Man faces 800-plus computer misuse charges; guessed passwords to SingPass accountsPublished on May 23, 2015 8:40 AM
By Elena Chong Court Correspondent
A man was charged yesterday with more than 800 offences under the Computer Misuse Act.
James Sim Guan Liang, 39, faces 293 charges of unlawfully disclosing SingPass passwords to a person with the pseudonym "Lemon" for the purpose of helping "Lemon" and other unknown persons to make a false statement to get a Singapore visa.
Sim, an administrative assistant then,
guessed the passwords of the 293 account holders by entering their
SingPass and
identity card numbers in the login fields.
The alleged offences took place at a flat in Toa Payoh from March to May 2011.
Between January and May the same year, he allegedly committed 575 counts of unauthorised access into the homepages of Central Provident Fund Board members, and a Media Development Authority server.
Sim's lawyer G. Gopalan asked for time to make representations.
Deputy Public Prosecutor Jeremy Lua told District Judge Eddy Tham that the prosecution was finalising further charges under the Immigration Act and National Registration Act.
Responding to media queries if this was a "hacking" case, the Attorney-General's Chambers said that no hacking of the SingPass infrastructure was detected.
"In fact, the
methodology was very simple. The accused guessed the passwords of the accounts in question. This was possible because all the accounts used
passwords based on the NRIC of the account holder."
A pre-trial conference is scheduled for June 26.
The maximum penalty for disclosing a password to gain access to a program or data held in any computer is a $10,000 fine and three years in jail on each charge.
If convicted of unauthorised access, Sim could be fined up to $5,000, jailed for up to two years, or both.
Source:
http://www.straitstimes.com/news/singapore/courts-crime/story/man-faces-more-800-computer-misuse-charges-20150523
Man jailed for cracking passwords of SingPass account holders and selling details to China-based syndicateMar 25, 2016 6:00am
By RONALD LOH
If you do not make the effort to think of a good password, you are inviting trouble from hackers, cyber security experts here warned.
This is especially crucial if the password is for your SingPass account, which can reveal sensitive information such as your Central Provident Fund (CPF) account, your address and how much you earn.
Yesterday, a former administrative assistant was jailed five years and two months for cracking the passwords of 293 SingPass account holders and selling the details to a China-based syndicate to produce sham Singapore visa applications.
This happened after James Sim Guan Liang, 39, realised that some people used their NRIC number as their SingPass password.
Mr David Freer, vice-president of Intel Security's Asia Pacific Consumer business, said cyberattacks happen daily and it may be inevitable that your account is targeted.
To protect yourself, ensure that you use a strong password - one that has at least eight characters and contains numbers, symbols and upper and lowercase letters for best effect - and different ones for your various online accounts, he said.
"The first line of defence for keeping your online data safe is your password. You should always use a complex and hard-to-guess password," he said.
Mr Freer added that passwords should be changed every three to six months.
In January, password management firm SplashData analysed more than 20 million passwords that were leaked globally over the last year and published the worst ones.
The list was topped by "123456", "password" and "qwerty" - the first six letters on the top row of a regular keyboard.
New entries on the list, now in its fifth year, include pop culture references like "star wars", "solo", and "princess", following the release of the latest Star Wars movie.
Mr Chooi Ker Ming, Fortinet Singapore's network security consultant, said hackers look for passwords that give the highest returns-on-investment.
"Instead of investing in a costly high-powered server for brute force password cracking, they usually do a scan with a general server and take out the easiest targets.
"The low-hanging fruits - accounts with the easiest-to-break passwords such as '1234567' or 'password' - are compromised first," he said.
This becomes especially dangerous if that account is your SingPass account, considered "very valuable" to hackers, said Mr Freer.
BLACK MARKET
"Through an illegally gotten password, cybercriminals are able to find out a person's address, how much he earns, how much money he has in his CPF account, who he is married to and more.
"Such information enables them to carry out more serious crimes, or sell the information within the black market," he said.
Mr Chooi also advised Internet users to use e-services that have a second layer of security such as two-factor authentication (2FA), a process involving a one-time password (OTP) that is randomly generated and delivered via SMS or through a token.
From July 5, SingPass users will require an OTP to transact with the CPF Board, Inland Revenue Authority of Singapore, Ministry of Manpower and Accounting and Corporate Regulatory Authority.
Said Mr Chooi: "With 2FA, you don't have to worry about password changes, since the OTP generated is valid for a particular transaction only."
The low-hanging fruits - accounts with the easiest-to-break passwords such as '1234567' or 'password' - are compromised first.
About the case
Former administrative assistant James Sim Guan Liang, 39, was sentenced to
five years and two months' jail yesterday for cracking SingPass accounts and selling them to a China-based syndicate.
He faced 886 charges, mostly under the Computer Misuse Act, and pleaded guilty to 73 of them in January. The rest were taken into consideration.
Court papers said he spent thousands of hours on his computer to crack the passwords of 293 SingPass accounts.
All his victims had used their NRIC number as their password.
The Chinese syndicate he sold the credentials to used the information to apply for sham visas for foreigners to enter Singapore. Some of them later committed crimes here.
Yesterday, District Judge Low Wee Ping said in sentencing that the number of charges were staggering and he could not regard Sim as a first-time offender even though this was his first brush with the law.
Noting that Sim had unlawfully accessed the computer systems of the Media Development Authority (MDA) and the Central Provident Fund Board (CPF) 577 times to harvest information, the judge said: "It is no different from breaking into a home 577 times."
Source:
http://www.tnp.sg/news/singapore-news/man-jailed-selling-singpass-account-details-syndicate