Speaker 1: Welcome to tech Stuff, a production from iHeartRadio. Hey there,
Speaker 1: and welcome to tech Stuff. I am your host, Jonathan Strickland.
Speaker 1: I am an executive producer with iHeartRadio. And how the
Speaker 1: tech are you? I am recording live here from the
Speaker 1: iHeart Podcast studio powered by Bose at the House of
Speaker 1: Music at the iHeartRadio Music Festival. I'm sure you're gonna
Speaker 1: be able to hear some of the ambience, let's call
Speaker 1: it here at the festival. And that's just proof that
Speaker 1: I'm actually here. I don't know how that happened. I
Speaker 1: am nowhere near cool enough to have been invited here.
Speaker 1: I guess they didn't listen to the show first. That's
Speaker 1: fine with me, though. There's some pretty incredible musical acts
Speaker 1: that are going to be rocking out in the arena
Speaker 1: that's right in front of me, and I will sit
Speaker 1: here and talk about geeky tech stuff. So the question
Speaker 1: is then, what topic should I cover for this episode?
Speaker 1: And I asked myself that several times. I had a
Speaker 1: lot of possible answers. Maybe I could talk about the
Speaker 1: tech of running a concert, for example, there's a lot
Speaker 1: of tech involved in that. Maybe I could just talk
Speaker 1: about the tech needed to make sure a band's equipment's
Speaker 1: all working properly. I could talk about sound systems, or lasers,
Speaker 1: or pyrotechnics or all sorts of stuff, but I'm in Vegas, baby,
Speaker 1: And what's more, I'm staying at a hotel that's owned
Speaker 1: by MGM Resorts. So I think the topic to tackle
Speaker 1: is the recent hacker attack on that company. So what
Speaker 1: exactly happened, who is responsible or who do we think
Speaker 1: is responsible, how did it unfold, and what are the
Speaker 1: ongoing consequences. So sit back, folks, it's time to do
Speaker 1: a casino heist podcast episode tech stuff style. Now, Originally
Speaker 1: I thought I do a quick history of MGM Resorts International,
Speaker 1: you know, the company that became the target of the hackers.
Speaker 2: But as it turns out, that company's history is, let's say,
Speaker 2: it's super complicated, and it overlaps the history of MGM Studios,
Speaker 2: the film company, as well as numerous other companies both
Speaker 2: within the gambling world and beyond.
Speaker 1: So rather than go through all of that, which would
Speaker 1: be confusing in an entire episode by itself, I'm just
Speaker 1: gonna kind of give you a summary. So, since the
Speaker 1: mid nineteen eighties, the company that we now call MGM
Speaker 1: Resorts International has had some major ups and downs. It
Speaker 1: has also over time swallowed up other companies that operated
Speaker 1: resorts and casinos in Vegas and in other places. Today,
Speaker 1: MGM Resorts International operates but does not own, numerous resorts
Speaker 1: in Vegas and beyond. Among the Vegas properties are the
Speaker 1: MGM Grand and assorted MGM properties like Park MGM, the Blagio,
Speaker 1: the Aria, the Cosmopolitan New York, New York, Excalibur, the Luxor,
Speaker 1: Mandalay Bay, and some more. And it also has a
Speaker 1: more than forty ownership of the T Mobile Arena, the
Speaker 1: building that is directly in front of me, just the building. However,
Speaker 1: they do not own the land. The company made somewhere
Speaker 1: in the neighborhood of thirteen billion dollars in revenue last year.
Speaker 1: That was an increase from nearly nine point seven billion
Speaker 1: from the year before, and it seems that twenty twenty
Speaker 1: two saw the highest revenues in the company's history so far.
Speaker 1: Of course, revenue is not the same as income. That's
Speaker 1: more to the tune of one point four billion dollars
Speaker 1: for twenty twenty two. That's a lot of money, princely
Speaker 1: sum as I might say they own more than thirty
Speaker 1: billion dollars worth of assets. So, in other words, to
Speaker 1: enterprising thieves, MGM Resorts International is a tempting target. Heck,
Speaker 1: that's the stuff of heist movies, right, except a heist
Speaker 1: is typically a high risk endeavor and it's almost bound
Speaker 1: to fail. Successful heists have happened in the past, even
Speaker 1: in Vegas, but more often not, the house comes out
Speaker 1: on top. Moving the heist into the realm of computer
Speaker 1: systems becomes a different matter. However, it's more likely that
Speaker 1: you can find a way to pull off your crimes
Speaker 1: while you protect yourself. Now, before we move on to
Speaker 1: the actual hacking attack, I also need to mention the
Speaker 1: company Caesar's Entertainment. Like MGM, Caesar's has a really, really
Speaker 1: complicated history. It's filled with mergers and acquisitions and sales
Speaker 1: and even bankruptcies. It gets bonkers. The most recent move
Speaker 1: of that company was in twenty twenty. That's when another
Speaker 1: company called El Dorado Resorts Incorporated acquired Caesar's Entertainment Corporation.
Speaker 1: Then El Dorado Resorts changed its own name to Caesar's Entertainment.
Speaker 1: But there are other companies that are lumped in there.
Speaker 1: As well, like Hera's Entertainment is part of that. Anyway.
Speaker 1: In twenty fifteen, Caesar's went into bankruptcy, and as part
Speaker 1: of the effort to get out of bankruptcy, the company
Speaker 1: split into two entities. One would be a company that
Speaker 1: would actually operate the various resorts and casinos. The other
Speaker 1: would be what is called a real estate investment trust
Speaker 1: or REIT, which would actually own all the properties. To
Speaker 1: get into riits is beyond the scope of the show,
Speaker 1: but y'all, they can be monsters anyway. The spin off
Speaker 1: OREIT took the name VICH after Vinnie vid Vic. You know,
Speaker 1: I came, I saw I conquered, So VICH technically owns
Speaker 1: many nineteen in fact of Caesar's properties. Here's the wild thing.
Speaker 1: Last year VICH acquired ownership of thirteen MGM properties. So
Speaker 1: both Caesar's Entertainment and MGM Resorts International pay rent to
Speaker 1: VICE in order to operate their respective casinos. So you
Speaker 1: want to know what the power behind the throne is,
Speaker 1: look to vch. Anyway, while all those dealings are worthy
Speaker 1: of a deep and engrossing podcast series, this is a
Speaker 1: hint somebody make a podcast series about these real estate
Speaker 1: companies and their involvement in Las Vegas because it is fascinating,
Speaker 1: but our focus should really be on the hacker attacks. Now.
Speaker 1: It is important that I mentioned Caesar's because while the
Speaker 1: attack on MGM's properties was the major attack that's been
Speaker 1: in the news for a couple of weeks, now, those
Speaker 1: same hackers, or at least some of them, first targeted
Speaker 1: Caesar's Entertainment a little earlier. Two of the biggest gambling
Speaker 1: companies in the world have fallen prey to hackers, and
Speaker 1: it appears that the foothold the hackers established came courtesy
Speaker 1: of a third party security firm and also involves a
Speaker 1: very important company in tech, namely Octa. Now, y'all, the
Speaker 1: hacker attack is bad news for MGM, there's no way
Speaker 1: around it. But I would actually argue it could be
Speaker 1: way worse for Octa, at least as far as reputations go.
Speaker 1: And that's because Octa is an identity and access management company.
Speaker 1: This is the company that markets the user authentication system
Speaker 1: that tons of other companies rely upon. With Octa, a
Speaker 1: company can hand over the trickier elements of user authentication.
Speaker 1: So as companies grow more complex, they might add more
Speaker 1: systems that employees rely upon, and it can be a
Speaker 1: hassle if you need a different log in for every
Speaker 1: single service you use. A service like single sign on
Speaker 1: really simplifies things. You have a username and password and
Speaker 1: that gives you access to a suite of different services
Speaker 1: all with just one log in, So you can see
Speaker 1: where the value of that is right well, with Octa,
Speaker 1: a company can hand over all of this and Octa
Speaker 1: handles it, and you pretty much have to just trust
Speaker 1: Octa to be a good steward of this process now.
Speaker 1: Todd McKinnon and Frederick Krist co founded Octa back in
Speaker 1: two thousand and nine. The company has been the focus
Speaker 1: of a couple of security incidences since it's founding. In
Speaker 1: twenty twenty one, a hacker group secured limited access to
Speaker 1: octasystems by compromising a camera network inside the Octa offices,
Speaker 1: specifically a system designed by Verkaida, a company that I
Speaker 1: should probably talk about in a future episode. In early
Speaker 1: twenty twenty two, a different hacker group known as Lapsus
Speaker 1: accessed OCTA's systems. This time, the attack vector was a
Speaker 1: third party support engineer. Lapsus shared information suggesting that the
Speaker 1: data breach was far greater than what Octa was telling
Speaker 1: the public. But Octa executives really held their ground. They
Speaker 1: said that are only around two point five percent of
Speaker 1: OCTA's customers were potentially impacted by this data breach, and
Speaker 1: that the hackers had limited access to customer data. Octa
Speaker 1: said the data breach lasted for less than half an
Speaker 1: hour and it only hit two customers, whereas Lapses claimed
Speaker 1: and maintained a presence in OCTA's systems or this client
Speaker 1: of OCTA's systems for the better part of a week. Now,
Speaker 1: that attack was bad, but it could have been worse,
Speaker 1: And to be totally fair to Octa, it was really
Speaker 1: the third party security person who was at fault for
Speaker 1: the breach. Though I never really saw details on exactly
Speaker 1: what happened with that one, I imagine it was something
Speaker 1: fairly similar to what we are talking about today. So
Speaker 1: let's set the scene. We're not going to go strictly
Speaker 1: chronologically because some information we wouldn't know about until later,
Speaker 1: so we're going to be jumping around a little bit
Speaker 1: for the purposes of our story. Will begin on September tenth,
Speaker 1: twenty twenty three. That day, some folks who were staying
Speaker 1: at MGM Resort International properties began to encounter errors while
Speaker 1: they were trying to interface with various systems connected to
Speaker 1: those properties. The following day, September eleventh, twenty twenty three,
Speaker 1: things got much worse. Players who were members of MGM
Speaker 1: Resort's loyalty program saw that their loyalty features weren't working.
Speaker 1: The websites went down. People staying at MGM properties found
Speaker 1: that their digital keys that they depended on on their smartphones,
Speaker 1: they they weren't working anymore. They couldn't get into their
Speaker 1: rooms using their digital keys. They these effects got worse.
Speaker 1: You know, a lot of video slot machines went offline.
Speaker 1: That was a huge indicator that something really bad had happened.
Speaker 1: Sports betting features were interrupted even ATMs on casino floors
Speaker 1: went out of service. At eleven twenty seven am Eastern Time,
Speaker 1: MGM Resorts posted on x you know, the platform formerly
Speaker 1: known as Twitter, a little message and it read quote
Speaker 1: MGM Resorts recently identified a cybersecurity issue affecting some of
Speaker 1: the company's systems. Promptly after detecting the issue, we quickly
Speaker 1: began an investigation with assistance from leading external cybersecurity experts.
Speaker 1: We also notified law enforcement and took prompt action to
Speaker 1: protect our systems and data, including shutting down certain systems.
Speaker 1: Our investigation is ongoing and we are working diligently to
Speaker 1: determine the nature and scope of the matter. You know
Speaker 1: it's serious when they say that they responded promptly and quickly.
Speaker 1: When you get both of those back to back, you
Speaker 1: know it's a bad, bad time. And what exactly happened, Well,
Speaker 1: i'll tell you after we come back from this quick break.
Speaker 1: All right, we're back. You are listening to tech stuff
Speaker 1: live at the iHeart Podcast Studio powered by Bows at
Speaker 1: the House of Music at the iHeartRadio Music Festival, in
Speaker 1: the house that John built. This is a pretty incredible experience.
Speaker 1: Whenever I look up, I'm just seeing tons of people
Speaker 1: in various trendy outfits wandering around getting ready for the
Speaker 1: festival and hanging out the House of Music. It's pretty cool. Again,
Speaker 1: I feel like I'm totally out of place here, but
Speaker 1: they invited me, so I guess I should just embrace it.
Speaker 1: So we're going to jump back into this cybersecurity incident
Speaker 1: that hit a couple of major gaming and hotel companies
Speaker 1: and dozens of properties so as you might expect, speculation
Speaker 1: ran rampant regarding the nature of the cybersecurity issue that
Speaker 1: MGM Resorts International mentioned. Some thought that it could just
Speaker 1: be a massive systems failure, like you know, maybe some
Speaker 1: key system that connects everything went down. Some people figured
Speaker 1: it had to be a ransomware attack. Lots of folks
Speaker 1: assumed that the issue would receive a ton of coverage
Speaker 1: on certain podcasts. No one mentioned me, which just hurts
Speaker 1: my feelings, and folks were complaining right away about the
Speaker 1: issues they encountered. One x user posted quote, we are
Speaker 1: at one of your resorts. It's pretty widespread. We can't
Speaker 1: check in, pay with card, use comps, receive our gifts,
Speaker 1: get tickets out of machines. End quote. Others claimed they
Speaker 1: had unexplained charges on their bills. Some of these incidents
Speaker 1: happened before September eleventh, so whether they are accurate, or
Speaker 1: maybe they reflect some other issue that's unrelated to this,
Speaker 1: or maybe they're the attempt of cashing in on a
Speaker 1: bigger problem, I can't say. I don't know. I just
Speaker 1: know people reported it. The websites for various MGM resorts,
Speaker 1: as well as the sites for restaurants on MGM properties
Speaker 1: all went down. MGM replaced its website with kind of
Speaker 1: a landing page that directed people to call resorts directly,
Speaker 1: so it just listed each resort and its phone number,
Speaker 1: so you would have to call them on the phone,
Speaker 1: you know, like a caveman. That's a joke. I'm old
Speaker 1: I still call places on occasion. The following day, MGM
Speaker 1: Resorts gave an update saying that much of its services
Speaker 1: were operational, including entertainment, dining, and gaming, but people were
Speaker 1: still encountering issues. There were still problems with slot machines.
Speaker 1: Hand pay became the method to cash out. This is
Speaker 1: when you have to signal for a casino employee to
Speaker 1: come over and count out by hand your winnings rather
Speaker 1: than getting the machine to print out a ticket, and
Speaker 1: you take that ticket to a payout machine feeded in
Speaker 1: and then you get your cash that way. The ATMs
Speaker 1: were still having issues. People still couldn't check in online,
Speaker 1: They could not make a card payment to book a room.
Speaker 1: At that point, lines were forming at the desks of
Speaker 1: various MGM resort properties because you couldn't use your digital
Speaker 1: keys at all, so you couldn't just check in with
Speaker 1: your phone and then use your phone to get into
Speaker 1: your room. You had to go and get a physical
Speaker 1: key card. It was still like an RFID chip key card,
Speaker 1: so you could hold it up to the door and
Speaker 1: it would open, but you had to have one. You
Speaker 1: couldn't just use your phone to do it. So that
Speaker 1: meant everybody had to go and wait in line to
Speaker 1: get a key. On September twelfth, we heard that a
Speaker 1: hacker group called Alpha ALPHV. Actually that's the way they
Speaker 1: style their name. Sometimes they're also called black Cat. We
Speaker 1: heard that they could have been behind the attack. Now,
Speaker 1: the black Cat name actually comes from malware that this
Speaker 1: group has created, you know, some malicious software, ransomware to
Speaker 1: be precise, and Alpha introduced that in late twenty twenty one.
Speaker 1: And here's how an Alpha attack would typically work out.
Speaker 1: So the group would end up collaborating with someone to
Speaker 1: inject the malware into a targeted system. That person might
Speaker 1: be a disgruntled employee of the target. Maybe they're not
Speaker 1: even disgruntled, maybe they're just very greedy. Because Alpha would
Speaker 1: offer up to ninety percent of a ransom to the
Speaker 1: quote unquote affiliate. The affiliate could also be some other
Speaker 1: hacker group that its job is just to gain access
Speaker 1: to a system through some means, and Alpha would provide
Speaker 1: the malware while the other group actually would get access
Speaker 1: to the target. It would become this, you know, this
Speaker 1: collaborative effort. Now, this means the business model for Alpha
Speaker 1: is r a as that stands for ransomware as a serve.
Speaker 1: That as a service trend has gotten out of control, y'all.
Speaker 1: So these hackers, who primarily communicate on Russian language platforms,
Speaker 1: build the tools, but they don't necessarily carry out the
Speaker 1: attacks themselves. They're facilitators. The black cat and malware encrypts
Speaker 1: a target computer system, so it makes it inaccessible to
Speaker 1: the system's rightful owner. So imagine you log into your computer,
Speaker 1: but you find out you can't access anything. All the
Speaker 1: files are encrypted, all the methodologies are encrypted. You can't
Speaker 1: decrypt it, so it's just a brick without the key.
Speaker 1: The data on your machine stays out of your reach.
Speaker 1: And then you see a message, and the message tells
Speaker 1: you that the hackers will give you access back to
Speaker 1: your data. They will give you the decryption key, but
Speaker 1: only if you pay them a ransom. Usually this is
Speaker 1: in the realm of millions of dollars. Typically they ask
Speaker 1: for it in the form of cryptocurrency to avoid being
Speaker 1: traced back to the people responsible. And if you don't
Speaker 1: pay up, the hackers will say either you will not
Speaker 1: get access to your data again, it's just gone, or
Speaker 1: they'll delete it. Sometimes they'll say, all right, we won't
Speaker 1: delete it. Instead, what we're going to do is we're
Speaker 1: going to release all that data on a public platform
Speaker 1: so that anyone and everyone can see what it is. Typically,
Speaker 1: ransomware hackers want to target organizations that have a lot
Speaker 1: of money and a lot of incentive to protect data. Now,
Speaker 1: pretty much every organization has an incentive to protect its
Speaker 1: data at least to some extent. Information is the currency
Speaker 1: of the modern era, after all, and while you can't
Speaker 1: spend information, you can sure affect the value of a
Speaker 1: company by stealing their information. But ransomware hackers typically want
Speaker 1: to target organizations that have access to buckets of cash.
Speaker 1: So prime targets for these hackers ideally fall into a
Speaker 1: couple of categories. If it's a really big company and
Speaker 1: its business depends upon the safe keeping of information, particularly
Speaker 1: really personal information, that ends up being a big target.
Speaker 1: So hospitals and other healthcare companies fall into that category.
Speaker 1: By law, these companies are meant to keep patient data secure.
Speaker 1: There in big trouble if they don't, And obviously any
Speaker 1: healthcare company that fails to live up to that would
Speaker 1: have a massive problem, not just from the government or
Speaker 1: from law enforcement, but you know, they would lose the
Speaker 1: confidence of patients, and patients could have their lives really
Speaker 1: upturned if their personal health information gets shared everywhere. So
Speaker 1: the thinking goes that those companies are more likely to
Speaker 1: pay a ransom in order to make the problem go away.
Speaker 1: That's why ransomware hackers target healthcare companies so frequently. They
Speaker 1: have a very high incentive to get the problem fixed
Speaker 1: as quickly as possible. Well, casinos and resorts definitely fall
Speaker 1: into a similar category. Right first, you've probably heard the
Speaker 1: phrase the house always wins. Well, that phrase references the
Speaker 1: fact that the odds are ever in the favor of
Speaker 1: the house. You might have a good night at the tables,
Speaker 1: and you might leave with more money than you brought
Speaker 1: with you, but lots of other people will end the
Speaker 1: night down with less money than what they started with.
Speaker 1: Or maybe you'll also be down a little bit, and
Speaker 1: other folks will also be down a bit, and some
Speaker 1: of them might be down a lot. All casino games
Speaker 1: favor the house, and that makes sense because if they
Speaker 1: didn't favor the house, then casinos would soon be out
Speaker 1: of business, right So instead, collectively the casinos in Nevada
Speaker 1: can make at least a billion dollars every month. That's
Speaker 1: across all the casinos in Nevada. Some games will give
Speaker 1: you better shot at winning that other games. Blackjack is
Speaker 1: a game that has fairly decent odds, somewhere in the
Speaker 1: neighborhood of forty percent to win. Dealers have about a
Speaker 1: forty nine percent chance to win. And you might think, oh,
Speaker 1: forty nine plus forty's that's not one hundred. Well, that's
Speaker 1: because the rest of the odds kind of cover the
Speaker 1: case where you could have a draw or a push
Speaker 1: where you go to the next hand. Meanwhile, games like
Speaker 1: kino or the Wheel of Fortune, they have some of
Speaker 1: the worst odds in gambling. So that doesn't mean you're
Speaker 1: destined to lose if you play, but the chances are
Speaker 1: pretty darn high. So anyway, this means that casinos make
Speaker 1: a lot of money. If I might elaborate, they make
Speaker 1: a crap ton of money and that puts them firmly
Speaker 1: in one of the categories that ransomware hackers love to target,
Speaker 1: companies that are flush with cash. On top of that,
Speaker 1: these casinos deal with a lot of customer data, whether
Speaker 1: it's someone staying at a resort or a gambler who
Speaker 1: has signed up to participate in a loyalty program, which
Speaker 1: is a pretty frequent thing, because the casinos here have
Speaker 1: lots of incentives to get people to sign up to
Speaker 1: their loyalty programs. You can get gifts, you can redeem credits,
Speaker 1: you can get a free room if you're a frequent
Speaker 1: gambler and you're part of the loyalty program. There are
Speaker 1: a lot of reasons for that. In return, one, the
Speaker 1: casino has a repeat customer, which is very valuable, and two,
Speaker 1: the casino can gather data about the people who visit
Speaker 1: their resorts and learn more about them and thus cater
Speaker 1: to them more and make even more money. So this
Speaker 1: information has value not just because of how it can
Speaker 1: be used to advertise to individuals, that's often what we
Speaker 1: talk about when we talk about data in the modern world,
Speaker 1: but it has value because the customers are trusting the
Speaker 1: casinos with this information. Even if they aren't aware of
Speaker 1: the implications, and so when there is a data breach,
Speaker 1: suddenly customers get very much concerned about that data. It
Speaker 1: affects them directly. If there's the possibility that the customer's
Speaker 1: own finances could be compromised, that's a huge problem for
Speaker 1: both the customer and the casino. So this means casinos
Speaker 1: and resorts are in that sweet spot for ransomware hackers.
Speaker 1: So how did we find out about Alpha's alleged involvement
Speaker 1: with the MGM Resorts International hack. Well, one early statement
Speaker 1: came from the x account, the Twitter account of a
Speaker 1: group called VX Underground. Vx Underground bills itself as the
Speaker 1: largest collection of malware source code, samples and papers on
Speaker 1: the Internet, and they work with lots of researchers, They
Speaker 1: work with hackers, They work with tons of people largely
Speaker 1: to educate about malware. They are rather cheeky, I would
Speaker 1: say they kind of have that cheeky sense of hackers.
Speaker 1: They do not necessarily come across as being buttoned down,
Speaker 1: let's say. So. On September twelfth, VX Underground posted all
Speaker 1: Alpha ransomware group did to compromise MGM Resorts was hop
Speaker 1: on LinkedIn, find an employee, then call the help desk.
Speaker 1: A company valued at thirty three billion, nine hundred million
Speaker 1: dollars was defeated by a ten minute conversation end quote. Now,
Speaker 1: MGM did not comment on this, and as far as
Speaker 1: I'm aware, has never actually referenced their cybersecurity incident as
Speaker 1: an attack, but lots of other folks have not been
Speaker 1: in the mood to mince words, and the information that
Speaker 1: would come out later seem to align with what VX
Speaker 1: Underground was claiming. The attack happened through social engineering. So
Speaker 1: stage one, you learn about the person you're going to impersonate.
Speaker 1: You find someone on LinkedIn who has listed their job
Speaker 1: title and where they work. If you can find someone
Speaker 1: who has a very high profile job title, something that's
Speaker 1: really high up in an organization, that's potentially much better,
Speaker 1: or if it's not high up, at least someone who
Speaker 1: works within the IT department, because that typically means you're
Speaker 1: going to find someone who has a lot of access
Speaker 1: to the systems if you're able to compromise their account. Now,
Speaker 1: I've talked about social engineering a ton on this show,
Speaker 1: how it is a huge part of hacking. See if
Speaker 1: you've got a system that is at least in theory,
Speaker 1: really well secured. Your best bet of infiltrating the system
Speaker 1: is to target a vulnerability. And sometimes you find out
Speaker 1: about technical vulnerability, right. You might find out that there's
Speaker 1: a vulnerability in some software that a company is dependent upon,
Speaker 1: and by targeting that software vulnerability, you can penetrate the system.
Speaker 1: You can gain access to it, you can get a
Speaker 1: foothold there, and if you're really good, or really quick
Speaker 1: and or really lucky, you can exploit that vulnerability and
Speaker 1: then you're in. Obviously, there's way more to it than that.
Speaker 1: I mean, just because you get access doesn't mean that
Speaker 1: you can do anything, and even if you can do something,
Speaker 1: you might get found out before you're able to really
Speaker 1: do a lot of damage. But you get the idea.
Speaker 1: That's one method of penetrating a secure system, as you
Speaker 1: target a vulnerability in some software. But another way is
Speaker 1: not to worry about the tech side that much at all.
Speaker 1: You target people. You look at people who have access
Speaker 1: to the system you want to infiltrate. People are frequently,
Speaker 1: in fact almost always, I would say, the weakest point
Speaker 1: of a security system. If you can convince someone who
Speaker 1: has access to hand that access over you're in. Maybe
Speaker 1: you outright trick the person, Maybe you pose as someone
Speaker 1: in authority, or maybe someone who needs help, and you
Speaker 1: convince them to do something they absolutely shouldn't do. As
Speaker 1: it turns out most of us anyway, if we are
Speaker 1: presented with someone who who is saying that they really
Speaker 1: need help, they're in desperate need of some assistance, we
Speaker 1: want to try and be the person to give them
Speaker 1: that assistance. It's not universally true, but it's true often
Speaker 1: enough that this approach works a lot. Or maybe instead
Speaker 1: you actually are promising this person a cut of the money.
Speaker 1: Maybe you're counting on their greed to push them into
Speaker 1: granting you access. If you target someone who has a
Speaker 1: lot of administrative access to a system but they are
Speaker 1: not in a high paying job, sometimes just promising them that,
Speaker 1: you know, sweet cold hard cash is enough to let
Speaker 1: them be kind of a conspirator on your side. Now,
Speaker 1: in this case, it seemed that someone talked to a
Speaker 1: third party IT staffer, and as part of that conversation,
Speaker 1: they convinced the IT staffer to reset some multi factor
Speaker 1: authentication settings so that the hackers could gain access to
Speaker 1: a single sign on system. You know, the kind of
Speaker 1: stuff that ACTA provides out. I'm guessing a lot of
Speaker 1: you know that there are different levels of access with
Speaker 1: computer systems, whether we're talking about a network or even
Speaker 1: just a single computer. So, for example, a user typically
Speaker 1: has limited access to a computer or a system. They
Speaker 1: might be able to do stuff like open specific programs
Speaker 1: and call up files and that kind of thing, but
Speaker 1: to make actual changes to the computer, the user might
Speaker 1: need administrator access, while other levels of access come with
Speaker 1: specific permissions, and administrator level access has no such restrictions.
Speaker 1: And so the attackers wanted two target accounts that would
Speaker 1: have the highest administrator access to systems to have as
Speaker 1: much opportunity to do whatever they wanted as they could.
Speaker 1: So on September fourteenth, news broke that Caesar's Entertainment had
Speaker 1: also been the target of a ransomware attack. The company
Speaker 1: had filed a report with the SEC on September seventh.
Speaker 1: In that report, the company leads with Caesar's Entertainment Incorporated.
Speaker 1: The company we or are because it's a unofficial filing,
Speaker 1: recently identified suspicious activity in its information technology network resulting
Speaker 1: from a social engineering attack on an outsourced IT support
Speaker 1: vendor used by the company. Our customer facing operations, including
Speaker 1: our physical properties and our online and mobile gaming applications,
Speaker 1: have not been impacted by this incident and continue without
Speaker 1: disruption end quote. So that's a big difference between the
Speaker 1: Caesar's attack and what happened at MGM. The report goes
Speaker 1: on to say that an investigation determined that the hackers
Speaker 1: were able to access information in Caesar's Entertainment's loyalty program interface. Obviously,
Speaker 1: that includes customer information, including stuff like driver's license numbers
Speaker 1: and or social security numbers. If you enroll in these,
Speaker 1: you typically have to allow them to make a copy
Speaker 1: of things like your driver's license in order to get
Speaker 1: the benefits of the loyalty program. Now that's clearly a
Speaker 1: risk for things like identity theft. They said there was
Speaker 1: no evidence that the hackers were able to access things
Speaker 1: like passwords, bank account information, or payment card information, so
Speaker 1: that's good, but the identity theft issue is still a
Speaker 1: big concern. They did say they would offer credit monitoring
Speaker 1: to all members of the loyalty program and that it
Speaker 1: had already taken steps quote to ensure that the stolen
Speaker 1: data is deleted by the unauthorized actor end quote. So
Speaker 1: how do they make sure that this data gets deleted
Speaker 1: by a party they have no control over. Most folks
Speaker 1: interpreted that to mean that Caesar's had paid the ransom. Now,
Speaker 1: the rumor mill said that the hackers were asking for
Speaker 1: thirty million dollars and in return they would pinky swear
Speaker 1: that they would delete the stolen data. Caesar's ultimately agreed
Speaker 1: to pay fifty fifteen million dollars to delete information yaoza.
Speaker 1: By the way, fifteen million dollars means that technically this
Speaker 1: would have been the second most successful casino heist that
Speaker 1: I have ever encountered. And granted, it's not quite the
Speaker 1: same as a casino heist, but then number one really
Speaker 1: isn't either. I'll talk more about that toward the end
Speaker 1: of this episode. In fact, we'll talk a lot more
Speaker 1: about the hackers and what they did. But we're going
Speaker 1: to take another quick break. Okay, we're back. You're listening
Speaker 1: to Tech Stuff live at the iHeart Podcast Studio powered
Speaker 1: by Bose at the House of Music at the iHeartRadio
Speaker 1: Music Festival. All right, Moving forward a little bit more.
Speaker 1: Around September fifteenth, a different hacker group called Scattered Spider
Speaker 1: claimed responsibility for the MGM attack but not the Caesars attack.
Speaker 1: VX Underground referred to Scattered Spider as a subgroup. According
Speaker 1: to numerous sources, this group mostly consists of young hackers
Speaker 1: think like seventeen to twenty two who live in places
Speaker 1: like the United States and the United Kingdom. They appear
Speaker 1: to be native English speakers or extremely fluent English speakers,
Speaker 1: and they have a reputation for being very very good
Speaker 1: at social engineering. Scattered Spider is suspected of using tools
Speaker 1: like phishing websites in addition to social engineering, so they
Speaker 1: typically will direct someone to a login page that looks
Speaker 1: like it's a legit page, but in fact it allows
Speaker 1: the hackers to fish for credentials. As for multi factor authentication,
Speaker 1: calling an it helped us to reset MFA is an
Speaker 1: effective way to get around that. There's also SIM cards
Speaker 1: swapping that they've done, where they've convinced phone companies to
Speaker 1: swap a digital SIM card to a different device. They
Speaker 1: pose as a customer and then they talk the telecommunications
Speaker 1: wrap on the other end of the line to change
Speaker 1: a SIM card setting, which then gives them the ability
Speaker 1: to access things like multi factor authentication when the code
Speaker 1: gets sent Instead of going to the valid person, it
Speaker 1: goes to their phone number, which has now been switched
Speaker 1: to a different phones simcard very nefarious. Now, you might
Speaker 1: wonder about resetting multi factor authentication why anyone would even
Speaker 1: agree to do that in the first place. I mean,
Speaker 1: the whole point of multi factor authentication is to have
Speaker 1: multiple ways of authenticating a person's identity. But with just
Speaker 1: a little thinking it becomes clear. So let's say that
Speaker 1: you call into an IT help desk and you claim
Speaker 1: that you can no longer access your work account because
Speaker 1: you recently changed phone numbers. So that means that when
Speaker 1: you try to log in, you get a text message
Speaker 1: sent to your old phone number and you can't receive it.
Speaker 1: So you are talking with them saying, I need you
Speaker 1: to switch this because I still have my username, I
Speaker 1: still have my password, but I can't get access because
Speaker 1: I no longer have that phone and I need to
Speaker 1: be able to access my work, So you ask for
Speaker 1: a reset. Maybe you have a lot of information about
Speaker 1: the person that you're posing as so as you can
Speaker 1: convince the person on the other end of the phone
Speaker 1: call that you're legitimate. Again, that's what you do with
Speaker 1: the investigation. When you're using LinkedIn to learn a little
Speaker 1: bit about your kind of patsy if you will, Maybe
Speaker 1: you just sound really clueless and stressed and you just
Speaker 1: trigger the I person's desire to help you get out
Speaker 1: of the tight spot. Like I said, most of us
Speaker 1: typically want to help someone when they are really struggling.
Speaker 1: They reset the MFA on the account, They put a
Speaker 1: new phone number in that phone that you happen to control,
Speaker 1: and now you don't have to worry about that multi
Speaker 1: factor authentication process anymore. So I want to be clear,
Speaker 1: Scattered Spider, these are not script kiddies, right. These are
Speaker 1: not people who just download some code and then they
Speaker 1: make use of it. They have an understanding of how
Speaker 1: computer and cloud systems work. They have an understanding how
Speaker 1: the underlying businesses work. They do their homework. By knowing
Speaker 1: how these businesses work, they know how to target and
Speaker 1: make their social engineering efforts have the best chance for success.
Speaker 1: So I want to be clear, like they are good
Speaker 1: at what they do. They're not just fast talkers. They
Speaker 1: know their stuff. So it's possible that they were involved
Speaker 1: in one or maybe even both of the attacks, though
Speaker 1: again they weren't claiming that. However, Alpha has also claimed
Speaker 1: responsibility for the MGM attack, and they argued that any
Speaker 1: reports stating it was teenagers were inaccurate and based on rumors.
Speaker 1: There was another rumor that Alpha was very quick to
Speaker 1: deny that was reported in at least some outlets that
Speaker 1: had to do with slot machines. So, according to this rumor,
Speaker 1: and I love this rumor, but according to this rumor,
Speaker 1: Scattered Spider originally wanted to essentially reprogram slot machines so
Speaker 1: that they just started to pay out cash, kind of
Speaker 1: like a scene that's in you know, The Ocean's Eleven movies,
Speaker 1: Except this would mean that the slot machines would sort
Speaker 1: of spit out tickets, kind of like receipts with winnings
Speaker 1: on them. The rumor goes that the hackers found this
Speaker 1: wasn't really possible. In fact, one of the rumors said
Speaker 1: that the person who was making this suggestion hadn't even
Speaker 1: seen The Ocean's Eleven movies, So they were just talking
Speaker 1: about something they had heard of and wanted to try.
Speaker 1: And when they found out that it wasn't going to
Speaker 1: be as easy as they thought, they moved on to
Speaker 1: just steal data from the computer systems. Now, Alpha categorically
Speaker 1: says this story is totally false, it's completely fiction, and
Speaker 1: that it somehow got you know, circulated among news outlets.
Speaker 1: What's the truth, dawn't know. Back to OCTO, So, David Bradbury,
Speaker 1: the CEO of OCTA, has said that social engineering attacks
Speaker 1: are at the root of five OCTA clients who have
Speaker 1: recently found themselves compromised by ransomware attacks, and that Caesar's
Speaker 1: Entertainment and MGM Resorts are two of those five, but
Speaker 1: he hasn't named the other three. He also referenced Scattered
Speaker 1: Spider and Alpha as business associates or affiliates, suggesting that
Speaker 1: at least some of the hacks of OCTA clients are
Speaker 1: the product of cooperation between these two groups. So this
Speaker 1: story is still unfolding as a record here in Las
Speaker 1: Vegas right now. Currently, MGM Resorts International says that all
Speaker 1: operations are back to normal, that's how everything's being reported,
Speaker 1: and that it's continuing to investigate the quote unquote cybersecurity issue,
Speaker 1: that the FBI is involved, and that they're taking this
Speaker 1: very seriously. There are concerns that these attacks will have
Speaker 1: a hefty impact on the value of both MGM and
Speaker 1: Caesar's Entertainment. It's certainly had an impact on MGM's ability
Speaker 1: to generate revenue while all this was going on. Loyalty
Speaker 1: program members should probably sign up for credit monitoring because
Speaker 1: a lot of their personal information is stored in those systems,
Speaker 1: and it sounds like hackers got access to all of
Speaker 1: that stuff. So credit monitoring is not a bad idea
Speaker 1: if you want to make sure that your information hasn't
Speaker 1: just started been trading around on the dark web and
Speaker 1: people start like taking out credit cards under your name,
Speaker 1: that kind of thing. So probably a good idea at
Speaker 1: least to keep an eye on your credit. It's easier
Speaker 1: if you do sign up for credit monitoring, but you
Speaker 1: can do it on your own if you're really diligent
Speaker 1: about it. But yeah, scary stuff. I'll also say this,
Speaker 1: So I've been staying at the Aria, like I said,
Speaker 1: which is an MGM Resorts property, and have encountered some
Speaker 1: technical glitches which may or may not have any connection
Speaker 1: to the hackers. According to the people I spoke with,
Speaker 1: they recently used a new computer system and brought it
Speaker 1: online and that the issues they're running into may very
Speaker 1: well just be working the bugs out of a new
Speaker 1: system and have nothing to do with the hackers at all.
Speaker 1: But what I will say is that they have connected
Speaker 1: essentially all room controls through an Internet interface, and you
Speaker 1: can use a tablet or I assume an app to
Speaker 1: be able to access those things. But when I got
Speaker 1: to my room, what I found was that I could
Speaker 1: not close the curtain on the window. I could not
Speaker 1: turn off the lights in my room, none of the
Speaker 1: buttons worked. The tablet that was part of the room
Speaker 1: would not connect. I did not want to use the
Speaker 1: app for reasons that I think should be pretty obvious.
Speaker 1: And so again I don't want to say that that's
Speaker 1: part of the hacker attack, but it was unfortunate to
Speaker 1: have that's of experience right on the tail end of
Speaker 1: this hacker issue. It's it's concerning, and it's one of
Speaker 1: those things that will continuously come up. Another thing I
Speaker 1: will say this again not directly connected to the hacker attack,
Speaker 1: but just something that I observed. The Wi Fi in
Speaker 1: that hotel is an open Wi Fi connection, like you
Speaker 1: can just connect to it and you you know, you
Speaker 1: do a little sign on on a web landing page,
Speaker 1: but then you're connected. There's no password security on the
Speaker 1: Wi Fi network at all, And I gotta tell you,
Speaker 1: if you are a major hotel that has just been
Speaker 1: the target of a massive ransomware attack, maybe you should
Speaker 1: start offering a password protected Wi Fi network. I'll tell
Speaker 1: you this, I won't connect to it unless I'm using
Speaker 1: a VPN. I just refuse to do it. They may
Speaker 1: be perfectly safe, but it might not be with an
Speaker 1: open network like that. And a recent attack in not
Speaker 1: even a week old at this point, there were still
Speaker 1: issues unfolding this past week. Don't do it, so yeah,
Speaker 1: interesting observations. As for moving forward, I think these attacks
Speaker 1: are the most recent reminders that organizations have to make
Speaker 1: some really big decisions about cybersecurity now. Part of that
Speaker 1: really involves an ongoing educational approach that reinforces how to
Speaker 1: spot social engineering and phishing schemes and why it's important
Speaker 1: not to share credentials or to act on suspicious emails
Speaker 1: or phone calls. This is particularly true for people who
Speaker 1: are working in positions that have administrative level access to
Speaker 1: certain computer systems within an organization. If we count the
Speaker 1: ransom that Caesar is allegedly paid to have sensitive customer
Speaker 1: data deleted as a heist. Like I said, it would
Speaker 1: be the second biggest casino heist in history from what
Speaker 1: I can tell, at least from a monetary standpoint. If
Speaker 1: you're wondering what is the number one well that goes
Speaker 1: to a kiwi? A New Zealander named James Manning, who
Speaker 1: would the help of a casino services manager, managed to
Speaker 1: cheat his way to thirty three million dollars by cheating
Speaker 1: at blackjack. So supposedly he and this casino employee were
Speaker 1: able to breach the security camera system and they used
Speaker 1: things like hand signals and stuff in order to cheat
Speaker 1: on eight successive hands of blackjack that ultimately resulted in
Speaker 1: thirty three million dollars of winnings. Manning was confronted and
Speaker 1: then by casino security, and then he was banned from
Speaker 1: the Crown Casino in Melbourne, Australia after they picked up
Speaker 1: on the scam, and fortunately before the casino had actually
Speaker 1: credited him most of his winnings so he didn't walk
Speaker 1: away with thirty three million dollars. The casino chose to
Speaker 1: keep this matter quiet rather than suffer embarrassment by admitting
Speaker 1: that they got taken for thirty million. This was made
Speaker 1: a little more complicated because Manning was supposed to participate
Speaker 1: in a PR stunt later in that week. He was
Speaker 1: supposed to order an outrageously expensive cocktail called the Winston.
Speaker 1: The Winston was priced at twelve thousand, five hundred dollars
Speaker 1: for a single cocktail. The casino had even promoted that
Speaker 1: this was going to happen, so this was going to
Speaker 1: be like an event type of thing, and that it
Speaker 1: would establish a Guinness World record for the most expensive
Speaker 1: cocktail ever purchased. But with Manning's scam uncovered and then
Speaker 1: him banned from the casino, they had to scramble to
Speaker 1: come up with an alternative customer, and then they had
Speaker 1: to arrange to pay the guy back. So really it
Speaker 1: wasn't a purchase at all. Like money changed hands, but
Speaker 1: it changed hands back, so there was no real purchase here.
Speaker 1: By the way, that story also has its own share
Speaker 1: of drama and scandal that goes beyond what I just said.
Speaker 1: But I think we've had enough for one episode if
Speaker 1: you ask me. So that means that we're reaching the
Speaker 1: point where it's time for me to sign off from
Speaker 1: the iHeart Podcast studio powered by Bows. Here at the
Speaker 1: iHeartRadio Music Festival in Las Vegas, Nevada, and maybe in
Speaker 1: light of these recent hacker attacks, we should actually change
Speaker 1: that saying to say the house almost always wins. I
Speaker 1: hope you are all well, and I'll talk to you
Speaker 1: again really soon. Tech Stuff is an iHeartRadio production. For
Speaker 1: more podcasts from iHeartRadio, visit the iHeartRadio app, Apple Podcasts,
Speaker 1: or wherever you listen to your favorite shows.