Speaker 1: Welcome to tech Stuff, a production from iHeartRadio. Hey there,
Speaker 1: and welcome to tech Stuff. I'm your host, Jonathan Strickland.
Speaker 1: I'm an executive producer with iHeart Podcasts and how the
Speaker 1: tech are you? So recently I talked about how the
Speaker 1: US Department of Justice has filed a civil antitrust lawsuit
Speaker 1: against the company Live Nation Entertainment, which, among many other things,
Speaker 1: operates the service Ticketmaster, a service that I would say
Speaker 1: has fostered a lot of very strong opinions among concertgoers,
Speaker 1: including yours. Truly, I have very strong feelings about Ticketmaster.
Speaker 1: But last Friday night, which was the night of May
Speaker 1: thirty first, two thy twenty four for those of y'all
Speaker 1: listening from the future, Ticketmaster was in the news for
Speaker 1: a reason because the company had been the target of
Speaker 1: hackers who allegedly stole data belonging to around five hundred
Speaker 1: sixty million ticket Master customers. Now, that data reportedly includes
Speaker 1: personal information like names, addresses, and phone numbers, as well
Speaker 1: as purchase history. So you know, that means the hackers
Speaker 1: can check and see if a you know, very public
Speaker 1: punk rocker type has secretly been sneaking off to watch
Speaker 1: Taylor Swift concerts or something, and also some partial credit
Speaker 1: card information like the last four digits on credit cards.
Speaker 1: Ticketmaster slash Live Nation initially kept quiet about this revelation,
Speaker 1: but then late on Friday confirmed that a data breach
Speaker 1: did in fact happen. This is a problem for lots
Speaker 1: of reasons. I mean, anytime there's a data breach, that's
Speaker 1: a problem, But when you're talking about a data breach
Speaker 1: affecting hundreds of millions of people, that just spells a
Speaker 1: massive headache moving forward. And we'll talk a lot about
Speaker 1: why that is in this episode, But really I thought
Speaker 1: I would chat about some of the largest data breaches
Speaker 1: in US history, which is a super happy topic, right,
Speaker 1: but I thought it was really important to consider how
Speaker 1: technology that's meant to make systems more efficient and effective
Speaker 1: can also sometimes provide an opportunity for malicious agents, for
Speaker 1: hackers to make off with potentially huge amounts of information.
Speaker 1: And as we all know, information is valuable. I mean,
Speaker 1: it is the currency of the Internet in many ways,
Speaker 1: and data breaches are becoming more and more common. The
Speaker 1: Identity Theft Resource Center reported that in twenty twenty one,
Speaker 1: there were one eight hundred and sixty two data breaches
Speaker 1: that it was able to identify. In twenty twenty three,
Speaker 1: that number was up to three thousand, two hundred five,
Speaker 1: almost double. However, I feel I should clarify that twenty
Speaker 1: five of those incidents were data exposures, and two of
Speaker 1: them were data leaks, and fifty six were incidents that
Speaker 1: weren't categorized at all. They're uncategorized, I don't know the
Speaker 1: nature of them, so that leaves us three twenty two
Speaker 1: cases of actual data breaches, and the differences between these
Speaker 1: different categories are sometimes subtle and a little gray. As
Speaker 1: for my source for what constitutes the largest data breaches
Speaker 1: in the United States, I decided settle on one source
Speaker 1: just for the list. Right, I went into lots of
Speaker 1: sources for the details of all these things, but I
Speaker 1: used a blog post on upguard dot com. It was
Speaker 1: written by Kyle Chen. Now, Kyle Chen lists twenty six
Speaker 1: cases of data breaches, and the Ticketmaster case isn't among them.
Speaker 1: It hasn't been updated since the Ticketmaster issue. Arguably, Ticketmasters
Speaker 1: should be in any list about large data breaches in
Speaker 1: the United States because this was a big one. I
Speaker 1: imagine when the dust settles, it could end up on
Speaker 1: that list where I can't say Chen's definition. The biggest
Speaker 1: isn't just in how many records were part of a
Speaker 1: data breach, Like that's not the only factor that constitutes
Speaker 1: whether or not it merits consideration. Also the nature of
Speaker 1: the information and the impact the breach had end up
Speaker 1: factoring how it falls on the list. And twenty six
Speaker 1: cases is way too many cases for a podcast episode
Speaker 1: or even you know, two of them. So I'm just
Speaker 1: gonna go with the top ten, and even that's gonna
Speaker 1: require me to break this into two episodes, and I'm
Speaker 1: gonna work backward to add to the drama. By the way,
Speaker 1: Kevin Chin and no point says that this is a
Speaker 1: ranked list, so you could argue, I'm just giving you
Speaker 1: ten random large data breach stories out of a list
Speaker 1: of twenty six, and that's a legitimate criticism. But a
Speaker 1: guy's got to start somewhere, right Anyway. I'm doing this
Speaker 1: as a list because I've watched a lot of Jenny
Speaker 1: Nicholson's older YouTube videos recently, and I absolutely love how
Speaker 1: she turns everything into quote an internet friendly numbered li list.
Speaker 1: In the quote, I think that's very funny. I mean,
Speaker 1: Red Letter Media did the same thing with the Planket
Speaker 1: reviews with all the different parts, although that was somewhat
Speaker 1: necessitated by the fact that in the early days when
Speaker 1: they were posting those super long reviews, YouTube videos were
Speaker 1: limited to ten minutes each, so they would upload like
Speaker 1: a nine part series to take down the Star Wars
Speaker 1: episode one critique or whatever. Anyway, I've decided to go
Speaker 1: backward in order to increase the drama. So we're gonna
Speaker 1: start with number ten, which is FriendFinder Networks. And this
Speaker 1: one's a doozy. So friend Fighter Networks deals with products
Speaker 1: and services that include some that are not suitable for
Speaker 1: a family friendly podcast. I will use some euphemisms, but
Speaker 1: they include stuff like adult entertainment, webcam sites, that kind
Speaker 1: of thing. That's part of what friend Fighter Networks operates.
Speaker 1: The adult magazine company Penthouse bought friend Fire in early
Speaker 1: twenty sixteen, and interestingly, the company operates several dating services,
Speaker 1: including one intended to help people find someone with whom
Speaker 1: to have casual sexual encounters, that being adult friend Finder.
Speaker 1: On one end of the spectrum, and on the other
Speaker 1: end of the spectrum, they have a dating service for
Speaker 1: devout Christians. So I guess it's a company that really
Speaker 1: does believe an equal opportunity to make money off of
Speaker 1: various audiences. Anyway, as a company with businesses that are
Speaker 1: in the adult entertainment sphere and social networks and also
Speaker 1: dating services, FriendFinder Networks has access to a lot of
Speaker 1: sensitive user information that includes info that customers absolutely would
Speaker 1: prefer remain private or at least under their own control.
Speaker 1: So it was a bit of a shock in late
Speaker 1: twenty sixteen when news broke that hackers stole data from
Speaker 1: the company that stretched back two decades, like there was
Speaker 1: information in there that was twenty years old, and it
Speaker 1: even included information belonging to people who had long since
Speaker 1: deleted their accounts with FriendFinder Networks, but their information remained
Speaker 1: on company servers despite the fact that they had deleted
Speaker 1: their accounts. That seems like a very bad data ownership policy.
Speaker 1: Right to retain information about people who had subsequently deleted
Speaker 1: their account with you, that's a real problem. So the
Speaker 1: method that these hackers used relied on LFI, which is
Speaker 1: local file intrusion or sometimes local file insertion. It kind
Speaker 1: of depends upon who you're talking to, but the name
Speaker 1: sort of explains how this works. The hacker injects essentially
Speaker 1: malicious directions into a system, and they do this usually
Speaker 1: by incorporating those directions into a file, so, for example,
Speaker 1: a multimedia file. This multimedia file might contain basic directory
Speaker 1: commands within the file itself, so essentially it tells the system,
Speaker 1: hey execute these commands in this order, and if the
Speaker 1: server isn't protected against such relatively simple attacks, if I'm
Speaker 1: being honest, then the code can prompt the web server
Speaker 1: to configure the file improperly and give backdoor access to
Speaker 1: a hacker, which is in fact what happened in this case.
Speaker 1: The hackers got access to information stored on the affected servers,
Speaker 1: and there were six databases in total that were affected
Speaker 1: by this, six massive databases, and the take was huge.
Speaker 1: So the hackers made off of information that related to
Speaker 1: more than four hundred and twelve million customer accounts. The
Speaker 1: information included email addresses, including some belonging to government and
Speaker 1: military users, transaction history, account passwords. Some of these passwords
Speaker 1: at least were encrypted, but they used a really primitive
Speaker 1: hash to do it, an outdated method that was no
Speaker 1: longer considered secure, so that was a big, prible problem.
Speaker 1: More than three hundred million of the accounts came from
Speaker 1: Adult friend Finder, and more than sixty million came from
Speaker 1: a webcam site. And I'm sure a lot of customers
Speaker 1: got really nervous about this. I mean, the taboo nature
Speaker 1: of these sites and services meant a lot of people
Speaker 1: were probably sweating over their past activities and hoping they
Speaker 1: wouldn't be exposed. Now, keep in mind that one year earlier,
Speaker 1: in the summer of twenty fifteen, hackers compromised around thirty
Speaker 1: two million accounts from the company Ashley Madison. Ashley Madison
Speaker 1: was built around the idea of a dating service that
Speaker 1: would let married people secretly find potential partners in order
Speaker 1: to have an affair. There was this sense that some
Speaker 1: sort of hacker anarchist was going to reveal salacious details
Speaker 1: about folks in the wake of these attacks, or that
Speaker 1: at the very least, they would make these details available
Speaker 1: so that anyone who really wanted to sift through all
Speaker 1: the stolen information could dig up whether or not you
Speaker 1: know the neighbor down the street was secretly trying to
Speaker 1: sneak around behind their partners back or whatever, or the
Speaker 1: sexual orientation of people you knew. You could find that
Speaker 1: kind of information out based upon the stuff that had
Speaker 1: been stolen in these sorts of attacks, and depending on
Speaker 1: where you are, that kind of thing can have deadly consequences.
Speaker 1: So the information involved with this data breach was extremely sensitive,
Speaker 1: particularly from a social perspective. I mean, you're not likely
Speaker 1: to come forward and say I was the victim of
Speaker 1: identity theft if it also means you have to cop
Speaker 1: up to something that is socially taboo, like, there's just
Speaker 1: a lot of pressure on you to not come forward.
Speaker 1: That the idea of coming forward is actually worse than
Speaker 1: someone taking advantage of the information they have on you. So,
Speaker 1: while this hack didn't include stuff like credit card information,
Speaker 1: just the fact that names were appearing on these customer
Speaker 1: lists was a huge problem. It could give other hackers
Speaker 1: the opportunity to engage in blackmail or spearfishing and target
Speaker 1: people based on what was revealed in their data with friends.
Speaker 1: And that's a real issue that's going to come up
Speaker 1: again and again in these episodes. Is that idea of yeah,
Speaker 1: the data might not include, say, your credit card, but
Speaker 1: that's not really the concern here. The concern is how
Speaker 1: can someone use your information to victimize you in various ways?
Speaker 1: And one of those is spearfishing. So what did FriendFinder
Speaker 1: Network do in response to this? Sadly, the answer was
Speaker 1: not much. While security researchers alerted the public that they
Speaker 1: had detected a vulnerability in the FriendFinder Network system, the
Speaker 1: company did not acknowledge the data breach for a full
Speaker 1: week and only then began to send out notifications to customers.
Speaker 1: And the company didn't have any really helpful advice for
Speaker 1: those customers either, saying that people should change their passwords. Now,
Speaker 1: according to idstrong dot com, the company had lacks password
Speaker 1: requirements in the first place. Passwords weren't even case sensitive,
Speaker 1: for example, and they didn't update this, so their password
Speaker 1: protocols were still not really at an industry standard. And
Speaker 1: here's a real kicker. The company had also been breached
Speaker 1: in twenty fifteen. Now, the twenty fifteen breach, because remember
Speaker 1: the one we're talking about is really twenty sixteen, But
Speaker 1: the twenty fifteen breach was much smaller in scope. Only
Speaker 1: three and a half million users were affected. That's still
Speaker 1: a lot of people, but it's nowhere close to four
Speaker 1: hundred and twelve million. But the types of information that
Speaker 1: were stolen included things like partial payment information, and at
Speaker 1: least in some of the research I was doing, Like
Speaker 1: some sources said that the types of info that were
Speaker 1: stolen in the twenty sixteen attack did not include things
Speaker 1: like sexual orientation or preferences or that kind of thing.
Speaker 1: Other sources said, no, that was part of the twenty
Speaker 1: sixteen hack as well. So I don't know what the
Speaker 1: full extent was, but a lot of the analysis I've
Speaker 1: looked at about this particular breach points out that the
Speaker 1: company failed to act properly in the wake of the
Speaker 1: twenty fifteen breach, which meant it was essentially set up
Speaker 1: for the much larger attack in twenty sixteen. So that's
Speaker 1: a pretty damning allegation there, right, that a company had
Speaker 1: already been the victim of a massive data breach and
Speaker 1: then failed to take the adequate response in order to
Speaker 1: prevent an even larger data breach the following year. So again,
Speaker 1: just having the basics of your information leaked out would
Speaker 1: be a huge problem given the nature of this company,
Speaker 1: And despite the company's arguably lack luster response to the breach,
Speaker 1: customers kept on being customers. I guess they never had
Speaker 1: to learn a lesson because there really weren't massive consequences.
Speaker 1: And again maybe this is partly because of the nature
Speaker 1: of the services themselves, right, Like for a customer to
Speaker 1: put up a big fuss, they would also have to
Speaker 1: reveal themselves to be a customer in the first place,
Speaker 1: and then the social taboo kicks in again. But unlike
Speaker 1: some other companies that were going to talk about in
Speaker 1: this episode, the friend Finder Networks didn't see serious setbacks
Speaker 1: as a result of this attack. Okay, and we just
Speaker 1: got through one, and we've got lots more to go,
Speaker 1: So let's take a quick break to thank our sponsors
Speaker 1: and we'll be right back. Okay, we're moving on to
Speaker 1: number nine on our list. And this one is a
Speaker 1: real blast from the past. It's MySpace, and this attack
Speaker 1: technically happened in twenty thirteen, but it wasn't discovered and
Speaker 1: reported until twenty sixteen, and even twenty thirteen was late
Speaker 1: in the game for MySpace now. MySpace was once the
Speaker 1: king of social networking platforms, but it had been losing
Speaker 1: ground to Facebook since two thousand and nine. News Corps,
Speaker 1: which had purchased MySpace for a whopping five hundred and
Speaker 1: eighty million dollars in two thousand and five, ended up
Speaker 1: selling the company off to Justin Timberlake and a company
Speaker 1: called Specific Media in twenty eleven for thirty five million dollars.
Speaker 1: So again they purchased it for five hundred eighty million
Speaker 1: and then six years later sold it for thirty five million.
Speaker 1: Not a good deal. By twenty sixteen, Time Incorporated purchased
Speaker 1: Specific Media, and then Meredith Corporation acquired Time Incorporated. Because
Speaker 1: there's always a bigger fish, that story gets more and
Speaker 1: more complicated too, but we're going to leave that here.
Speaker 1: My point is that MySpace had already experienced a dramatic
Speaker 1: decline in relevance by twenty thirteen when the attack actually happened,
Speaker 1: but still the site had millions of user records and
Speaker 1: a hacker was able to get access to them, like
Speaker 1: three hundred and sixty million records. The data lifted during
Speaker 1: the breach included email addresses, user names, and passwords, which
Speaker 1: were encrypted using again an outdated method, and therefore security
Speaker 1: experts considered it insecure, and that was a real issue
Speaker 1: right now. Looking back on this hack today, there's a
Speaker 1: disturbing lack of information as to how it actually happened.
Speaker 1: It went undiscovered for nearly three years and only really
Speaker 1: came to light when folks realized that data from the
Speaker 1: breach was popping up for sale on black market sites
Speaker 1: on the Dark Web. As for who was responsible and
Speaker 1: the vulnerabilities they exploited, that remains something of a mystery.
Speaker 1: MySpace responded to this news by invalidating all the passwords
Speaker 1: of all the affected accounts, which would require users to
Speaker 1: set up new passwords and also encourage people who weren't
Speaker 1: directly impacted to go ahead and update their passwords as well.
Speaker 1: In an overabundance of caution, like the friend Finder breach,
Speaker 1: there wasn't much a user could do to protect themselves
Speaker 1: from the hackers. In fact, I would argue there was
Speaker 1: nothing a user could do. It wouldn't matter if they
Speaker 1: had used a strong or a weak password, because the
Speaker 1: real issue was MySpace was using a very weak hashing
Speaker 1: method to encrypt passwords in the first place. So even
Speaker 1: if you picked a very strong password, if it's being
Speaker 1: stored in an encryption that can easily be broken, then
Speaker 1: they can just get to your password anyway, doesn't matter
Speaker 1: how strong it was. You did your part. MySpace failed,
Speaker 1: is what I'm saying. Now. All that being said, I
Speaker 1: do still urge everyone to use unique, strong passwords for
Speaker 1: all their sites and services. Unique is really important because
Speaker 1: if you're using the same password everywhere, it just takes
Speaker 1: one data breach to be able to compromise all of
Speaker 1: your stuff. If they have your email and whatever password
Speaker 1: you use for that, you know, one like obscure website,
Speaker 1: and it happens to be the same password you use
Speaker 1: for say your bank, that's bad news for you. Use
Speaker 1: unique passwords, get a password vault of some sort a
Speaker 1: good one, research this and find one that really works
Speaker 1: for you, and make unique, strong passwords for each of
Speaker 1: the sites you go to so that you can avoid
Speaker 1: this issue. Because data breaches, sadly are not uncommon, they're
Speaker 1: getting more common every year, and this will help protect
Speaker 1: other elements of your online presence from hackers. Sadly, there's
Speaker 1: not very much you can do to protect the systems themselves.
Speaker 1: I mean, that's in the control of whatever platform you're using.
Speaker 1: And I'm not telling you not to use platforms goodness, nos,
Speaker 1: I use tons of them. Just to be as careful
Speaker 1: as you can be to mitigate any issues that might
Speaker 1: pop up due to data breaches. Also, you know, enable
Speaker 1: multi factor authentication if that's available, if it's on there,
Speaker 1: use it again. Nothing is absolutely fool proof. I'm not
Speaker 1: here to tell you that if you have multi factor
Speaker 1: authentication you'll never get hacked. That's not necessarily true. But
Speaker 1: the more precautions you take the better. The harder you
Speaker 1: make yourself to be a target, the more effort it
Speaker 1: takes to actually crack your security, and the less likely
Speaker 1: someone's going to actually pursue that. It's not impossible, but like,
Speaker 1: why struggle if you can go for all the low
Speaker 1: hanging fruit, don't be low hanging fruit still. Now, if
Speaker 1: hackers are breaching a company's systems, we're really left to
Speaker 1: the competence of that company when it comes to personal security.
Speaker 1: So our first two entries on this list are both
Speaker 1: web based companies. Right, we had MySpace and we had
Speaker 1: the FriendFinder Networks. But up next is a company known
Speaker 1: for its brick and mortar operations, and I'm talking about
Speaker 1: home Depot, which experienced a massive data breach in April
Speaker 1: twenty fourteen. This was an attack that compromised more than
Speaker 1: fifty million customers data, including their credit or debit card information,
Speaker 1: lifting that information right from inside the stores themselves. And
Speaker 1: this attack went unnoticed until the hackers started putting the
Speaker 1: credit card info up on sale on the dark web,
Speaker 1: at which point home Depot was made aware that they
Speaker 1: had been breached. So let's walk through how this attack happened. So,
Speaker 1: according to the US Office of the Director of National Intelligence,
Speaker 1: the hackers first secured Quote credentials, user names, and passwords
Speaker 1: from a third party vendor end Quote, and that gave
Speaker 1: them the foothold into home depots computer network. So first
Speaker 1: they identified a company that worked with home Depot. They
Speaker 1: were able to secure a username and password from this company.
Speaker 1: They use that to infiltrate home Depot's computer network. On
Speaker 1: top of that, they then were able to essentially take
Speaker 1: advantage of a zero day vulnerability that was within Microsoft Windows.
Speaker 1: So a zero day vulnerability is a fancy way of
Speaker 1: saying that the entity responsible for making whatever the thing
Speaker 1: is So in this case, Microsoft Windows is unaware that
Speaker 1: the vulnerability even exists. And because they're unaware that there
Speaker 1: is a vulnerability, there's no means to prevent or mitigate
Speaker 1: attacks that leverage or exploit this vulnerability. Zero day vulnerabilities
Speaker 1: are incredibly valuable in the hacker community because there's no
Speaker 1: real defense against them, and if you're very careful, you
Speaker 1: have the chance to continue to exploit these kinds of
Speaker 1: vulnerabilities for a while before anyone notices. So it's called
Speaker 1: zero day because that's how much time the you know,
Speaker 1: the entity Microsoft in this case has before malicious agents
Speaker 1: are able to exploit that vulnerability. So the hackers exploit
Speaker 1: Microsoft Windows and they're exploring home Depot systems and they're
Speaker 1: able to identify thousands, like seven five hundred points of
Speaker 1: sale systems in self checkout lanes at physical home Depot stores.
Speaker 1: So again, this was not targeting the online point of
Speaker 1: sale operations for home Depot. You know, the website commerce
Speaker 1: part of Home Depot was not part of this attack,
Speaker 1: And I just think that's good to point out because
Speaker 1: I don't think it's as common now, But I remember
Speaker 1: when online commerce first became a thing, people were scared
Speaker 1: to buy stuff off the internet. They were reluctant to
Speaker 1: use their credit card to purchase something online because they
Speaker 1: were worried about security, which is understandable, but it turns
Speaker 1: out that going to a brick and mortar store is
Speaker 1: not necessarily more secure because those systems are also connected
Speaker 1: to networks that ultimately get connected to the Internet, and
Speaker 1: so if you're able to compromise those networks, then you
Speaker 1: can still tap into that kind of system. So the
Speaker 1: hackers deployed custom built malware for these points of sale systems,
Speaker 1: and they use this malware to record the credit and
Speaker 1: debit card information of home Depot customers. They even made
Speaker 1: sure that they transmitted that data during home Depot's business
Speaker 1: hours so that the company's security team wouldn't notice like
Speaker 1: a transmission at an odd hour, like if it was
Speaker 1: two in the morning, then the security team was saying, like, hey,
Speaker 1: why is our system sending info out at this hour?
Speaker 1: That could be a tip off. So they made sure
Speaker 1: that all those transmissions happened during normal business operating hours
Speaker 1: and that would kind of mask these On top of
Speaker 1: all the legitimate transmissions, cybersecurity experts criticized home Depot so
Speaker 1: for having insufficient security measures in place. The company estimated
Speaker 1: that spent nearly one hundred and eighty million dollars in
Speaker 1: the wake of this attack to pay off all the
Speaker 1: various costs. On top of that, there was a class
Speaker 1: action lawsuit from across forty six states that ended with
Speaker 1: Home Depots settling out of court for seventeen point five
Speaker 1: million dollars. Now, Home Depot didn't admit, you know, responsibility
Speaker 1: for this, but it did promise to invest in security measures,
Speaker 1: including hiring a chief of information of security. Now, as
Speaker 1: for that seventeen point five million dollar settlement, I just
Speaker 1: want to put that into context so that we can
Speaker 1: kind of appreciate what that means or doesn't mean. Keep
Speaker 1: in mind, around fifty six million customers were affected by
Speaker 1: this data breach, So if you were to include all
Speaker 1: of them in the class action lawsuit, which obviously not
Speaker 1: realistic but you know, we're just doing this as a
Speaker 1: thought experiment, then that would mean each person would receive
Speaker 1: the princely sum of thirty one cents. That's only if
Speaker 1: the various lawyers of all the different states did this case.
Speaker 1: Gradis for free. So what I'm saying is that while
Speaker 1: Home Depot may have had to spend a lot of
Speaker 1: money to deal with the aftermath of this breach, the
Speaker 1: settlement I think was a case of getting off lightly
Speaker 1: considering the nature of that breach. But I also have
Speaker 1: to remind myself that ultimately the real criminal here are
Speaker 1: the hackers who pulled off the attack and the folks
Speaker 1: on the dark web who purchased the credit and debit
Speaker 1: card information. Those are the real criminals. While I can
Speaker 1: be disappointed in home Depot's lack of security or lackluster security,
Speaker 1: in this case, I don't want to blame the victim
Speaker 1: like I do think that there is a responsibility there,
Speaker 1: But the real villains are the people who did the stealing.
Speaker 1: It's just it's easy to blame big companies as well
Speaker 1: when they failed to be good stewards of customer information.
Speaker 1: So next up on Chin's list, oh massive data breaches
Speaker 1: here in the United States, is another one that happened
Speaker 1: in twenty fourteen. This attack targeted the bank JP Morgan
Speaker 1: Chase and it impacted around eighty three million bank customers.
Speaker 1: Seventy six million of those were households and the other
Speaker 1: seven million were small businesses. This attack also reportedly leveraged
Speaker 1: a zero day vulnerability, but in this case, it was
Speaker 1: a vulnerability in JP Morgan Chase's web applications, so this
Speaker 1: gave the hackers the foothold to access kind of a
Speaker 1: directory level of server information for JP Morgan Chase. This
Speaker 1: then let the hackers identify databases containing customer information Now,
Speaker 1: one source I looked at suggested the information included financial
Speaker 1: data like credit card information, but that was just in
Speaker 1: one source, and every other source, including The New York Times,
Speaker 1: says that was not the case. So I feel pretty
Speaker 1: confident that that one source was an outlier and had
Speaker 1: some misinformation in it. I mean, that's a flag for
Speaker 1: all of y'all out there. So it's always good to
Speaker 1: double check things and check multiple sources. Sometimes it can
Speaker 1: be really difficult to determine what reality is based on
Speaker 1: the reporting of various sources. Sometimes even reputable sources get
Speaker 1: things wrong. So you know, thinking critically involves a lot
Speaker 1: of checking and double checking, and sometimes it involves making
Speaker 1: an educated guess as to what is most likely to
Speaker 1: be real. So in this case, I think it's most
Speaker 1: likely that the information that was stolen was personal information
Speaker 1: but not financial information. So the attackers got access to
Speaker 1: things like names, email addresses, that kind of thing, which
Speaker 1: again doesn't sound like it's as critical as credit card information,
Speaker 1: but it's still really useful data if, for example, you
Speaker 1: want to create a spear phishing campaign and trick people
Speaker 1: into making mistakes, like if you know they are customers
Speaker 1: of this particular bank, and you know what their email
Speaker 1: address is, and you know their actual name, you can
Speaker 1: craft and attack targeting that person that appears to be
Speaker 1: coming from the legitimate business and potentially take advantage of
Speaker 1: them that way. So the hackers then developed attacks for
Speaker 1: these servers they had identified, and they ultimately infiltrated around
Speaker 1: ninety servers within the business. The attackers had started back
Speaker 1: in June twenty fourteen. JP Morgan Chase would detect the
Speaker 1: intrusion a month later in July. The public, however, would
Speaker 1: not find out about it until September, when the company
Speaker 1: disclosed the attack in a securities filing and various media
Speaker 1: outlets reported on it. Now, considering that other major breaches
Speaker 1: like the aforementioned home depot attack, there was another one
Speaker 1: that hit target, these attacks were fresh in the minds
Speaker 1: of consumers because they were national news here in the
Speaker 1: United States. The JP Morgan Chase attack was a huge
Speaker 1: blow because it revealed that even massive financial institutions, which
Speaker 1: had good reputations for being really secure, could also fall
Speaker 1: victim to hacker intrusions, which became a brand news source
Speaker 1: for anxiety for American consumers and as for the attackers
Speaker 1: in this case, there were four identified arguably five. The
Speaker 1: fifth one, however, was kind of after the effect, but
Speaker 1: the main four included a Russian citizen named Andrew Turin.
Speaker 1: There was an American named Joshua Samuel Arn aka Mike Shields.
Speaker 1: That's the alias he would use and some of his
Speaker 1: nefarious activities according to authorities. And then there were two
Speaker 1: Israeli citizens. There was Gary Shalan aka Gary Shallis Lashville.
Speaker 1: I know I mangled that name aka Gabriel aka Gabby
Speaker 1: aka Philip Moussey aka Christopher Ingeham. Lots of aliases for
Speaker 1: Gary Shallon. And then finally there was Ziv Ornstein aka
Speaker 1: Aviv Stein aka John Avery. So for four people, that's
Speaker 1: a lot of different names, right. Well, these four hackers
Speaker 1: were linked to numerous crimes, not just the JP Morgan
Speaker 1: chase instance. There were other ones as well, and they
Speaker 1: were also operators I believe of online casino or something
Speaker 1: along those lines. Anyway, at least one of them, that
Speaker 1: being Gary Shallon, was released early. He secured an early
Speaker 1: release after agreeing to a plea deal that had him
Speaker 1: pay a whopping four hundred three million dollar fine. Now,
Speaker 1: if you can afford to pay a four hundred three
Speaker 1: million dollar fine to get out of the pokey. I mean,
Speaker 1: I guess crime really does pay. Other folks connected to
Speaker 1: the scheme were not so fortunate, so for example, Andrew
Speaker 1: Tieran received a twelve year sentence at the end of
Speaker 1: his trial. So I guess it's you know who you know,
Speaker 1: and who you know needs to be a whole lot
Speaker 1: of Benjamin Franklin's JP Morgan Chase pledged to beef up
Speaker 1: the company's security and would double the investment within five
Speaker 1: years from two hundred and fifty million a year to
Speaker 1: five hundred million a year. So that's good. Okay, got
Speaker 1: a couple more I want to talk about before we
Speaker 1: wrap up Part one. I guess of our top ten
Speaker 1: largest data breaches in US history, But first let's take
Speaker 1: another quick break to thank our sponsors. We are up
Speaker 1: to number six on our list of biggest data breaches
Speaker 1: in US history. And that would be LinkedIn. Uh, LinkedIn,
Speaker 1: that social network site that I almost never log into.
Speaker 1: If I were a savvy mover and shaker, I would
Speaker 1: make way better use of LinkedIn, But I'm not, and
Speaker 1: so I post to my account once every blue moon,
Speaker 1: and I keep thinking, Man, I need to make better
Speaker 1: use of this resource and really network with people. That
Speaker 1: could be so helpful. But I've got only so much
Speaker 1: emotional energy for things like social networks. And I still
Speaker 1: have a LinkedIn account. I just don't use it very much. However,
Speaker 1: because I have a LinkedIn account, this next story affects
Speaker 1: me whether I pop on there regularly or not. This
Speaker 1: data breach is quite a bit different from the ones
Speaker 1: we've talked about so far because this one did not
Speaker 1: involve a HA gaining access to LinkedIn's internal systems. There
Speaker 1: was no security intrusion in this case. Instead, the hacker
Speaker 1: someone at least what's believed is that was a hacker
Speaker 1: using the handle Tomliner, but Tomliner could be a middleman
Speaker 1: like he might not he or she or they might
Speaker 1: not have been the person responsible for the actual hack,
Speaker 1: but they did get access to at least some of
Speaker 1: the data. Anyway, The quote unquote hacker simply used tools
Speaker 1: to scrape data off public profiles on LinkedIn. A ton
Speaker 1: of public profiles, like more than ninety percent of the
Speaker 1: public profiles on LinkedIn. That would be around seven hundred
Speaker 1: million profiles. And here's the crazy thing. Earlier that same year,
Speaker 1: the same person claimed responsibility for leaking five hundred million
Speaker 1: LinkedIn records, So this was like the second time in
Speaker 1: the same year and going from five hundred million to
Speaker 1: seven hundred million yaalza. Now, essentially this methodology is the
Speaker 1: same as if you were to go manually from LinkedIn
Speaker 1: profile to profile and you just jotted down all the
Speaker 1: relevant information that you were looking for. You know, stuff
Speaker 1: like what's a person's username, what's their full name, what's
Speaker 1: their phone number, their email address, you know what other
Speaker 1: social networking sites do they use? Anything that would appear
Speaker 1: on the person's profile. You would just jot it down.
Speaker 1: That would take you an eternity to do seven hundred million,
Speaker 1: So you create a tool that will just do this automatically.
Speaker 1: So the hacker had used LinkedIn's API that stands for
Speaker 1: Application Programmer Interface and they designed these data scraping tools
Speaker 1: to harvest user data. This was against LinkedIn's policies, but
Speaker 1: there really weren't any measures in place to actually prevent
Speaker 1: it from happening. So yeah, LinkedIn says, hey, don't do this,
Speaker 1: but they didn't have a way to stop you from
Speaker 1: doing it twice in the same year. As it turns out,
Speaker 1: now this attack did not compromise stuff like passwords or
Speaker 1: financial information, but it did include things like those connected
Speaker 1: social applications. So if an affected user had linked their
Speaker 1: Facebook account or whatever to their LinkedIn profile, that meant
Speaker 1: the attackers would have that information. And again this can
Speaker 1: be incredibly helpful if you want to design a phishing attack.
Speaker 1: You know, your basic blunt phishing attack might start from
Speaker 1: a place where little to nothing is known about your target.
Speaker 1: But the more attackers learn about you, the better they
Speaker 1: can craft an effective trap. And considering that there were
Speaker 1: a lot of executives using LinkedIn to network with each other,
Speaker 1: there's some really high value targets mixed in with everybody else.
Speaker 1: Like even if it's not an executive, it might be
Speaker 1: someone who's an associate of an executive, like an assistant
Speaker 1: or a coworker or something like that, a direct report.
Speaker 1: And if you're able to know who that person's direct
Speaker 1: report is or who they're reporting to, I guess I
Speaker 1: should say, then you can craft an attack that might
Speaker 1: be very convincing. You know, a classic one is your
Speaker 1: boss apparently texting you out of nowhere saying hey, I
Speaker 1: need access to five thousand dollars in petty cash. Can
Speaker 1: you wire it to me, and then they give you
Speaker 1: a link and it turns out it's just someone who's
Speaker 1: made the connection. They know who your boss is, and
Speaker 1: they're using that to pressure you into doing something you
Speaker 1: really shouldn't do. That's a very simple example, but it
Speaker 1: happens all the time. So this LinkedIn attack is a
Speaker 1: pretty tricky one. And we've seen similar data scraping techniques
Speaker 1: across the web, both of the purposes of harvesting user
Speaker 1: information and in recent years also using it to train
Speaker 1: up AI models. And typically platforms condemn these practices. They
Speaker 1: say it violates their policies. They want to protect their
Speaker 1: user information. Now, I would argue it's largely really because
Speaker 1: user data is valuable, and these platforms would very much
Speaker 1: like to prevent other entities from taking advantage of the
Speaker 1: same information that the platforms themselves are profiting off of.
Speaker 1: It's not so much to protect our privacy as it
Speaker 1: is to protect the platform's investment in gathering all the
Speaker 1: information in the first place. Like no, this is ours.
Speaker 1: This is ours to exploit and to profit from, not yours. Well.
Speaker 1: Number five on this list includes an old topic for
Speaker 1: tech stuff, which is the infamous Cambridge Analytica case with Facebook. Now,
Speaker 1: this one is a little bit complicated, but I'll see
Speaker 1: if I can summarize at least the tech side of it,
Speaker 1: although it does also include politics. Sorry I wish it didn't,
Speaker 1: but it's literally the very nature of this case. So
Speaker 1: the LinkedIn attack we just talked about is kind of
Speaker 1: similar to this because this attack, the Cambridge Analytica scandal,
Speaker 1: really centers on some loopholes in Facebook's API. So it
Speaker 1: all starts with a researcher named Alexander Cogan. And Cogan
Speaker 1: used Facebook's API to create a survey app, and it
Speaker 1: would pay Facebook users a small amount in return for
Speaker 1: them taking the survey. They did not know is that
Speaker 1: anyone who opted to take this survey was unknowingly giving
Speaker 1: Cogan the ability to view that person's friends profiles as
Speaker 1: if Cogan were in fact the person taking the survey.
Speaker 1: So let me give an example to make this a
Speaker 1: little more clear. Let's say I'm your friend on Facebook.
Speaker 1: Hi friend, and as your friend, I can see more
Speaker 1: of your profile than just some random schmo on the internet. Right,
Speaker 1: maybe you've set certain things on your profile to friends only,
Speaker 1: so as your friend I can see that. But some
Speaker 1: random person wouldn't be able to see that, right, But
Speaker 1: then I decide I'm going to go take the survey
Speaker 1: so I can make twenty bucks or whatever. And now
Speaker 1: Cogan can see your profile as if he were me
Speaker 1: because of this loophole and Facebook's API, and so now
Speaker 1: Cogan can view all of your friend's only information as
Speaker 1: if Cogan were your friend. So Facebook would actually close
Speaker 1: off this loophole before the Cambridge Analytica scandal became ann
Speaker 1: thing like face. This book made that change in the
Speaker 1: years following twenty thirteen when Cogan did this actual work.
Speaker 1: But by then the data already existed with Cogan. Cogan
Speaker 1: had access to all this information and he worked with
Speaker 1: Cambridge Analytica to share it. And so Cambridge Analytica had
Speaker 1: access to all this data they shouldn't have. They did
Speaker 1: not have the consent of the various people on Facebook
Speaker 1: to share the information, and they began to use this
Speaker 1: data in various ways during political campaigns, mostly conservative ones.
Speaker 1: Cambridge Analytica was a British company. It was a sort
Speaker 1: of a campaign strategy company, and their pitch was that
Speaker 1: they were using data driven techniques to make it far
Speaker 1: more effective to get messaging out to potential voters, and
Speaker 1: it was largely for conservative politicians. Facebook was reportedly aware
Speaker 1: of these issues, but didn't take any action until a
Speaker 1: former Cambridge Analytica employee essentially blew the whistle on the
Speaker 1: whole operation and it became a big public scandal. Now,
Speaker 1: ultimately it's debatable whether any of Cambridge Analytica's efforts were
Speaker 1: actually that effective, but the point is the company got
Speaker 1: access to somewhere between fifty and ninety million Facebook profiles
Speaker 1: that it should not have been able to access, and
Speaker 1: that's a big no no. Now, both Cambridge Analytica and
Speaker 1: Facebook would face serious repercussions for this scandal. Facebook would
Speaker 1: face hundreds of millions of dollars in various costs, from
Speaker 1: fines to a massive class action lawsuit settlement, and in
Speaker 1: a separate but related matter, the Federal Trade Commission or FTC,
Speaker 1: would find Facebook an astonishing five billion with a B
Speaker 1: dollars for failing to practice secure and ethical data privacy policies.
Speaker 1: Cambridge Analytica was just kind of related to this. It
Speaker 1: was it was a specific instance of a larger problem. Now,
Speaker 1: Cambridge Analytica would actually fold as a result of this scandal.
Speaker 1: The company ended up essentially liquidating, but you could argue
Speaker 1: Cambridge Analytica is not really gone because some other companies
Speaker 1: that were related to Cambridge Analytica would continue to exist,
Speaker 1: and they bought up the assets of Cambridge Analytica. So yeah,
Speaker 1: you could argue it's still out there lurking, it's just
Speaker 1: under different names. Now, the political nature of Cambridge Analytica
Speaker 1: and the use of psychological profiling techniques really make this
Speaker 1: particular data breach stand out. Now, you could argue there
Speaker 1: are lots of other breaches, including ones we've already talked about,
Speaker 1: that had a much broader scope and involved way more victims, right,
Speaker 1: But the involvement of psychological profiling, specifically for the purposes
Speaker 1: of affecting political campaigns makes this one seem particularly sinister.
Speaker 1: But as I said earlier, number five actually includes Cambridge Analytica.
Speaker 1: It's not exclusively Cambridge Analytica. That was just part of it.
Speaker 1: The whole of number five on Chen's list is Facebook itself,
Speaker 1: specifically with regard to an a April twenty twenty one
Speaker 1: incident anchoring the topic, and that is where we're going
Speaker 1: to pick up in our next episode. We'll pick up
Speaker 1: with number five in Facebook and talk about the twenty
Speaker 1: twenty one incident that merited entry upon this list of
Speaker 1: the largest data breaches in US history, and then we'll
Speaker 1: we'll you know, work our way through four, three, two
Speaker 1: and one, and I'll probably have more to say about
Speaker 1: ticket Master as well as we get to that. Anyway,
Speaker 1: just as a reminder again, there's very little we as
Speaker 1: individuals can do about these kinds of things. I mean,
Speaker 1: if we work in the security department of these big corporations,
Speaker 1: we can try and make sure that the practices we're
Speaker 1: using are best practices and that we're not being laxed
Speaker 1: at all on computer security. But for the rest of us,
Speaker 1: you know, we can just do what we can to
Speaker 1: protect ourselves and hope that the companies we do business
Speaker 1: with are doing the same. And if they're not, we
Speaker 1: can take whatever little measures we might have to mitigate
Speaker 1: the impact it's going to have on ourselves. But really
Speaker 1: a lot of this is out of our control. This
Speaker 1: is why security is an everybody problem, not just on
Speaker 1: the individual or on the company. It's everyone involved. And
Speaker 1: it only takes one week link to make a real
Speaker 1: entry point for malicious agents. So I know that's not
Speaker 1: very comforting, but it's good to know the reality of
Speaker 1: the situation that we all need to do our part
Speaker 1: as best we can. Even that's not going to protect
Speaker 1: us from everything, but it will at least limit the
Speaker 1: amount of effect these hackers can have, and hopefully we'll
Speaker 1: be able to act in such a way to minimize
Speaker 1: the impact. If you can do that enough, then you
Speaker 1: remove the incentive to attack in the first place. If
Speaker 1: it's so hard to get a success in your attack,
Speaker 1: you might figure there's a way to make money faster
Speaker 1: and easier, some other method. So yeah, let's make it
Speaker 1: real hard for the crooks to do crime. If we
Speaker 1: do that, maybe they'll look something else. So that's the hope.
Speaker 1: I hope that all of you out there are doing well,
Speaker 1: and I will talk to you again really soon. Tech
Speaker 1: Stuff is an iHeartRadio production. For more podcasts from iHeartRadio,
Speaker 1: visit the iHeartRadio app, Apple Podcasts, or wherever you listen
Speaker 1: to your favorite shows.