Speaker 1: Brought to you by the reinvented two thousand twelve Camray.
Speaker 1: It's ready. Are you get in touch with technology? With
Speaker 1: tech Stuff from how stuff works dot com. Hello everyone,
Speaker 1: and welcome to tech Stuff. My name is Chris Paulette
Speaker 1: and I'm an editor at how stuff works dot com.
Speaker 1: Sitting across from me, as always, his senior writer, Jonathan
Speaker 1: Strickland be there. Yes, today we have sort of a
Speaker 1: sobering topic to discuss. Yes, now, when we're recording this,
Speaker 1: it's in August, early August. It's August t actually, and
Speaker 1: earlier this week there was a news story that broke
Speaker 1: throughout the Twitter sphere really first and then beyond about
Speaker 1: a tech journalist named Matt Honan who has written for
Speaker 1: various UH publications, including Wired, and how he had his
Speaker 1: essentially his entire digital life hacked over the course of
Speaker 1: about thirty minutes and UH and to kind of explain
Speaker 1: what happened, first, we'll sort of talk about the way
Speaker 1: he discovered this through his personal experience, and then how
Speaker 1: the hackers did it, and then what needs to happen
Speaker 1: so that we protect ourselves against such things happening in
Speaker 1: the future. So to start, he was he was playing
Speaker 1: with this kid and he noticed that his iPhone had
Speaker 1: shut down, so it crashed essentially, and he thought, oh, well,
Speaker 1: that's annoying. I guess I'll have to go and uh
Speaker 1: connected to my computer, restore from back up, and just
Speaker 1: get this thing going again. He didn't really think much
Speaker 1: of it, because you know, technology occasionally fails. Yes, So
Speaker 1: then he goes and he goes over to his computer
Speaker 1: and tries to start that up, and that also isn't
Speaker 1: loading up properly. It's asking him for information that he
Speaker 1: doesn't have and it won't accept his password, and so
Speaker 1: he's thinking, well, that's weird, but he doesn't again panic yet. Uh.
Speaker 1: He then thinks about trying his iPad, which also isn't working,
Speaker 1: and he tries logging into his Google account using a
Speaker 1: different computer, and that also gives him a failure. And
Speaker 1: it's at that point where he's thinking something seriously wrong
Speaker 1: is happening. And eventually he starts noticing that his own
Speaker 1: Twitter handle is posting stuff uh, and he's not the
Speaker 1: one doing it, and so he can't access his Twitter
Speaker 1: account anymore either. And there are these horrible Twitter messages
Speaker 1: with various you know, uh inappropriate tweets going out things
Speaker 1: that are racist or homophobic, or having lots of foul
Speaker 1: language in it um and it's just, you know, it's
Speaker 1: it's just beyond his control. He gets on the phone
Speaker 1: with Apple trying to find out what's going on, UH
Speaker 1: to explore Lane that his his account has been hacked,
Speaker 1: and it takes him quite some time before they were
Speaker 1: able to sort this out. Part of the reason is
Speaker 1: that they for a while, we're looking at the wrong account.
Speaker 1: They had his name wrong, and so they were looking
Speaker 1: at an account that had none of the issues he
Speaker 1: was explaining. And then when the Apple representative repeated his
Speaker 1: name back to him, that's when he said, wait a minute,
Speaker 1: that's not who I am. I'm Matt Honan. You've got
Speaker 1: the wrong name. And then once they switched their focus,
Speaker 1: then they started seeing, oh, well, before you called in,
Speaker 1: and actually I think Honan had to ask about this.
Speaker 1: They didn't, They didn't um volunteer this information. But before
Speaker 1: Honan had called in, someone else had called in to
Speaker 1: regain access. They said, to regain access. Really it was
Speaker 1: to gain access for the first time. It was the
Speaker 1: hackers who had called in too, because they had claimed
Speaker 1: that they no longer had the password or security question answers,
Speaker 1: so they could not get the password normally. They were
Speaker 1: trying to get into his dot me email and the
Speaker 1: the reason for all of this is probably the craziest
Speaker 1: part of the story, although the pathway of how the
Speaker 1: hackers got to the point where they were able to
Speaker 1: do all these things. You know, once they got access
Speaker 1: to his iCloud account, they were able to do things
Speaker 1: like wipe his devices, which is what happened. They wiped
Speaker 1: his iPhone, his Mac, and his iPad in part to
Speaker 1: prevent him from being able to head them off. While
Speaker 1: they were going down this trail of hacking his digital life.
Speaker 1: They were also able because of the way he had
Speaker 1: interconnected various accounts. They were able to do things like
Speaker 1: reset his Google password, send the message to the dot
Speaker 1: Me address, which they already had access to yes, because
Speaker 1: they had gained it from Apple. Once they got the
Speaker 1: password for the Google account, then they were able to
Speaker 1: get the password for Twitter because that's where he had
Speaker 1: his Twitter account attached to his Google account, So it
Speaker 1: was kind of a leap frog thing, right he would
Speaker 1: they could do a password recovery from one system. It
Speaker 1: would send the message to one of the email addresses
Speaker 1: that was already compromised, and then they would get access
Speaker 1: to the next thing. Turns out what the hackers were
Speaker 1: interested in from the very beginning was getting hold of
Speaker 1: his Twitter account and posting these messages. That's really just
Speaker 1: for laughs. That's all they really wanted to do. They
Speaker 1: weren't really out to make a big show that you know,
Speaker 1: it should be Matt Honan that should suffer for this. Uh.
Speaker 1: Had nothing to do with Gizmoto, which Honan had written for,
Speaker 1: and his account was linked to Gizmodo's account. It never
Speaker 1: been unlinked, even though he no longer wrote for Gizmoto,
Speaker 1: So they also had access to Gizmoto's Twitter account and
Speaker 1: hijacked that for a while. Um so, you you know.
Speaker 1: It turned out the only reason they wanted to get
Speaker 1: his Twitter account was because he had one of the
Speaker 1: most rare things in Twitter, a three letter Twitter handle,
Speaker 1: you know, because most people had to go with a
Speaker 1: longer Twitter handle because of course, once one's taken, it's gone.
Speaker 1: So people who managed to land one of those three
Speaker 1: letter accounts are rare, and so they thought, oh, this
Speaker 1: is that's that's why they targeted this particular Twitter account
Speaker 1: had nothing to do with him personally, had nothing to
Speaker 1: do with who he worked for, and had nothing to
Speaker 1: do with the fact that he was a tech journalist.
Speaker 1: It was just because his Twitter handle was three letters long.
Speaker 1: And that's crazy to me. First of all, that you
Speaker 1: know that that was the that they were They were
Speaker 1: willing to go through the steps that they had to
Speaker 1: go through in order to get this one Twitter account. Well,
Speaker 1: that's true, although it only took them a little less
Speaker 1: than an hour to accomplish. Once they had, once they
Speaker 1: had determined their route of attack, it was all over.
Speaker 1: So the way they did this was not through any
Speaker 1: kind of crazy sit down at the computer, type in
Speaker 1: the password three times and then you may to get
Speaker 1: in type thing. And it certainly wasn't a Hollywood style
Speaker 1: hacker brute force attack where there was uh, you know,
Speaker 1: some group of of hackers trying everything they could to
Speaker 1: brute force their way in. Yeah, it wasn't like a
Speaker 1: computer program that was just running password after password and
Speaker 1: you see the little like digits flip up each time
Speaker 1: you hit one. That's correct, that wasn't what happened. What
Speaker 1: happened was much more simple really in a way, because
Speaker 1: I had nothing to do with using code. It has
Speaker 1: everything to do with manipulating systems. But from a person perspective,
Speaker 1: not or or a policy perspective, not from a technological one. Yeah,
Speaker 1: and it's it's also clear that although Apple's security procedures
Speaker 1: are in part to at fault, um, they are not
Speaker 1: the only ones the hackers targeted to get more information
Speaker 1: on hone and and that Um, it just so happened
Speaker 1: that uh, the information they needed coincided across multiple companies
Speaker 1: with his accounts, and once they got some information from
Speaker 1: a couple of places, they were easily able to go
Speaker 1: in and fiddle with other stuff. There are really three
Speaker 1: parties that are I don't want to say at fault
Speaker 1: you don't blame the victim. There are three party There
Speaker 1: are three parties that made this possible for the hackers
Speaker 1: to get the access to to the accounts. One of
Speaker 1: those is Honing himself. Yeah, and he greatly admits that. Yes,
Speaker 1: if you he has written an incredible uh article that
Speaker 1: that documents this entire process and what he went through.
Speaker 1: He blogged about it when it happened, but then he
Speaker 1: wrote up a much more comprehensive account of it. For
Speaker 1: Wired and UH and it's a very interesting read. I
Speaker 1: highly recommend you read it, especially if you're concerned with
Speaker 1: your own potential security computer security. So he was at
Speaker 1: fault and not at fault, he was he some of
Speaker 1: his choices made this possible. Uh, the Amazon Amazon dot
Speaker 1: Com also its policies made this possible. And Apple's policies
Speaker 1: made this possible. So those three parties together made it
Speaker 1: possible for the hackers to achieve this and UH, and
Speaker 1: it's kind of interesting how how they came about it. Yeah,
Speaker 1: and and some of the irony as we get into
Speaker 1: this is that some of the very things that made
Speaker 1: this possible are in place specifically to make it more
Speaker 1: difficult for someone to steal identities. So it actually UH
Speaker 1: some of these some of these procedures actually worked in
Speaker 1: exactly the opposite way in which they weren't intended when
Speaker 1: they were implemented. So the way this started off was
Speaker 1: it was fairly clever. So they they first they started
Speaker 1: to the hackers did a little recon work, and they
Speaker 1: wanted to find out, um about how they would get
Speaker 1: uh the access to the Twitter account. And then they
Speaker 1: were able to find out Honan's UH email address because
Speaker 1: he has a website. They went to the website, they
Speaker 1: did a who is look up on Honan, which gave
Speaker 1: them two things, like two things they needed. They needed
Speaker 1: the email address and they needed his physical address. Yeah. Now,
Speaker 1: if you register a domain name, you are required to
Speaker 1: have contact information available. Um, and that information is publicly
Speaker 1: available now um some well we could talk about that too,
Speaker 1: but anyway, the the who is record for the domain
Speaker 1: had his information in it. Yeah. So once they had
Speaker 1: that information the Google account and the just the email address,
Speaker 1: they didn't have access to the account yet. Um. They
Speaker 1: figured out that the Twitter account was linked to the
Speaker 1: personal website. That's what That's where they found the Gmail address.
Speaker 1: That's where they on the physical address. And then they
Speaker 1: started to look at the account recovery for a Google
Speaker 1: and without actually sending in a recovery request, they saw
Speaker 1: that the address, which was only partially obscured per Google's policy,
Speaker 1: wasn't at me dot com email address. That was the
Speaker 1: recovery address. Well that's an Apple thing, right, So that's
Speaker 1: where they said, ah, now we know how to get
Speaker 1: at him because it's because his Google address will go
Speaker 1: back if we did a password recovery. Because that will
Speaker 1: go to an Apple address, and because we know how
Speaker 1: to manipulate the system so that we can get access
Speaker 1: to his Apple account, it's all over. And the way
Speaker 1: they got access to the Apple account was kind of interesting. Now,
Speaker 1: they did not have the password, they did not have
Speaker 1: the answer to security questions, So calling up Apple and
Speaker 1: getting access to to this account would require that they
Speaker 1: have some other information. What Apple requires is that you
Speaker 1: have to have the building address and the last four
Speaker 1: digits of the credit card you used to establish that account.
Speaker 1: So what the hackers did was they said, well, there's
Speaker 1: a good chance that the same credit card this guy
Speaker 1: used to establish his iCloud account is the one that
Speaker 1: he uses for Amazon. And so instead of calling Apple first,
Speaker 1: they called Amazon first, and they said that they wanted
Speaker 1: to add a credit card number to the existing Amazon account,
Speaker 1: So they weren't trying to get the credit card number.
Speaker 1: They wanted to add a credit card number, right, So
Speaker 1: then they add a credit card number to the Amazon account.
Speaker 1: Then they hang up. Then they call Amazon back and
Speaker 1: they say that they have lost access to their account
Speaker 1: and that they will provide the name the billing address,
Speaker 1: which they already have from the who Is look up
Speaker 1: of the website and then the credit card number they
Speaker 1: gave at the at the call they made earlier. So
Speaker 1: there's now this credit card number that is legit because
Speaker 1: they provided it. It's not the same one that was
Speaker 1: used to establish the account in the first place. So
Speaker 1: then Amazon says, oh, all right, well, we'll send you
Speaker 1: the password to the account. Here's which email I addressed
Speaker 1: you wanted to go to. So they hackers give their
Speaker 1: email address or an email address that they have created
Speaker 1: for the purposes of this hack. So now Amazon sends
Speaker 1: the log in information to UH to Amazon dot Com,
Speaker 1: to that account, to the email they log into the
Speaker 1: Amazon dot Com account, and then they look for the
Speaker 1: other credit card number, the one that was actually used
Speaker 1: to establish that account. So this is Honan's actual final
Speaker 1: four digits because those are unmasked in the Amazon dot
Speaker 1: Com system. Yes, they masked the rest of it, right, Yeah,
Speaker 1: the rest of the numbers are masked. So it's not
Speaker 1: that the hackers ever had access to the credit card,
Speaker 1: other than they could have bought a whole bunch of
Speaker 1: stuff on Amazon and had it sent somewhere. But that's
Speaker 1: all that's. Yeah, that's what they could have done if
Speaker 1: they had wanted to, but they could not actually pull
Speaker 1: the credit card number itself other than the last four digits.
Speaker 1: But those last four digits are what Apple needs for
Speaker 1: account verification, right, So they take those four digits, they've
Speaker 1: got the building address, They give a call to Apple.
Speaker 1: They give that information, and because Honan used the same
Speaker 1: billing address and the same credit card for both services,
Speaker 1: Apple said, oh, well then you're clearly this guy. We
Speaker 1: will send you the account retrieval information to your email address.
Speaker 1: So then they now have the way to log into
Speaker 1: Honan's iCloud account. They do that. That's where they then
Speaker 1: disable his devices. They wipe them to help slow things
Speaker 1: down so they can continue to do this stuff. Now
Speaker 1: they have access to his Apple email, they have access
Speaker 1: to his Amazon account. That's when they go to the
Speaker 1: Google password recovery asked for the recovery information so that
Speaker 1: they can access his Google account. Well, that goes to
Speaker 1: his Apple address, which they already have access to. The
Speaker 1: information comes to the Apple address, they go into the
Speaker 1: Google account. They immediately delete the password recovery UH email
Speaker 1: out of his account so that if he has any
Speaker 1: other devices that would alert him that his password had
Speaker 1: been changed. That he would not be aware of it,
Speaker 1: so they they hide that, they change the password so
Speaker 1: that now they've locked him out, they have access to
Speaker 1: his Google account. They then were able to go and
Speaker 1: get access to the Twitter account. Um, this is kind
Speaker 1: of scary. And again it has nothing to do with
Speaker 1: sitting down encoding stuff. It is hacking. You're hacking a system,
Speaker 1: but you're doing it more through social engineering and manipulating
Speaker 1: policies and systems. Right, So if you guys remember we
Speaker 1: had that discussion and I think it was episode three
Speaker 1: D ninety nine where we interviewed Brian Brushwood and we
Speaker 1: talked about social engineering. Now with Brushwood, his approach to
Speaker 1: social engineering is more about you know, having fun and uh, like,
Speaker 1: you're in a social situation where you you know, you
Speaker 1: never have to buy a drink because you're doing these
Speaker 1: cool things and convincing other people to buy drinks for you,
Speaker 1: or you know, you're doing something so that you can
Speaker 1: get the phone number of someone you're interested in. So
Speaker 1: you're still social engineering people, but it's not necessarily this
Speaker 1: as nefarious as uh as what these hackers were doing. Yeah,
Speaker 1: and it's not typically what one thinks of when one
Speaker 1: thinks of identity theft. I mean again, UM, a lot
Speaker 1: of us would look at the specifically maybe the Amazon
Speaker 1: portion of this or an online retail portion of this,
Speaker 1: and say, oh, well, they got access to his credit
Speaker 1: card number, they can buy stuff. Well yeah, and in
Speaker 1: a lot of cases that maybe what a hacker might
Speaker 1: try to do. After all, we have talked about uh
Speaker 1: online systems being hacked for financial information and financial gain,
Speaker 1: but that's not the point of this. Um, the system
Speaker 1: that I was speaking of a few minutes ago, when
Speaker 1: I was saying that ironically, some of these things were
Speaker 1: turned against him tools that would be used to protect him. Um,
Speaker 1: if you're not in an Apple customer, you may not
Speaker 1: be aware. There's a there's a uh an I cloud
Speaker 1: system uh called find my and there're a couple of
Speaker 1: them like find my iPhone. Yeah. Um, so let's say, uh,
Speaker 1: you know, we're talking completely behind here. Let's say you
Speaker 1: have an iPhone and your kid has run off with
Speaker 1: it and stuffed it somewhere in some piece of furniture
Speaker 1: or dropped it and or you left it in a
Speaker 1: cab or you left it in a cab. Well, if
Speaker 1: you're if you're Natalie Dell Conti well yeah, um, well,
Speaker 1: I was gonna start with the the easy one. You
Speaker 1: can make it. You can make your phone make a
Speaker 1: noise so you know it's in the house, but you
Speaker 1: can't figure out where it went. I'd like to have
Speaker 1: one of these for my keys and maybe the remote.
Speaker 1: But you know you can. You can make it make
Speaker 1: a noise, or if you've left it in a cab,
Speaker 1: you can have it tell you roughly where it is. Uh.
Speaker 1: This is especially useful if you can't remember if you
Speaker 1: left it in a cab, or if you at a
Speaker 1: restaurant whatever, or you know, you were at a bar
Speaker 1: and you had a prototype version of the newest iPhone
Speaker 1: and it was sitting on the stool next to you
Speaker 1: when you were sitting there at the bar, but then
Speaker 1: when you turned around it was gone, and then it
Speaker 1: ends up at some tech blog. Yeah, well that could happen. Yeah,
Speaker 1: they're they're Twitter feed could be hacked to um. But yeah,
Speaker 1: I mean, so you can find out where it is.
Speaker 1: You can have it make a noise so that if
Speaker 1: it is in the same location as you are, Uh,
Speaker 1: you know you can you can track it down. Um.
Speaker 1: If you don't know where it is, let's say you
Speaker 1: did leave it in a in a bar somewhere and uh,
Speaker 1: you say, oh, well, you know it's not I don't
Speaker 1: know where that is. And you could see a location
Speaker 1: it shows you on the map where where it might be. Oh,
Speaker 1: it's no longer in my control. It's somewhere where I
Speaker 1: don't know where it is. I'm I have sensitive information
Speaker 1: on there. My my calendars on there, my contacts are
Speaker 1: on there. Um as as Honan himself said, you know
Speaker 1: he had um information from many other tech journalists. Um,
Speaker 1: so he might just let's say he was still in
Speaker 1: control of his accounts, but no longer in control of
Speaker 1: the device. He could say, wipe this device. I don't
Speaker 1: want anything on it anymore. You know, I want to
Speaker 1: wipe it clean so that nobody else gains information in
Speaker 1: my personal stuff. It's only a matter of time before
Speaker 1: they figure out my my pass code. Wipe it clean.
Speaker 1: You know, you can tell it to do that and
Speaker 1: it will remotely do that. Apple has added that for
Speaker 1: the Mac to find my mac. So in that case,
Speaker 1: let's say he had corporate information. Many companies have have
Speaker 1: this policy in place. Yes, you can check your corporate
Speaker 1: email on your personal device, but if you do that. Um,
Speaker 1: we retain the right to wipe the information on the
Speaker 1: device if it should fall into somebody else's hands, or
Speaker 1: let's say that you were to, uh, you were to
Speaker 1: to either be fired or you you know, you left
Speaker 1: or whatever. They might retain that right so that they
Speaker 1: can protect themselves as a corporate entity. Yeah, so there
Speaker 1: there are positive reasons to be able to do this
Speaker 1: in this case. Once the hackers gained information about his
Speaker 1: account and we're able to get access to his account
Speaker 1: and lock him out, Um, they also chose to completely
Speaker 1: wipe his phone, his iPad, and his Mac laptop. And
Speaker 1: in doing so, they not only wiped out any you know,
Speaker 1: corporate in formation. He's he's a freelance writer, so any
Speaker 1: articles he might have been working on that were on
Speaker 1: his hard drive gone. He also lost a year's worth
Speaker 1: or more, I guess the photos of personal photos, personal
Speaker 1: stuff that that he had created. And Yeah, Liz leads
Speaker 1: us to the the thing that we have said a
Speaker 1: billion times on this podcast that is an exaggeration, but
Speaker 1: back up your data. Yeah, and he admits, he admits
Speaker 1: he was not regularly backing up his hard drive. This
Speaker 1: is not to to pick on him or anything else.
Speaker 1: It's something that he wishes in retrospect he had been
Speaker 1: doing on a regular basis because, um, oddly enough, this
Speaker 1: is where this this is where this story takes an
Speaker 1: unusual turn. He has been in contact with his hackers
Speaker 1: and has agreed not to put in in return. They
Speaker 1: were telling him how they did it. Yes, and uh,
Speaker 1: I think first of all, the first thing we can
Speaker 1: agree on easily is that Amazon has to change its policy.
Speaker 1: Well yeah, because because that's the first step that means
Speaker 1: that anyone could access anyone else's Amazon account. Well, um,
Speaker 1: I wasn't gonna get there quite yet. I wanted to
Speaker 1: make the point that this is where it kind of
Speaker 1: gets a little weird, because they they shared all this
Speaker 1: information with him, and this is how he was able
Speaker 1: to write such a comprehensive, uh post on on Wired
Speaker 1: about it was they they told him what they were doing,
Speaker 1: what the point of it was. Um, they admitted, look,
Speaker 1: you know, we weren't trying to to steal your your stuff.
Speaker 1: We weren't really trying to wipe out your your personal life.
Speaker 1: We have nothing against you personally. We wanted your Twitter account. Um.
Speaker 1: The guy that that that he talked to primarily um
Speaker 1: was saying, essentially, hey, uh, you know, my partner was
Speaker 1: the one who wiped out your computer. And now that
Speaker 1: you tell me all your personal files, your your the
Speaker 1: pictures of your your kid were on here, I'm really sorry. Yeah,
Speaker 1: I'm actually really sorry. I didn't mean to to cause
Speaker 1: you personal harm as a result of this. And they say, now,
Speaker 1: I don't know, you know, I don't know whether their
Speaker 1: motives are are as pure as they say. You know,
Speaker 1: they say part of it was that they wanted to
Speaker 1: point out that it really is this easy to hack
Speaker 1: into your personal account, and they wanted to draw attention
Speaker 1: to that. Now, I took her say that all the time.
Speaker 1: I suspect, based upon the messages that they posted on Twitter,
Speaker 1: that that's something they they that's covering their tracks. I
Speaker 1: think they were doing it for the kicks. Yes, well,
Speaker 1: if you're looking at again, if you're reading the Twitter,
Speaker 1: the Twitter posts that that we're posted under his name,
Speaker 1: and there were a lot that he left there. He says,
Speaker 1: I wanted to keep a record of it. He did
Speaker 1: delete some because they were overly hurtful, patently offensive, and
Speaker 1: he said, you know, these could actually cause people to
Speaker 1: feel badly about themselves, and I don't want that. I
Speaker 1: do want there to be a record of what had happened,
Speaker 1: but not at that, not that, not at the expense
Speaker 1: of someone else's feelings, um, other than my own obviously.
Speaker 1: So then he went out and he deleted the ones
Speaker 1: they felt were particularly offensive, and then the rest he
Speaker 1: left up. If you read those, I think it's it's
Speaker 1: pretty hard to defend yourself with I'm just showing how
Speaker 1: the system can be hacked. It's more than that. It's
Speaker 1: also hey, you know, ha ha, we did it, you know,
Speaker 1: And and it's so it goes beyond that. And I
Speaker 1: think it's very telling the the hacker he got in
Speaker 1: touch with, assuming that the what he the information he
Speaker 1: gave was accurate about himself, about the hacker himself as
Speaker 1: a young guy nineteen years old, might not quite really
Speaker 1: get be mature enough to realize, you know, what the
Speaker 1: consequences are of those actions and what how they could
Speaker 1: affect the target beyond on justus. Oh, you know, they're thinking,
Speaker 1: we have a goal, we want to get hold of
Speaker 1: this Twitter account. They're not thinking of what consequences are
Speaker 1: going to be felt by the target beyond just the
Speaker 1: fact that our Twitter handle has been taken over, and
Speaker 1: so some of that may just be that they were
Speaker 1: very narrowly focused on what they wanted to do and
Speaker 1: they didn't really consider what could happen or how it
Speaker 1: would feel for that sort of stuff to happen to
Speaker 1: a person. Um. So that's that's something there too, And
Speaker 1: we see that a lot. I mean, there are a
Speaker 1: lot of hackers out there who because they can do something,
Speaker 1: they'll do it and they don't realize or they don't
Speaker 1: care what the consequences of that action are going to
Speaker 1: be to the people who are also involved in that
Speaker 1: whatever that situation is. Um. So maybe maybe now this,
Speaker 1: you know, according to the article, it sounds like this
Speaker 1: guy is at least a little remorseful, Yes, that he's
Speaker 1: feeling some remorse for this, and you know, we don't
Speaker 1: know if really like he was at all culpable in
Speaker 1: the the actual deletion. He claims that it was the
Speaker 1: other guy who did it, but you know, you never know. So, yeah,
Speaker 1: it's it's interesting to look at that. And you know,
Speaker 1: if if you kind of put yourself in the shoes
Speaker 1: of the the hacker, um, you know, especially if you're
Speaker 1: thinking of somebody who is doing it for for fun,
Speaker 1: to mess with somebody, and and the person says, hey, look,
Speaker 1: I'm not going to press charges against you, but I
Speaker 1: want to know how how you did it. He started thinking, hey,
Speaker 1: this guy is working with me. You know, the heat
Speaker 1: of the moment's off, the sense of accomplishment you get
Speaker 1: from uh hacking in and and gaining access to all
Speaker 1: this information. You know, after the fact, you've had a
Speaker 1: chance to cool down, they've had a chance to cool down.
Speaker 1: You start thinking about it, like, well, you know what,
Speaker 1: this guy is not angry enough with me to to
Speaker 1: press charges with the cops. You know, we kind of
Speaker 1: damaged this guy, and he's willing to talk to us
Speaker 1: about it and share the story online. And you know,
Speaker 1: they kind of got something out of it too. They
Speaker 1: kind of got a little anonymity anonymous press, so they
Speaker 1: get to point to themselves and say, hey, look he's
Speaker 1: talking about us. He doesn't seem like such a bad guy.
Speaker 1: I guess we kind of, you know, burned a lot
Speaker 1: of stuff of his online. That kind of stinks. You know,
Speaker 1: we were really kind of doing it for the fun
Speaker 1: of it, and now it's not so much fun. You
Speaker 1: like a decent guy now you know that there's a
Speaker 1: real person on the other end of that account. That's
Speaker 1: the other thing is there's a dehumanizing effect sometimes with
Speaker 1: the whole you know, you don't really identify the fact
Speaker 1: that there's a person on the other end of these accounts.
Speaker 1: Sometimes you don't. It doesn't the concept isn't fully formed. Yeah,
Speaker 1: for for a lot of us, we would have gone
Speaker 1: out and if we had found out who did it,
Speaker 1: we would have pressed charges. We would have wanted to
Speaker 1: take them. Now some of us would have re enacted
Speaker 1: the film taken. But well, but yeah, that that's that's
Speaker 1: what makes this story more are interesting than other hacking
Speaker 1: stories I think, is that that it's got a humanizing
Speaker 1: character for both parties, the person who or people who
Speaker 1: took advantage of of honing and honing himself. And it
Speaker 1: does point to security issues. Now these are legitimate for um,
Speaker 1: you think about your Amazon account. For example, Let's say
Speaker 1: you don't have anything else except an email account in
Speaker 1: an Amazon account, by and large, you probably wouldn't have
Speaker 1: a lot of these security issues. The security issues that
Speaker 1: Amazon would have in place would make it very difficult
Speaker 1: for them for someone else to get that information from them.
Speaker 1: But then you start sharing. You start using this um
Speaker 1: email address with Amazon and every other company that you
Speaker 1: do business with online. That makes your email address a
Speaker 1: a key to getting information from other companies. And then
Speaker 1: you start doing business with other pieces. You've got the
Speaker 1: same credit card number across these different companies, and once
Speaker 1: you have the last four digits of your social Security
Speaker 1: number or a credit card number, that makes it possible
Speaker 1: to use that information as a key across multiple entities.
Speaker 1: And all of a sudden, if you do business with
Speaker 1: a whole bunch of places, they get something like your
Speaker 1: physical address, your name, your email address, a credit card number,
Speaker 1: any of that stuff, and they've got the keys to
Speaker 1: open lots and lots of accounts for for them to
Speaker 1: get more information. And once they've hacked one, they can
Speaker 1: get information that will let them into lots and lots
Speaker 1: of other places. Oh, they have an Amazon account, I
Speaker 1: wonder if they have a Barnes and Noble account. We
Speaker 1: could find out in about ten minutes. So Honan admits
Speaker 1: that his password was not the strongest. It was a
Speaker 1: seven seven digit alpha numeric password, but that it was
Speaker 1: one he had used for many years. But they haven't
Speaker 1: They didn't really right right. So that's that's the point
Speaker 1: of this thing, is that even if he had had
Speaker 1: the strongest password in the world, it would not have
Speaker 1: mattered because they circumvented that. They didn't they weren't attacking
Speaker 1: through that direction. And this this demonstrates why security is
Speaker 1: so tough, because you think about the most obvious point
Speaker 1: of entry, which would be the log in right your
Speaker 1: user name and your password. That's the most obvious point
Speaker 1: because that's the way we access our information. Hackers are
Speaker 1: looking at a system and saying, what's the best vulnerable
Speaker 1: spot to go in at And if the front door
Speaker 1: is heavily locked, you look for a window or a backdoor,
Speaker 1: you look for something else it's gonna let you get
Speaker 1: into there, and not even you just bypass the place
Speaker 1: where you've got all the security and you go in
Speaker 1: through a different entrance. So when I said that Amazon
Speaker 1: really needs to work on its policy, mainly, the reason
Speaker 1: for that is that the only thing you need in
Speaker 1: order to get that that lug and recovery information was
Speaker 1: the credit card number that's associated with the account, which
Speaker 1: they did by adding in one the building address and
Speaker 1: an email address, and that's it. Um uh and in
Speaker 1: order to add the credit card number, all you need
Speaker 1: is the building address and the email address that is
Speaker 1: associated with the account. So you know, using some guesswork,
Speaker 1: thinking that Okay, well he's got an Amazon account, He's
Speaker 1: probably got an Amazon account. He's probably using this address
Speaker 1: for that Amazon account. We know his address because we
Speaker 1: looked it up from his website. We can fabricate a
Speaker 1: a a credit card using a generator that creates a
Speaker 1: realistic but not actually activated credit card number and assigned
Speaker 1: that to the Amazon account and then use that to
Speaker 1: get the entry point. So obviously Amazon needs to fix that,
Speaker 1: because if all you have is a person's address and
Speaker 1: you have a good guess at what email address they
Speaker 1: use for that Amazon account, then you could do the
Speaker 1: same thing. And so that's that's a that's number one.
Speaker 1: Number two would be the fact that Apple uses the
Speaker 1: last four digits of the credit card, the building and
Speaker 1: the building address as a security recovery method. Clearly that
Speaker 1: needs to to change in some way. Yeah, I think
Speaker 1: I think this is a uh, they're there are a
Speaker 1: couple of things. Now, if you read uh, there's an
Speaker 1: account on Honan's tumbler, and if you want to read
Speaker 1: some truly hurtful comments. I would suggest reading that um,
Speaker 1: because some people blame him for owning Apple devices, which
Speaker 1: is ridiculous. In fact, of the one that that bugged
Speaker 1: me probably the most was the one that said, serves
Speaker 1: him right for owning I crap. And I'm going you
Speaker 1: know this, this really could have happened with pretty much
Speaker 1: any manufacturer or Yeah, it's just I mean Apple had
Speaker 1: policies that they were able to leverage. That's not to
Speaker 1: say that other companies don't have those same policies, And
Speaker 1: it's just that Apples were well known to them, so
Speaker 1: that's how they once they saw the me dot com
Speaker 1: addresses that all right, we know how to do this. Yeah.
Speaker 1: And the thing is, I would say the vast majority
Speaker 1: of online retailers or or companies that have that offer
Speaker 1: services online um, I mean they knew how to get
Speaker 1: into a Google account too, um. And and a lot
Speaker 1: of them have the same policies. So if you can
Speaker 1: get as they did, if you can get one piece,
Speaker 1: then you can apply it to other pieces and get
Speaker 1: information from them and put the whole puzzle together that way.
Speaker 1: So it's not while while I've seen people singling out
Speaker 1: Apple and Amazon and um, and they should to some
Speaker 1: degree be uh considering new stuff. It's not just their fault.
Speaker 1: The catch twenty two here is once you make an
Speaker 1: account so locked down that it's extremely hard to get into,
Speaker 1: it's also hard for you to get into when you
Speaker 1: do forget your password, when you do forget what credit
Speaker 1: card you used. Say you've got ten credit cards. Um,
Speaker 1: let's say you h you shredded one of them because
Speaker 1: you don't use that card anymore. But that's the one
Speaker 1: that you set up the account with two years ago. Well,
Speaker 1: now you can't get back in. And so if they
Speaker 1: lock it down too hard, then you can't get back
Speaker 1: in either. So that's why they make it. Yeah, that's
Speaker 1: why they make those those pieces available. Well, can you
Speaker 1: tell me the last four digits of your Social Security number? Oh? Yeah,
Speaker 1: I know those. Well they got that from somebody else.
Speaker 1: So there there's a catch twenty two here. How how
Speaker 1: how secure is secure enough and not too secure to
Speaker 1: lock you out forever? So so there there is that
Speaker 1: is a challenge. Um. The part of it is to um,
Speaker 1: when we're talking about the domain name, they were able
Speaker 1: to get information from his domain name. Uh, and you
Speaker 1: can there are things you can do there too. UM.
Speaker 1: A lot of the services, the places where you can
Speaker 1: register domain names offer a secure UH service where you
Speaker 1: pay an additional fee per year or or per however
Speaker 1: often you UH you renew your domain name, that will
Speaker 1: lock it down so that it has a basically the
Speaker 1: the registrar is responsible for it. So if you want
Speaker 1: to contact the owner of the domain name to say
Speaker 1: make them an offer, Hey, we want so and so
Speaker 1: dot com. You've got it, Can we offer you ten
Speaker 1: thousand dollars and buy the domain name for you? It
Speaker 1: would go through your registrar and you would get contacted
Speaker 1: for it. But your information is not the the information
Speaker 1: out there, so there's a proxy between you and them. UM.
Speaker 1: That would have helped him too, if he had had
Speaker 1: something like that in place, it would have helped lock
Speaker 1: it down Google. UM the UH. It's it's kind of
Speaker 1: interesting because what Google showed them was uh M star
Speaker 1: star star star star star n at, you know, the
Speaker 1: the Gmail name. They were pretty right in guessing that
Speaker 1: it was his first initial last name. He had that
Speaker 1: address at at at several places. He points that out,
Speaker 1: and that was that was easy. Could Google fix that
Speaker 1: and make it more obscure so that it wouldn't be
Speaker 1: so easy to guess. Maybe could he have picked a
Speaker 1: more difficult name to use as his backup email address? Probably,
Speaker 1: But these are there are lots of little stuff that
Speaker 1: everyone involved could have done to make it more difficult.
Speaker 1: And there's Google also has a a two step verification process.
Speaker 1: That's exactly what I was going to mention nextel two
Speaker 1: part authentication is um is a useful approach. It also
Speaker 1: and I've used it, Yeah, I've used it. It's so
Speaker 1: two part of authentication is kind of what it sounds like.
Speaker 1: You need you need to have two different things in
Speaker 1: order to be able to act as the account. And
Speaker 1: a typical approach is that you register a phone number
Speaker 1: with whatever the services of like a cell phone. You
Speaker 1: register that cell phone with whatever the services, and then
Speaker 1: when you try to access it, you have to be
Speaker 1: able to provide not only the password, but then an
Speaker 1: authentication code is sent to your device that you have
Speaker 1: registered and you have to insert whatever that that number is,
Speaker 1: and then then you can and then and only then
Speaker 1: you can actually access whatever the account is. And that
Speaker 1: helps a lot because as long as that device remains
Speaker 1: in your possession and no one has been able to
Speaker 1: intercept it in any way, you should be fairly safe.
Speaker 1: So even if they try to reset the password, they
Speaker 1: can't get access to it because they're trying through a
Speaker 1: different device that has not been registered. Uh, and then
Speaker 1: you get that that message. And we've seen very variations
Speaker 1: of this as well, not just two part authentication, but
Speaker 1: also registering devices with services like UM. Lots of them
Speaker 1: do that so that you can look at the different
Speaker 1: sessions that are logged in through a particular service and
Speaker 1: then if you if you see that there's one there
Speaker 1: that you don't recognize, someone might have access to your account. So,
Speaker 1: for example, Facebook does this where if you try and
Speaker 1: access your UM Facebook account through different devices, it may
Speaker 1: tell you, hey, I don't recognize this device. This isn't
Speaker 1: something that you've used to access this account before UM
Speaker 1: and it'll send an email to you and let you
Speaker 1: know if you are that that hey, someone's accessing this.
Speaker 1: Is this you? Because if it's you, it's cool. But
Speaker 1: if it's not you, then you need to look into
Speaker 1: this now. Again, this is this is a good tool
Speaker 1: for people who feel like they may have been hacked. However,
Speaker 1: let's say that the person who is trying to access
Speaker 1: your Facebook account. Um, you know where they're trying to
Speaker 1: hack into your Facebook account also has control of your
Speaker 1: email address. Then when they say that, hey, is this
Speaker 1: you and they send that to your email address, well
Speaker 1: they've got that email address, yes, yes, if it's gotten
Speaker 1: to that point. It's this particular approach doesn't really help you.
Speaker 1: But other things that that you can do, because there's
Speaker 1: some things that you can't have any control over. It's
Speaker 1: it's the pole, it's the companies you work with. Well, one,
Speaker 1: you can choose which companies you you associate yourself with,
Speaker 1: but beyond that, you know you have to hope that
Speaker 1: they put in the right stuff in place to protect you.
Speaker 1: What you can do one, continue to use strong passwords
Speaker 1: and don't don't use the same ones across multiple platforms
Speaker 1: because it just makes it way easier if one if
Speaker 1: one account does get compromised, it makes it way easier
Speaker 1: for all the others to get compromised. It's the domino effect. Yeah,
Speaker 1: so you we wanna you want to start picking some
Speaker 1: pretty tough passwords and and vary the across and change
Speaker 1: them fairly regularly, because the longer they stay, the more
Speaker 1: likely you're going to UM encounter a problem, use some
Speaker 1: sort of password manager so that you can keep track
Speaker 1: of them all because I know it is. You know,
Speaker 1: the flip side of a strong password is it's really
Speaker 1: hard to remember. So if you're if you've got lots
Speaker 1: and lots of online accounts, then it's going to be
Speaker 1: really challenging to keep all those straight. So some sort
Speaker 1: of password manager is important. UM Also, think about what
Speaker 1: you share before you share it online, because some of
Speaker 1: the details you share may also serve as answers to
Speaker 1: various security questions, or they may give off other information
Speaker 1: that companies use to verify identity. So be careful about that.
Speaker 1: You know, don't don't be too free with personal information
Speaker 1: if that means that information could be used to circumventanced
Speaker 1: security systems. One suggestion I've always heard is that when
Speaker 1: you create answers to security questions you create, you're essentially
Speaker 1: creating another password. You don't you don't answer the question
Speaker 1: you and you put something else in there, and you
Speaker 1: put something something unrelated but something you will easily remember,
Speaker 1: all right, So something that doesn't have to be a
Speaker 1: strong password. In other words, it just needs to be
Speaker 1: a keyword that doesn't have anything to do with a question,
Speaker 1: but it's a keyword you are guaranteed to remember. So, So,
Speaker 1: for example, if you, uh, maybe I've seen something that
Speaker 1: asked for the name of your friend model of your
Speaker 1: first car, you could say something like grapefruit. Yeah, which, well,
Speaker 1: I know if I'm asked about my car, I'm going
Speaker 1: to say grapefruit. Somebody might go, oh, it's a Chevy.
Speaker 1: They might have looked on your Facebook page and you
Speaker 1: might have had a thing like this says man, I
Speaker 1: have such great memories of my of my first car,
Speaker 1: and then you have a picture of it on there. Well,
Speaker 1: that's all they would need to be able to answer
Speaker 1: that question if you use the right answer, the right
Speaker 1: or a corresponding answer. So if you've done, say a
Speaker 1: thing on on genealogy, and you've uh, you know, talked
Speaker 1: about your parents and say, well, you know my mother
Speaker 1: who was so and so, and it's like, what's your
Speaker 1: mother's maiden name? Oh, well I know it was Steven's
Speaker 1: because I saw it on the on their Facebook account.
Speaker 1: Well that's pretty easy to track down. Um. And and
Speaker 1: speaking of Facebook, Uh, it occurs to me that a
Speaker 1: lot of sites these days are using Facebook Connect or
Speaker 1: Google or Yahoo and you can say, hey, would you
Speaker 1: like to sign in with your blank account? Some of
Speaker 1: them exclusively do that where you cannot access it unless
Speaker 1: you happen to have one of those are their accounts. Yes,
Speaker 1: Like I believe Pinterest you had to log in through
Speaker 1: Facebook when it was when it first started. I don't
Speaker 1: know if that's still the case. And Spotify, Uh, Spotify,
Speaker 1: you know, had had switched to requiring Facebook. Um, okay.
Speaker 1: So if they gain access to your Facebook account, all
Speaker 1: of a sudden, they've got access to every other account
Speaker 1: that you've used that log in with. So when they
Speaker 1: offer you an opportunity to create a separate log in,
Speaker 1: maybe you should take that opportunity. Yeah, it's a pain.
Speaker 1: Is a pain. And the whole point about the whole
Speaker 1: Facebook connect is that it makes it much more convenient,
Speaker 1: you know, you you know, Facebook loves it because it
Speaker 1: becomes the platform for the Internet, and people love it
Speaker 1: because it means that it's one less thing they have
Speaker 1: to worry about when they want to log in. But
Speaker 1: it does mean that there is this point of vulnerability
Speaker 1: that is incredibly attractive to someone who wants to get
Speaker 1: access to your stuff. Because it's going if they get
Speaker 1: access to one thing, they get access to a dozen more.
Speaker 1: And it doesn't I say Facebook, but like Chris was saying,
Speaker 1: it's not just Facebook. Google is the same way. There
Speaker 1: are lots of different services that if you have a
Speaker 1: Google account you could potentially access. UM. Another another suggestion
Speaker 1: I've seen is that there are a lot of services
Speaker 1: out there that some of us will sign up for
Speaker 1: and then stop using and then forget about UM. It
Speaker 1: might not be a bad idea to if you never
Speaker 1: use those services, it might not be a bad idea
Speaker 1: to go back and check and delete those accounts, because
Speaker 1: those are other points of vulnerability, especially if it's going
Speaker 1: to you know, if you do tend to use the
Speaker 1: same group of passwords over and over and hackers get
Speaker 1: access to something, particularly if it's something that isn't terribly
Speaker 1: popular anymore, and maybe as a result, the security measures
Speaker 1: aren't as up to date as they could be. It's
Speaker 1: a possibility you might want to get rid of that stuff.
Speaker 1: So you know that my Space account that you haven't
Speaker 1: checked in four years, maybe it's time to just go
Speaker 1: ahead and close that out, you know that kind of stuff. Yeah, Uh,
Speaker 1: And we've already mentioned back up your data. It's also
Speaker 1: very important. Uh yeah, so basic basic tips that you
Speaker 1: can follow to try and protect yourself and keeping in
Speaker 1: line that you know, a lot of this also depends
Speaker 1: upon the other parties involved. Yeah, and so looking back
Speaker 1: at at at Matt hone and did he do something
Speaker 1: wrong or you know, deserving of being you know, you know,
Speaker 1: really he could have been any of us. And even
Speaker 1: though he's a known tech journalist, he you know, sort
Speaker 1: of succumbed to being human. You know, he had the
Speaker 1: same password, he didn't change it for a long time.
Speaker 1: He's probably told he didn't back up. And I'm sure
Speaker 1: he's probably told people to do that a thousand times,
Speaker 1: just like we have. You know, we're all guilty of
Speaker 1: doing these little things because their pains in the neck.
Speaker 1: We don't want to do it, we don't have time
Speaker 1: to do it. I mean, he's got kids times of
Speaker 1: premium for him, just like it is for so many
Speaker 1: of us. Um, you know, is it is it Apple's
Speaker 1: fault in particular? Is it Amazon's fault in particular? The
Speaker 1: only people who are are really at fault of the hackers. Yeah,
Speaker 1: it's it's it's the combination of all of these things
Speaker 1: together that made it possible. It's the hackers that are
Speaker 1: really at fault. Yeah, And the thing is, yeah, we're
Speaker 1: all busy, and none of us really wants to make
Speaker 1: up a new, you know, twenty four digit password for
Speaker 1: each thing and worry about them. No, none of us
Speaker 1: really wants to mess with that. But the truth of
Speaker 1: the matter is that all these systems worked together to
Speaker 1: make this possible. And and it's true for all of us.
Speaker 1: I mean, these these vulnerabilities are vulnerable for all of us.
Speaker 1: It's I know that Amazon and Apple both have thought
Speaker 1: about this. It's still kind of fresh um as the recording, Yeah,
Speaker 1: as they're recording this podcast. So you know, neither of them,
Speaker 1: I don't think, have made some public proclamation about how
Speaker 1: they're going to fix this going forward quote unquote fix
Speaker 1: it again. How what do you do? It's not obvious
Speaker 1: to do this, So I think the two part authentication
Speaker 1: is probably one of the the more obvious approaches. And uh,
Speaker 1: well we might see some other elements thrown in there too,
Speaker 1: And and how of her I have seen people say, yeah,
Speaker 1: and I turned this on and it was the point
Speaker 1: I was making earlier. It made it so difficult that
Speaker 1: it took me two weeks to figure out how to
Speaker 1: get back into my account, and it was a real
Speaker 1: pain in the neck. I got in, but it took
Speaker 1: me a while because I kind of, uh laid myself
Speaker 1: a trap. So it's it's one of those things where
Speaker 1: I think you kind of have to work into it
Speaker 1: and think about this stuff when you set it up
Speaker 1: and go back and look at your accounts and see
Speaker 1: how it's laid out to fix this for yourself. Yeah,
Speaker 1: this is this is why it's really important for companies
Speaker 1: to uh to hire white hat hackers who I mean,
Speaker 1: all they do is look at systems and try and
Speaker 1: find ways to to breach systems so that those systems
Speaker 1: can be improved over time. And it's important to get
Speaker 1: a third party to do it because when you design
Speaker 1: a system again, you may be thinking of the obvious
Speaker 1: points of injury, which is where you've really really put
Speaker 1: in great security, right like you know, like there's no
Speaker 1: way anyone's going to get through this, at least not
Speaker 1: in the next five years. We require people to use
Speaker 1: non alpha numeric characters, Well, that's great if they're going
Speaker 1: to use the password in case they used a backdoor. Yeah.
Speaker 1: So again that's why you want to have a third party,
Speaker 1: because they're not thinking the way you think. They're thinking
Speaker 1: how do I get into this system? Not not how
Speaker 1: strong do I make this door? So yeah, there's certain
Speaker 1: things companies can do, um, but there are a lot
Speaker 1: of things we can do as customers, as users to
Speaker 1: try and protect ourselves. And uh. And it's a great
Speaker 1: responsible to you. Don't forget it's a cautionary tale. And uh,
Speaker 1: I mean in a way it could have turned out
Speaker 1: way worse than it did. Um. So I'm sure, I'm
Speaker 1: sure there's some solace in that for Honan, But I
Speaker 1: mean I can't imagine how and I really don't want
Speaker 1: to imagine how how how he felt when all that happened. Uh. Anyway,
Speaker 1: that wraps up this discussion about the cloud security, maintaining
Speaker 1: your own security there and uh and and the problems
Speaker 1: that exist in our digital age. So you guys, if
Speaker 1: you have any suggestions for topics we should cover in
Speaker 1: future episodes of tech Stuff, you can let us know
Speaker 1: by sending us an email are adjust as tech Stuff
Speaker 1: at Discovery dot com, or send us a message on
Speaker 1: Facebook or Twitter, or handle it both of those is
Speaker 1: text stuff. H. S W and Chris and I will
Speaker 1: talk to you again really soon. For more on this
Speaker 1: and thousands of other topics, visit how stuff works dot com.
Speaker 1: Brought to you by the reinvented two thousand twelve Camray.
Speaker 1: It's ready, are you