Speaker 1: Equifax board metaphorical lemon juice on a paper cut after
Speaker 1: company representatives directed customers to a fake site to find
Speaker 1: out if they had been affected by a security bach.
Speaker 1: I'm Jonathan Strickland, and this is tech stuff data. On
Speaker 1: July en, hackers gained access to equifaxes database. Equifax is
Speaker 1: a consumer credit reporting agency. Along with Experience and TransUnion,
Speaker 1: it is part of the Big three credit reporting agencies,
Speaker 1: and the company has records on more than eight hundred
Speaker 1: million people and their credit histories. A vulnerability on Equifax's
Speaker 1: website allowed the hackers to snoop around and take an
Speaker 1: enormous amount of information, including credit card numbers for more
Speaker 1: than two hundred thousand people and personal identifying data for
Speaker 1: a hundred eighty two thousand people, including social security numbers.
Speaker 1: It's possible that the breach affected as many as one
Speaker 1: three million people to some degree. As security breaches go,
Speaker 1: this one was particularly bad. It led to discussions about
Speaker 1: everything from network security to the United States reliance on
Speaker 1: the Social Security number system for just about everything. The
Speaker 1: company kept the breach under wraps until early September twenty seventeen.
Speaker 1: At that time, Equifax launched a tool that was supposed
Speaker 1: to help customers determine if their data was among the
Speaker 1: information stolen by hackers, so that they might then make
Speaker 1: an informed decision about what to do next. Right away,
Speaker 1: reports came out that the tool itself didn't appear to
Speaker 1: be reliable. This wasn't helped when Equifax itself began to
Speaker 1: send people to a fake testing site. The site Equifax
Speaker 1: set up to help people verify whether or not they
Speaker 1: had been affected has the u r L www dot
Speaker 1: Equifax Security seventeen dot com. The u r L sets
Speaker 1: this page apart from the primary domain, Equifax dot com,
Speaker 1: and that's a big problem. At least one Equifax representative
Speaker 1: tweeted out the wrong link to a potential victim. That
Speaker 1: link was security Equifax dot com. The words Equifax and
Speaker 1: security were swapped. Equifax deleted this incorrect tweet, but as
Speaker 1: you're probably aware, nothing is ever truly deleted from the Internet.
Speaker 1: That mistake in u r L would lead users to
Speaker 1: an actual site. If the dark mirror version of our
Speaker 1: universe were the one we were in, that site would
Speaker 1: have been another data mind so that criminals could entice
Speaker 1: users to give up valuable information and the information Security
Speaker 1: Biz we call that fishing with a pH Fortunately, the
Speaker 1: site wasn't in any way malicious. Instead, the site came
Speaker 1: from Nick Sweeting, who wanted to show how Equifaxes approach
Speaker 1: was dangerous and irresponsible. Sweeting knew that the way Equifax
Speaker 1: set up that site was a mistake. By registering a
Speaker 1: domain that doesn't actually live on the Equifax dot com
Speaker 1: domain itself, the company opened up the opportunity for someone
Speaker 1: to create a fake or spoof site. Sweeting had no
Speaker 1: intent on using the data people would submit through his
Speaker 1: fake site to any malicious purpose. He just wanted to
Speaker 1: drive home the fact that if he could do it,
Speaker 1: so could a more criminal type person. The page he
Speaker 1: created had a banner across the top that read cybersecurity
Speaker 1: incident and important consumer information which is totally fake. Why
Speaker 1: did Equifax use a domain that's so easily impersonated by
Speaker 1: phishing sites? This happens frequently on the web. By copying
Speaker 1: the look of an established trusted entity, data thieves can
Speaker 1: convince people to hand over valuable information willingly. Upon casual observation,
Speaker 1: the spoofed site seems perfectly legitimate. The thieves depend upon
Speaker 1: the trust customers have with the institution or organization sation
Speaker 1: they believe they are communicating with. In this case, not
Speaker 1: only did Equifax set up a tool on a u
Speaker 1: r L outside of Equifax dot com, the company also
Speaker 1: mistakenly advised customers to go to the fake site itself,
Speaker 1: after already suffering a major setback in public confidence. This
Speaker 1: was not a great move, and it really illustrated how
Speaker 1: quick responses to a crisis can go terribly wrong. Sweeting
Speaker 1: also pointed out that while he intended no harm, there
Speaker 1: are surely parties active online right now that have darker intentions.
Speaker 1: Many of these will go to great links to create
Speaker 1: a believable experience to full innocent users into giving up
Speaker 1: more of their information. This is a double slap in
Speaker 1: the face for people who are already worried that thieves
Speaker 1: had stolen their data. It's a vulnerable population undergoing further exploitation.
Speaker 1: Sweetings argument is one many cybersecurity experts agree with. It's
Speaker 1: a better idea for an organization to make any official
Speaker 1: tool part of their primary domain rather then to set
Speaker 1: up a new web domain. This reassures users that they
Speaker 1: are dealing with the actual entity and not some random
Speaker 1: data fisher. While Equifax is a recent target of this
Speaker 1: sort of spoofing. There are lots of other examples, from
Speaker 1: fake news sites to link farms that only exist to
Speaker 1: generate page views and rack up advertising money. Spoofing is
Speaker 1: a big deal on the web. It always benefits the
Speaker 1: user to be careful when navigating to a U r
Speaker 1: L and to be absolutely sure that the site you're
Speaker 1: visiting is a legitimate one before you share any of
Speaker 1: your personal information. To learn more about information security, including
Speaker 1: how good guys sometimes act like bad guys so that
Speaker 1: they can stop the real bad guys, subscribe to the
Speaker 1: Tech Stuff podcast. We dive deep into tech topics to
Speaker 1: get a better understanding of how they work and affect
Speaker 1: our lives. That's all to me for now, see you
Speaker 1: next time. Eight