Speaker 1: Brought to you by the reinvented two thousand twelve camera.
Speaker 1: It's ready. Are you get in touch with technology? With
Speaker 1: tech Stuff from how stuff works dot com. Hello again, everyone,
Speaker 1: Welcome to tech stuff. My name is Chris Poette and
Speaker 1: I am an editor at how stuff works dot com.
Speaker 1: Sitting across from me, as always, his senior writer, Jonathan
Speaker 1: return to cinder address unknown, no such number, no such zone.
Speaker 1: So today you're not phoning it in, You're mailing it in.
Speaker 1: That's right. I have taken a step back. I'm going
Speaker 1: even I'm putting in even less effort than normal. Great
Speaker 1: that that will leave me to do my normal job
Speaker 1: of going uh huh with a whole lot of silence
Speaker 1: around it. Well, it will be a nice change. We
Speaker 1: actually have a request that came in through Twitter. So
Speaker 1: here's our tweet request from Luke. How did the epsilon
Speaker 1: email hack work? Well, Luke, we're gonna break it down
Speaker 1: for you. Um Now, first, before we talk about how
Speaker 1: it worked, I guess we need to talk about what happened, right, Yes,
Speaker 1: So I can talk about this from a personal standpoint
Speaker 1: because I was one of the people affected. I can
Speaker 1: talk about this from five personal standpoints. Yeah, if I
Speaker 1: talk about it with my wife in mind, I think
Speaker 1: I probably close to the same number. I only received
Speaker 1: one email, but she apparently received several and you received five,
Speaker 1: right right, So so okay, okay, okay. So when when
Speaker 1: you're signing up for an account with a service, a
Speaker 1: notification service, or you're buying something from someone and somebody
Speaker 1: somebody that that you know, somebody that you trust, uh,
Speaker 1: and you go and you you see the little thing
Speaker 1: where it says by accepting that clicking this box, you
Speaker 1: agree to the terms of service and the privacy policy.
Speaker 1: And sometimes you do and sometimes you don't click on
Speaker 1: the links for those things and read through them. Uh,
Speaker 1: there's this one little piece of language you probably have
Speaker 1: seen if you've actually gone to look at those and
Speaker 1: that's that part where it says, I agree to have
Speaker 1: my data shared with our trusted business partners and uh,
Speaker 1: basically for the for the purpose of delivering services to you.
Speaker 1: So if if you let's let's say you've you've you've
Speaker 1: decided to sign up for your local grocery stores rewards
Speaker 1: program and because you know you can get you know,
Speaker 1: twenty cents off this and fifty cents off that when
Speaker 1: you show your card, and lots and lots of people
Speaker 1: do it. Um some people don't because they feel like
Speaker 1: it's an invasion of privacy. Well, you know, maybe it is,
Speaker 1: maybe it isn't. In this case it is, but out
Speaker 1: they were right. But so, so what happens is you've
Speaker 1: signed up for this deal, you get the little card
Speaker 1: to put in your little key fob to put on
Speaker 1: your your key chain so that they can scan it.
Speaker 1: And then what happens on the other side is the
Speaker 1: company says, well, you know what, this is a lot
Speaker 1: of work maintaining this giant database of people who are
Speaker 1: our beloved customers. And you know, of course they are
Speaker 1: because they're spending money with it, and we have you know,
Speaker 1: our our business is not the maintaining of a database.
Speaker 1: Our business is blah blah blah. Absolutely and if you're
Speaker 1: doing blah blah blah, you you want somebody and you
Speaker 1: need somebody you trust that literally, they are a trusted
Speaker 1: business part. You want to find somebody who can maintain that.
Speaker 1: And so what's going on here is they say, well, okay, hey,
Speaker 1: you guys over here, can you manage our marketing database
Speaker 1: for us? Send out the weekly flyer for us, you know,
Speaker 1: for the people who want that, uh, you know, keep
Speaker 1: track of the rewards points that they've earned when they
Speaker 1: shop with us. Can you do that? And they say, oh, absolutely,
Speaker 1: you can trust us. Yes, And and the whole point
Speaker 1: here is again, the company the in question is trying
Speaker 1: to let's just say that it's a for for the
Speaker 1: basis of this discussion, let's say it's a retailer. So
Speaker 1: we're saying this is a major retailer of of consumer products,
Speaker 1: and that the major retailer, you know, their concentration is
Speaker 1: keeping inventor or a selling products, moving, moving the marketing.
Speaker 1: You know, they got a lot of demands on their attention.
Speaker 1: So it makes sense to to outsource this database management
Speaker 1: to another company and then the retailer can concentrate it's
Speaker 1: full focus on conducting business. What could possibly go wrong
Speaker 1: with this? So let's say that you are the company
Speaker 1: that maintains databases. All right, So your customers are these
Speaker 1: major major corporations and financial institutions. Because some of these
Speaker 1: are banks. You know, there's some banks that and credit
Speaker 1: unions that, uh use this sort of stuff. Then there's
Speaker 1: you know, retailers, there's grocery stores, there's all sorts of companies.
Speaker 1: There's travel companies, travel agencies, that kind of thing. Um,
Speaker 1: so you have all these databases, well, that means that
Speaker 1: you are also a beautiful target for people who want
Speaker 1: to get as much information about as many people in
Speaker 1: one strike as possible. That's right. If you're one of
Speaker 1: these companies, trust is and and that of customer confidence
Speaker 1: for your customers is of paramount importance. You. This is
Speaker 1: when you go and you you're you're trying to get
Speaker 1: a new client, and you go to this big, big
Speaker 1: company and you put down the portfolio of all the
Speaker 1: other companies that you're helping, and go, look at all
Speaker 1: the people who trust us. You should trust us to
Speaker 1: do business with us, and we will totally manage this
Speaker 1: affiliate marketing program you've got going. Right, So then what
Speaker 1: happens if say someone is able to infiltrate that system
Speaker 1: and steal information, Well, then you've got a breach of
Speaker 1: trust and you have the potential to lose a lot
Speaker 1: of clients really quickly because you have demonstrated that you
Speaker 1: did you were not as secure as uh you had
Speaker 1: uh made out to be. Because ultimately, this is going
Speaker 1: to affect the customers of your customers. Right, So if
Speaker 1: you're the big database company, your customers are these giant companies,
Speaker 1: like like these retailers and financial institutions. Their customers are
Speaker 1: all angry because their information has been stolen by a hacker. Now,
Speaker 1: your your average customer is probably gonna blame the retailer
Speaker 1: or the financial institution. They're not you know, they're not
Speaker 1: looking beyond that because they get an email from uh,
Speaker 1: you know, major retailer number one, and the email says, hey,
Speaker 1: guess what. Turns out system was hacked and your name
Speaker 1: and email address have been compromised. So someone has that
Speaker 1: information now. Uh. In a course of course, that could
Speaker 1: be a lot worse. It could have more of your
Speaker 1: personal identification information there, like say a social Security number
Speaker 1: or birth date, or credit card information, that kind of thing.
Speaker 1: But name and email are bad enough as it is,
Speaker 1: and we'll get into why it's bad a little bit
Speaker 1: later in the podcast. Well, you're likely to blame if
Speaker 1: you're the victim of this. So the person, the customer
Speaker 1: who's a actim of this is likely to blame the
Speaker 1: actual retailer or financial institution. Um. That's why a lot
Speaker 1: of this information, like a lot of these companies have
Speaker 1: said no, no, no, no, no, it's not our fault.
Speaker 1: It's this this company that we trusted to hold all
Speaker 1: this information for us. They're the ones who slipped up.
Speaker 1: And it's interesting how they slipped up. You know. Ultimately,
Speaker 1: we're supposed to answer the question how did this hack work?
Speaker 1: It worked on a very basic, simple level. Let's talk
Speaker 1: about a little bit about how hackers get into systems. Right. Well,
Speaker 1: you know, I've I've seen war games. Yeah, you know,
Speaker 1: I know that all you have to do is, you know,
Speaker 1: dial up a machine and and you know type until there.
Speaker 1: That is a way of doing it is called the
Speaker 1: brute force method. It's when you are trying to brute
Speaker 1: force a system by just going through a sequence of
Speaker 1: passwords until one of them works. Not terribly efficient, takes
Speaker 1: a lot of time. A lot of systems protect against
Speaker 1: it by having a shut off. So if you try
Speaker 1: to access it certain number of times with an incorrect password,
Speaker 1: you get back a message saying you've attempted to access
Speaker 1: this unsuccessfully too many times. Uh, access to this account
Speaker 1: has been shut down for fifteen minutes, and you weren't
Speaker 1: able to try and log in again until fifteen minutes later.
Speaker 1: That makes that attack even less efficient, right, because now
Speaker 1: now you're gonna have fifteen minute breaks between every five
Speaker 1: attempts you try to get in, right, and then there
Speaker 1: are some companies that completely lock you out. You know,
Speaker 1: you know three ties, you've exceeded your limit. You're going
Speaker 1: to have to call somebody to get your password reset. Um,
Speaker 1: that's more of a consumer thing, I would say, rather
Speaker 1: than the other. But I mean, you know that that
Speaker 1: kind of technique is likely to cut down on the
Speaker 1: efficiency and ability of hackers to make their way into
Speaker 1: a system using a brute force method. Yeah, and you've
Speaker 1: probably seen movies where people have sat down at a
Speaker 1: computer and either they're running some weird decryptive decrypt program
Speaker 1: which is making the letters of the past word appear
Speaker 1: one by one, or they're typing in some sequence of
Speaker 1: numbers or words or whatever and they magically get in.
Speaker 1: The truth is that about ten minutes or last? Yeah?
Speaker 1: The truth this. First of all, if you do use
Speaker 1: that method, it takes a long time. And and second,
Speaker 1: they're way easier ways of hacking into a system, and
Speaker 1: it mainly deals with social engineering. In fact, I would
Speaker 1: argue that most of the really successful hackers are masters
Speaker 1: at social engineering. That's I would agree with you. Social
Speaker 1: social engineering is manipulating people, not machines you are. You
Speaker 1: are targeting the user, You're not targeting the system. Because
Speaker 1: people are easily manipulatable, manipulate, manipulate, manipulate. You can make
Speaker 1: people do stuff easily. Yeah. UM, I think it's sort
Speaker 1: of funny because when we mentioned MAC virus is uh,
Speaker 1: we get a lot of people who say there are
Speaker 1: no Mac viruses. Well, most of the Mac viruses that
Speaker 1: are out there require you to download a disk image,
Speaker 1: double click on the disk image and make create a
Speaker 1: disk install the program, go through the prompt where it
Speaker 1: says are you sure you want to install the program?
Speaker 1: Please enter your password. There are a lot of layer yes,
Speaker 1: but what it takes to overcome that is social engineering.
Speaker 1: And that's true for any operating system that has a
Speaker 1: virus or something like that, UM in that style that
Speaker 1: a lot of these require an element of convincing uh
Speaker 1: the person to install the virus or the key logger.
Speaker 1: You know, in this case, if you're trying to break
Speaker 1: into a system, you might use a key logger, which
Speaker 1: is uh basically recording every time every key you press
Speaker 1: on the keyboard in an attempt to discover logins and passwords. Um.
Speaker 1: And so if you want to install a trojan, if
Speaker 1: you want to install a key logger or something like that,
Speaker 1: in a lot of cases you have to fool the
Speaker 1: end user into believing that that software is safe enough
Speaker 1: to install on there. So you have to say, oh, well,
Speaker 1: you know, it's just uh, you know, little RSS feed reader,
Speaker 1: it's just anti virus. You wait, hey, we discovered a
Speaker 1: virus on your your computer. You really need to download
Speaker 1: and install this free software, right, and then you click
Speaker 1: on it actually turns out to be malware. Although it's
Speaker 1: it's masked as anti virus software, right, They have to hide.
Speaker 1: That's the other part of this is once it's on there,
Speaker 1: you can't discover it and go, oh no, look I
Speaker 1: installed something terrible on my system. I need to run
Speaker 1: my antivirus software. It's got to go no, no, I'm
Speaker 1: still honestly, just this pro little program. I'm fine. Yeah. So,
Speaker 1: so social engineering can take many different forms, Like it
Speaker 1: can be as simple as walking through the front door
Speaker 1: of a company and chatting up a receptionist and just
Speaker 1: getting enough information where it gives you a guideline as
Speaker 1: to what could be a password into the system using
Speaker 1: you know, the receptionists information. That's totally possible. You could
Speaker 1: end up identifying someone who works for a company and
Speaker 1: then uh coincidentally meet up with this person in a
Speaker 1: bar just by you know, following them and going into
Speaker 1: a bar and applying them with drinks and slowly getting
Speaker 1: information out that way. There are a lot of different
Speaker 1: ways of doing it. Now, the way that this one
Speaker 1: worked was very much what Chris was saying. It was
Speaker 1: an email that came through that lured people who worked
Speaker 1: for Epsilon. Epsilon is the company that's that database manager
Speaker 1: that we've been talking about, that's the trusted business partner. Yes,
Speaker 1: that's the company that that was handling all these databases
Speaker 1: for for hundreds of clients, and this affected millions of
Speaker 1: the final customers, which you know, people like me and
Speaker 1: Chris um. So it was a it was an email
Speaker 1: that was a phishing scam and uh what it did
Speaker 1: was they it was targeting Epsilon employees in particular. And
Speaker 1: one of the scary things is that this was a
Speaker 1: known problem. Oh yes, this was something that return Path,
Speaker 1: which is a company that is used for services like
Speaker 1: tracking email delivery. It. Return Path had an alert go
Speaker 1: out on November about phishing attacks that were aimed specifically
Speaker 1: at companies like Epsilon that manage these huge databases, and
Speaker 1: essentially that alert was, Hey, we're tracking a lot more
Speaker 1: phishing attempts for people who work for these companies, and
Speaker 1: we're guessing that the reason for this is they're trying
Speaker 1: to get their hands on customer information like emails and names. UM.
Speaker 1: Just as an aside, so that people know, UM, when
Speaker 1: we talk about phishing, we're talking about the pH phishing,
Speaker 1: which is UH. This is the type of social engineering
Speaker 1: that doesn't necessarily involve software in your computer. In general,
Speaker 1: a phishing attack is UM. If you've ever seen some
Speaker 1: account an email saying that your your account has been
Speaker 1: compromised and you need to UH send your user name
Speaker 1: and password, and you realize, hey, I've never had an
Speaker 1: account at that bank. UM, And wait if I if
Speaker 1: I click on this link, it takes me to some
Speaker 1: other completely different U r L. This is a social
Speaker 1: engineering technique saying you know, we need all the information
Speaker 1: you're willing to supply us, please fill it out. We
Speaker 1: don't And and when you look at the r L
Speaker 1: and it's not the same U r L as the
Speaker 1: company that you're doing business with. They don't have access
Speaker 1: to that information. So they try to create a website
Speaker 1: that looks just like the one that you're bank uses,
Speaker 1: or your other account holder uses or account provider uses,
Speaker 1: and lure or fool you into giving away your user name,
Speaker 1: your password, any other social security any information that you're
Speaker 1: willing to give because that those types of data are
Speaker 1: the kinds of things that people can use to falsify
Speaker 1: records and steal your identity. Um so, I mean they
Speaker 1: when we talk about fishing, that's in a broad sense,
Speaker 1: they're they're trying to get important information from you by
Speaker 1: fooling you into just giving it up on your own. Yeah. There,
Speaker 1: And there are different techniques for that as well, Like
Speaker 1: if you get you can get a phishing attack where
Speaker 1: it's like Christmas saying it's from a bank that you
Speaker 1: don't even use. Those that I have no idea what
Speaker 1: you're talking. That's like a shotgun approach. I get these
Speaker 1: all the time for Blizzard World of Warcraft accounts, and
Speaker 1: I don't play funny, but I don't play World of Warcraft.
Speaker 1: But apparently this is a thing. I didn't know it
Speaker 1: was a thing. I got an email that said that
Speaker 1: my account for Blizzard had been compromised, and I thought, huh,
Speaker 1: that's a heck of a thing. I don't have an
Speaker 1: account with Blizzard. I wonder how that happened. And uh.
Speaker 1: And then I talked to Tracy Wilson, who is not
Speaker 1: only a head of our editorial department here, she's also
Speaker 1: a former World of Warcraft, let's say, enthusiast, and and
Speaker 1: she said, yeah, that's a thing. There's there's this spam attack.
Speaker 1: It's a phishing attack to try and get information from people. Uh.
Speaker 1: And now I notice if I look through my junk mail,
Speaker 1: I tend to get you know, my junk mail ends
Speaker 1: up filtering it all out, but I tend to get
Speaker 1: a few of those each week. Now, well, that's kind
Speaker 1: of like the shotgun approach to fishing, but there's a
Speaker 1: more directed approach where if the attacker has just enough
Speaker 1: information about you to kind of tailor the phishing attack
Speaker 1: to be more likely to get a hit. We call
Speaker 1: that spear fishing. I as much as I dislike fishing,
Speaker 1: I like that term. Yeah. So spear fishing is where
Speaker 1: you have identified a particular vulnerability and you're going right
Speaker 1: for it. Well, in this case, these these fishing attacks
Speaker 1: that were directed towards Epsilon employees directed the employees to
Speaker 1: a website where that contained a link that UH downloaded
Speaker 1: and auto ran some malware onto the victims computers. So
Speaker 1: that malware UH did several things. One it turned off
Speaker 1: the anti virus software on the user's computer, so now
Speaker 1: you're you're detective of on your machine has gone to sleep, right.
Speaker 1: There was a trojan key logger called i Steeler also
Speaker 1: used on that which is specifically designed to help hackers
Speaker 1: steal passwords. And then there was another tool called cybergate,
Speaker 1: which is used to gain remote control of a system
Speaker 1: once it's been compromised. So you know, you guys have
Speaker 1: heard us talk about hackers doing this with bot nets before.
Speaker 1: That's that's exactly what this one was. It's just ahead
Speaker 1: a very specific target. So once a couple of employees
Speaker 1: fell victim to this, despite the fact that there had
Speaker 1: been a warning in November of UH, and there's still
Speaker 1: conjecture over whether or not Epsilon employees ever knew about
Speaker 1: the alert. I mean, we don't know the information. Epillon
Speaker 1: has not been terribly chatty about it as of the
Speaker 1: recording of this podcast. Um, anyway, the the system was
Speaker 1: compromised and hackers were able to access those databases with
Speaker 1: all those names and email addresses, including Chris's and mine
Speaker 1: and my lives and there we go. So we got
Speaker 1: four people just out of connected to this podcast who
Speaker 1: are affected. Um, they got all that information, and well,
Speaker 1: now the question is what can you do with that
Speaker 1: if you only have email addresses and names? Yeah, which
Speaker 1: is so far that's what they're claiming. Everyone should probably
Speaker 1: keep an eye on their finances just in case if
Speaker 1: there's anything hinky going on, you can act on it immediately,
Speaker 1: because there's always the chance that maybe more information was stolen.
Speaker 1: Then we are led to believe right now, I'm going
Speaker 1: to take them at their word and say, all right,
Speaker 1: it's just the names and email addresses. Well, it's not
Speaker 1: in their best interest to lie at this point. No,
Speaker 1: it would just get them and even by if the
Speaker 1: information is out there, there's no way they're getting it back. Right,
Speaker 1: So if it if it was a problem, the responsible
Speaker 1: thing to do is go ahead and say, look, this
Speaker 1: was a catastrophic failure and we need to react because
Speaker 1: the longer we wait, the more damage will be done.
Speaker 1: So i'm i'm I'm imagining that they're being and they're
Speaker 1: they're at least telling the truth as far as they
Speaker 1: under stand it. Right. If more information was stolen, they
Speaker 1: are not aware of it, so names and email addresses well.
Speaker 1: But one of the problems that could come out of
Speaker 1: this is more spear fishing attacks. But now instead of
Speaker 1: attacking the Epsilon to get its data base, it's going
Speaker 1: to be attacking the ultimate consumer like me and Chris
Speaker 1: and my wife and Chris's wife. Um, we will be
Speaker 1: the targets for these attacks, and it'll be spear fishing
Speaker 1: because since they pulled this information out of the upsilons
Speaker 1: data base, they're going to see which companies we had
Speaker 1: UH created accounts with. Yes. And this is also going
Speaker 1: to be tricky for spam filters to pick up on
Speaker 1: because one of the things they that spam filters traditionally
Speaker 1: look for is whether or not it seems to be
Speaker 1: personalized to you. I mean now that that spam filters
Speaker 1: are as sophisticated as they are, and of course we
Speaker 1: all know that even the best still let a few
Speaker 1: slip through on occasion. Um, and at least in a
Speaker 1: lot of cases. Uh, you'll you're going to see you're
Speaker 1: gonna have to be careful when you receive email, especially
Speaker 1: from companies that you know their information was compromised by epsilon.
Speaker 1: Now again, i've got five to look at. Um, you
Speaker 1: can sort of keep an eye on that. And it's
Speaker 1: always a good idea to be a little skeptical, especially
Speaker 1: if they're asking for information. Now, a lot of companies
Speaker 1: have gotten really good about reminding people of this. Um.
Speaker 1: You know, they say, remember, we will never ask you
Speaker 1: for your social security number. Don't give your your social
Speaker 1: security number over email, don't you know. If you have
Speaker 1: any questions, please call our customer service line. Don't fill
Speaker 1: up information in an email. And exactly that's the other
Speaker 1: thing email isn't isn't in general secure. So you you
Speaker 1: wouldn't want to send a friend somebody that you trust.
Speaker 1: You wouldn't want to send a friend your social security
Speaker 1: number over email. It's a bad idea. Um, that's why
Speaker 1: I just tattooed on the bomb on their feet. So
Speaker 1: you should also not be Jonathan's friend. Yes, it's a
Speaker 1: painful experience, believe me, um, I hate that screaming. Also, again,
Speaker 1: be very careful looking at the and look at the
Speaker 1: U r L s that they're asking you to click on.
Speaker 1: If it doesn't look like something related to the company,
Speaker 1: don't do it. If you have any question at all,
Speaker 1: I mean, if you have that pausing and now it's
Speaker 1: probably okay, don't have that pause right now. Get in
Speaker 1: contact with them, say are you really you know, you
Speaker 1: look at the number that you know is actually the
Speaker 1: number for that company and say, hey, I've got this email.
Speaker 1: This is this is a real message. Do you really
Speaker 1: want this information from me? And you know, if if
Speaker 1: they give you an email or phone number in that email,
Speaker 1: I wouldn't trust that anything. Most of these companies, these
Speaker 1: companies should all have the information they need already from you.
Speaker 1: They should not be asking for it again. If they
Speaker 1: are asking for it again, that's indicative of one of
Speaker 1: two things. Either you're getting a phishing email and someone
Speaker 1: is trying to get your information so that they can
Speaker 1: they can take advantage of you, or the company that
Speaker 1: is doing your business shouldn't be doing your business because
Speaker 1: they have been uh irresponsible managing your data. So either way,
Speaker 1: it's either way. The answers. Do not give your data
Speaker 1: over email. UM. And another thing to look for is
Speaker 1: in the u r L. Look for h T T
Speaker 1: P S if it's a secure system, and look at
Speaker 1: that little lock symbol. That's an indication that it's a
Speaker 1: trustworthy source. Again, this is just one factor to look
Speaker 1: don't don't just assume that if it's up there that
Speaker 1: means you're safe. Look for that. Also, look at the
Speaker 1: u r L. Make sure that you r L makes sense. UM.
Speaker 1: And what I recommend is if you want, if if
Speaker 1: you get an email from a company and you think
Speaker 1: this may very well be a legitimate email, navigate to
Speaker 1: that company's website directly. Don't click on links in your email, don't. UM,
Speaker 1: you know, don't copy and paste it from email into
Speaker 1: your your l because it's the same thing as clicking
Speaker 1: on a link. Really, go to your browser, type in
Speaker 1: that company's web address or go through Google and and
Speaker 1: you know, use the actual verified website to get to
Speaker 1: where you need to go, and then try to navigate
Speaker 1: to where that that email would indicate you need to
Speaker 1: go in order to complete whatever the transaction is. And
Speaker 1: that way, if you're going through the official channel, you
Speaker 1: are less likely to fall victim to a scam. Uh,
Speaker 1: and we just have to kind of resolve that will
Speaker 1: do that and resign ourselves to the fact that, at
Speaker 1: least for those affected by this, we're going to probably
Speaker 1: see an uptick in spam email over the next forever
Speaker 1: until we change email addresses. UM. There there's an old
Speaker 1: saying that says, it's not really saying, but people tell
Speaker 1: you to watch out for when you see those emails
Speaker 1: that that say, hey, we just found this out, forward
Speaker 1: it to all your friends, forward it to all your
Speaker 1: friends is usually a flag that it's a hoax. And
Speaker 1: I mean not We're not talking about fishing or any
Speaker 1: of that stuff now, I mean or even even malware,
Speaker 1: just the stuff that you know, the hey this big
Speaker 1: company is is actually uh uh, you know, shipping kittens
Speaker 1: to people. Microsoft has this email tracker and if you
Speaker 1: send this email forward, you will get a package of
Speaker 1: eminem's or something like that. Just ridiculous. Anything that says
Speaker 1: forward to tell your friends, that's that's a flag. Well
Speaker 1: here's a flag for you to UM. In the five
Speaker 1: emails emails that I got from these companies that said
Speaker 1: my address had been compromised, none of them said we
Speaker 1: need new information from you. So if somebody says your
Speaker 1: account has been compromised, send us new information. Here will
Speaker 1: send you a link. That's a huge clue right there.
Speaker 1: I don't go out on the limb and say that's
Speaker 1: that's a really big it's not a very big limb,
Speaker 1: um in. That's a big indicator, like, yeah, it's definitely
Speaker 1: something is wrong, something is hinky, that's not not on
Speaker 1: the up and up. So you know, you can use
Speaker 1: that without even having a click on anything. Just think
Speaker 1: of that and say, okay, well, Jonathan and Chris told me.
Speaker 1: You know that if somebody's asking for information, when they
Speaker 1: tell me that my accounts compromised or they need me
Speaker 1: to update my account information on file, that's that's a
Speaker 1: time to question this and think critically and not do
Speaker 1: it without being yeah please. And And here's the interesting
Speaker 1: thing is that probably as a result of this, I've
Speaker 1: seen this in a few reports. As a result of this,
Speaker 1: we're probably gonna see security firms recommending that companies use
Speaker 1: more of their uh anti intrusion software and hacker protection software.
Speaker 1: But ultimately that's not going to help at all for
Speaker 1: this kind of problem, because this is a people problem. Yes,
Speaker 1: this is a this is a a person, not a
Speaker 1: computer error. It's a person making an error in judgment.
Speaker 1: It so, even even if you put the most sophisticated
Speaker 1: security system in place, if you have people who are
Speaker 1: not practicing good security measures, that's an insecure system. Like
Speaker 1: it's just like if you you know, let's say that
Speaker 1: you've got a bank, right, You've got this bank, and
Speaker 1: you've got all these sophisticated locks on that front door,
Speaker 1: and you've got a laser system that goes across the
Speaker 1: floor at night, and you've you've got pressure sensitive tiles
Speaker 1: all along the front, and then you leave the back
Speaker 1: door open. The whole all those systems in the front
Speaker 1: aren't gonna matter at all because someone just walks through
Speaker 1: the back door because they, you know, were chatting up
Speaker 1: the security guard and uh, you know, made the security
Speaker 1: guard went back for a smoke, and they just put
Speaker 1: a little wedge over there, so it kept the door open.
Speaker 1: And then there and there and they're dealing all your stuff.
Speaker 1: Everyone knows you can beat those laser systems by doing
Speaker 1: cart wheels and you know, sort of doing that weird
Speaker 1: dance over them and walking on your fingertips Yeah, that's
Speaker 1: that easy. That's what I tried to do and it
Speaker 1: doesn't work out so well for me. But that's you know,
Speaker 1: that was twenty pounds go. So it's sort of like
Speaker 1: the brute force attack. It doesn't quite work. Yeah, so
Speaker 1: what really needs to happen is not necessary. Yes, better
Speaker 1: security measures are good, right, I'm not I'm not saying
Speaker 1: that companies shouldn't invest in that. They definitely should. But
Speaker 1: what they really also need to look at is educating
Speaker 1: the people who work for that company about these attacks
Speaker 1: and how to spot them and how to avoid them,
Speaker 1: because you know, it's that's where the weak spot is.
Speaker 1: It's not the technology, it's the people. And if the
Speaker 1: people are unaware of how these attacks can happen, uh,
Speaker 1: then we're gonna see this happen again and again and again.
Speaker 1: Especially if you're clever enough, hacker, you you do have
Speaker 1: a reward at the end of that fishing scam, so
Speaker 1: that the person who has gone through and and downloaded
Speaker 1: the malware does not immediately say, huh, I wonder if
Speaker 1: that was actually a bad thing. I just did you know?
Speaker 1: If you have something there so that it feels like,
Speaker 1: oh no, what what I what it was asking me
Speaker 1: to do I actually did, and I accomplish something. If
Speaker 1: you have that reward in place as a hacker, you're
Speaker 1: more likely to remain undetected. Now, granted, there's also the
Speaker 1: pressure that a person feels when they do something stupid
Speaker 1: to hide it immediately and not let anyone know about it,
Speaker 1: because you don't want to be the one to admit, hey,
Speaker 1: I just compromised our system. We need to be on
Speaker 1: the lookout. I wouldn't want to be that person. I
Speaker 1: would not want to be that person either, But ultimately
Speaker 1: it's better to be that person and say it than
Speaker 1: to not say anything. And then you're talking about the
Speaker 1: potential of billions of dollars of revenue going up and smoke,
Speaker 1: maybe maybe even an incalculable amount of money going up
Speaker 1: and smoke because you don't know what the ultimate fallout
Speaker 1: is going to be from that mistake. Yeah, I am, Yeah,
Speaker 1: I was going to speculate, and I just don't well
Speaker 1: think of it this way. You've got five emails, Yes,
Speaker 1: that's a lot of emails, and looking at a list
Speaker 1: and this was not a comprehensive list that that I
Speaker 1: saw online. A lot of companies rusted Epsilon to keep
Speaker 1: that information private. So and I hear that it affected
Speaker 1: a very tiny percentage of Epsilon's customers. But then, when
Speaker 1: you think Epsilon's customers aren't people like you and me,
Speaker 1: Epsilon's customers are corporations that also, in turn have access
Speaker 1: to potentially millions of people's email and identity. Uh, that
Speaker 1: two percent is still a big, big number in terms
Speaker 1: of actual living human beings. I once left a cell
Speaker 1: phone provider because everyone else that I knew had bad
Speaker 1: customer service from them, and I hadn't yet, but I
Speaker 1: was just waiting for it. So I decided to go
Speaker 1: ahead and jump ship. And that may very well happen
Speaker 1: with people who were not affected, right Yeah, And you know,
Speaker 1: of course this could also usher us into the dark
Speaker 1: ages of abandoning the Internet for commerce and going back
Speaker 1: to brick and mortar stores. I cannot imagine that happening.
Speaker 1: It's not gonna happen to me. No, it's way too convenient.
Speaker 1: I oh, I don't have to deal with people, it's uh.
Speaker 1: And they send stuff to me in pretty packages. It's
Speaker 1: like getting a present because you get to open the
Speaker 1: box and you wonder what's inside. It because you forgot
Speaker 1: because you were you were impulse shopping and it was
Speaker 1: three weeks ago. It's awesome. I have a problem. Ah Okay,
Speaker 1: all right, let's wrap this up. Guys. If you have
Speaker 1: anything that you want to add to this discussion about
Speaker 1: the Epsilon email hack, or perhaps you two were affected
Speaker 1: and you want to maybe express your concern, or if
Speaker 1: you have any other questions for us, especially if it's
Speaker 1: something about computer security and what you can do to
Speaker 1: be more secure, let us know, because these are important
Speaker 1: topics that I think everyone needs to think about to
Speaker 1: some extent, and you know, even even people who limit
Speaker 1: their online activity as much as possible need to be
Speaker 1: aware of it. So send us a message. You can
Speaker 1: find us on Twitter and Facebook are handled. There is
Speaker 1: text stuff h s W, or you can shoot us
Speaker 1: an email. That address is tech stuff at how stuff
Speaker 1: works dot com and Chris and I will talk to
Speaker 1: you again really soon. For moral on this and thousands
Speaker 1: of other topics, visit how stuff works dot com. To
Speaker 1: learn more about the podcast, click on the podcast icon
Speaker 1: in the upper right corner of our homepage. The how
Speaker 1: Stuff Works iPhone app has arrived. Download it today on
Speaker 1: iTunes brought to you by the reinvented two thousand twelve camera.
Speaker 1: It's ready, are you