don't allow businesses to ever see someone's NID then it can't improve things.
SSN wasn't intended to be used as an ID, but it is. So we have to deal with what we got.
"The simple way to fix this would be a national ID. SSNs are being used as semi-IDs; they were not intended to be IDs, and when I got my first SSN card it had printed on it in big red bold print "Not for use as an ID". If there was a real national ID, with, say, a 15-digit alphanumeric or at least numeric code not a 9-digit code numeric restricted by state and year, faking this kind of thing would be a lot harder."
One ID to rule them all and in the darkness bind them. A national ID is fraught with all sorts of new abuses that can be perpetrated and would be even harder to fix.
It's not so much that an SSN is used as an ID, that's what telephone numbers are for, but that it's required for legal employment and isn't being monitored in a way that prevents people and employers from circumventing employment laws. Not only could it be used to prohibit people that aren't eligible for employment in the US, it would also prevent people from using somebody else's SSN if they have outstanding taxes due and are trying to sidestep paying them.
"Even the half-hearted Real ID star in DLs is causing screaming and shouting."
It's more lines to stand in, more forms to fill out and trying to find one's damn birth certificate that's in a box somewhere when they've already been continuously licensed to drive in their home state for decades. The same birth certificate that was needed when first getting a driving license ages ago and a SSN. I haven't bothered since I don't have any plans to fly anywhere and they can come to me if I am not allowed to enter a Federal building, and why would I want to? I really don't want to go the county where I was born, stand in lines at the recorder's office (on the day/hours they are open) and pay money to have a copy made of the microfiche (if they still have it). I'm quite sure that the government knows who I am to several decimal places without me having to do the leg work.
" Getting lists of SSNs is pretty easy, no need to use the same one for them all."
The name on the SSN needs to sorta match the person claiming it's theirs and also needs to pass muster when run through E-verify. Even with employers using E-verify, there's plenty of problems since the system isn't saying "I've already got somebody or several somebody's in the system miles away working" and throwing back a query.
The system does catch fake SSN's while not barking even if a real one is obviously being used fraudulently.
The employers hiring illegals aren't using e-verify. There has been legislation proposed to make it mandatory for everyone but it is always shot down for various excuses like "don't want to add more burdensome regulation" and especially because the big corporate farms that hire them don't want to hire workers who have rights like minimum wage, overtime, safe working conditions and so forth. They also want to pay in cash to avoid paying the tax they legally owe on employee labor. They donate heavily to republicans to make sure that all the blowback on illegal immigrants falls only on them and not those who knowingly hire them.
Bullshit. it is _trivial_ to generate lists of valid SSNs. The first three digits are assigned by state, see https://www.ssofficelocator.org/social-security-number-prefix-listamong many, many, MANY other sites for a list. The next two numbers vary by date and location; again, it is trivial to generate lists of valid digits by just going to the right site. See, for example, https://stevemorse.org/ssn/ssn.html The last four digits are easily determined. In many cases people will give you the last four of their SSN if you just ask, and there are validators by the score available. See, for example, https://www.ssn-verify.com
Give me half an hour and I will have a hundred plus valid SSNs complete with names and last known addresses. Give me some more time and I will check the valid SSNs for, oh, underage children, who will never have used their SSNs and will not know for years that something is going on, or for dead people who by definition won't be checking anything. Apparently 11 year olds and dead people can be employed, no problem, it's when they try to take money out that there's a problem. And if you know what you're doing you can simply generate a nice new fictitious person. Lots of nice new fictitious persons. A good source for names is to visit a few graveyards and look for people who died in childhood; if you go to certain areas when the various records have problems, there might be a birth certificate available but not a death certificate. Several parishes in Louisiana are _famous_ for this, they had record problems due to Hurricane Katrina. Apparently it's amazing just how many zombies there are in Louisiana. Some places in Florida, Alabama, Georgia, and the Carolinas are also Happy Hunting Grounds. The SSA and various other government agencies don't bother to check addresses, other than to see if the address is valid; this has been known since at least the 1970s, see further the Blues Brothers movie, Jake and Elwood gave their address as... 1060 W Addison St, Chicago, IL 60613. A.k.a. Wrigley Field, home of the Cubs. And no, this was not just made up for the movie, people did that kind of thing and got away with it for years.
"Apparently 11 year olds and dead people can be employed, no problem"
It's more difficult to work when dead these days. I haven't seen anything being mentioned about workers being in their pre-teens being an issue. What crops up is when somebody dies, there may be Social Security payouts to surviving dependents so the Administration knows that the person is deceased. With birth certificates, if the person is deceased, the death record might be someplace else so the two documents didn't get filed together. Much of that has changed over the years where those documents aren't just recorded at the local level.
While you will have a hard time getting distributions when using a number not assigned to you, that may not matter if it gets you a job. You would just file a W-4 with your employer (statement of dependents/deductions) where you claim the most deductions you can before it will trigger an inquiry. I think it's four that's pretty much a slam dunk. That way you have the least deducted for taxes as possible.
If an 11 year old is "employed" and payroll checks are being issued in their name, their parents will have their return flagged when they list them as a dependent on it and it'll be figured out.
They prefer to use SSNs of people in prison and those with severe disabilities, because they aren't employed and don't file tax returns.
"They prefer to use SSNs of people in prison and those with severe disabilities, because they aren't employed and don't file tax returns."
That's an interesting angle. I wonder about the prisoner example. Would there be some sort of accounting for any wages earned in a prison job? Somebody under conservatorship would need a Social Security Number so they can be claimed as a dependent and might not have even a token job. Filing a tax return or not might not be a concern. If the IRS sees a W-2 (income statement) from an employer for that person or a form 1099 (independent contractor payment), it might trigger something, but perhaps not a red flag with the Social Security Administration that has anybody tracking down the person using the SSN fraudulently. Two agencies not comparing notes. I somehow doubt the doggies will look into it.
How on earth do you hire somebody with access to your crown jewels without clocking them in person and maintaining that social surveillance?
Oh yes of course Fred Blogs from Bloggsville you have passed our programming challenges (Solved by instant AI.) so we TRUST you.
Can you look after Fort Knox because we need security technicians... Great! You're an expert in penetrating and etc. Jump on board!
This is basic fail. The algorithm (ie procedure) for recruiting is completely hopeless when it comes to solving the whole problem.
>It's unclear how much of the ill-gotten gains Chapman pocketed, but according to the Justice Department, Chapman's overseas IT workers received more than $17.1 million for their work.
Probably it was barely even five figures total. These type of operations tend to rely on the naive and desperate who are getting a pittance and unaware of just how much they're generating for their overlords. The full details probably won't be disclosed, but I'm willing to bet the laptops were supplied by a middleman already set up and her involvement was to just make sure they remained plugged in and with an internet connection.
GDP is a useful number in some cases, but it isn't comparable in this case. North Korea doesn't publish GDP figures of their own, but estimates put it at $15 billion. However, a lot of that is never in cash; if someone in North Korea does some farming and someone eats the crops, nobody got any money but it adds to GDP. North Korea has lots of labor, treating almost everybody as slaves will give you that, but they don't have a lot of cash with which they can buy things they don't know how to make.
It's also worth keeping in mind that this was just one operation among many for them. They have more than one laptop farmer and they operate their tech worker scheme in many countries. They do all sorts of other things to get money, from organizing thefts from banks, both retail and central, to hacking anything with cryptocurrency in it, from personal wallets to large exchanges.
Hard currency is quite a big thing for North Korea. They want to import many things they don't have the capacity to make locally, but unlike Russia or other countries in that position, they don't have much they can export to earn the money to do it. If Russia wants some chips, they can sell some oil or minerals for cash and use that to buy the chips. North Korea finds stealing that money to work better because most of the things they make are either needed locally or made inefficiently compared to neighbors. For example, North Korea does make a lot of some agricultural goods, but China makes them much more efficiently, so China exports lots of those things and nobody buys North Korea's, which is actually fine because the North Koreans need to eat something and they don't import food.
So in reality, I think this is mostly about the money, and the backdoors they might install are also about going back and getting more money. Most of their major intrusions are the same thing. North Korea's known attacks are very heavily concentrated in three sectors: cryptocurrency companies, from which they steal money, banks (both retail and central), from which they steal money, and security companies, from which they steal exploits and use them on other people, again concentrated in those three areas.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
