1
00:00:06,510 --> 00:00:07,410
- [Instructor] In this segment,

2
00:00:07,410 --> 00:00:09,330
we're going to explore how to find out

3
00:00:09,330 --> 00:00:11,970
if any of our user accounts
have been compromised

4
00:00:11,970 --> 00:00:15,000
and how to get information
on pwned websites.

5
00:00:15,000 --> 00:00:16,680
Now the word pwn is slang

6
00:00:16,680 --> 00:00:20,640
and it's a combination
of password and owned.

7
00:00:20,640 --> 00:00:22,470
Has your password been owned?

8
00:00:22,470 --> 00:00:24,090
Has it been compromised?

9
00:00:24,090 --> 00:00:26,820
Is it potentially in
the hands of a criminal?

10
00:00:26,820 --> 00:00:29,670
Well, to find out, we're
gonna go to the website.

11
00:00:29,670 --> 00:00:30,903
Have I been pwned now?

12
00:00:31,800 --> 00:00:33,900
The have I been pwned is gonna allow us

13
00:00:33,900 --> 00:00:36,480
to search across multiple data breaches

14
00:00:36,480 --> 00:00:38,493
for a credential exposure.

15
00:00:39,960 --> 00:00:44,040
So I'm at the site, haveibeenpwned.com.

16
00:00:44,040 --> 00:00:45,527
It says, would you like to
check if you have an account

17
00:00:45,527 --> 00:00:48,330
that's been compromised in a data breach?

18
00:00:48,330 --> 00:00:51,090
Curiosity has definitely
got the best of me.

19
00:00:51,090 --> 00:00:54,120
So I'm gonna put in an
old email address of mine,

20
00:00:54,120 --> 00:00:58,747
sari oops, @sarigreene.com,

21
00:01:01,410 --> 00:01:05,123
and let's check to see if
this account has been pwned.

22
00:01:06,960 --> 00:01:11,460
Oh no, it's been found to be
pwned on nine breach sites.

23
00:01:11,460 --> 00:01:14,220
Now fortunately, no pastes had been found,

24
00:01:14,220 --> 00:01:16,590
meaning no dumps of my password

25
00:01:16,590 --> 00:01:18,663
or of my credentials has been found.

26
00:01:19,620 --> 00:01:22,710
But I'd like to know what
sites were compromised.

27
00:01:22,710 --> 00:01:24,690
So I'm scrolling down and it tells me

28
00:01:24,690 --> 00:01:26,940
the breaches that I were pwned in,

29
00:01:26,940 --> 00:01:28,800
defining a breach as an incident

30
00:01:28,800 --> 00:01:32,400
where data has been unintentionally
exposed to the public.

31
00:01:32,400 --> 00:01:36,646
Looks like an Elasticsearch
Instance of Sales Leads on AWS,

32
00:01:36,646 --> 00:01:40,680
Evite, Exactis, going down to MyHeritage,

33
00:01:40,680 --> 00:01:44,133
NestProspex, ShareThis.

34
00:01:45,420 --> 00:01:49,143
ToonDoo, and Verifications, and Zynga.

35
00:01:51,240 --> 00:01:54,540
Well, I'm still using Evite,
so let's read more about that.

36
00:01:54,540 --> 00:01:57,090
In April, 2019 the social planning website

37
00:01:57,090 --> 00:01:59,310
for managing online invitations,

38
00:01:59,310 --> 00:02:02,460
Evite identified a data
breach on their system.

39
00:02:02,460 --> 00:02:05,520
Upon investigation, they
found unauthorized access

40
00:02:05,520 --> 00:02:09,270
to a database archive dating back to 2013.

41
00:02:09,270 --> 00:02:12,030
The exposed data included
a total of 101 million

42
00:02:12,030 --> 00:02:14,760
unique email addresses most belonging

43
00:02:14,760 --> 00:02:16,950
to recipients of invitations.

44
00:02:16,950 --> 00:02:19,560
The members of the service
also had names, phone numbers,

45
00:02:19,560 --> 00:02:23,100
physical addresses, date of
birth, genders, and passwords

46
00:02:23,100 --> 00:02:25,533
stored in plain text exposed.

47
00:02:26,490 --> 00:02:29,820
So what was compromised,
date of birth, email address,

48
00:02:29,820 --> 00:02:34,500
gender, name, password, phone
numbers, and physical address.

49
00:02:34,500 --> 00:02:36,360
So what's my response?

50
00:02:36,360 --> 00:02:38,610
Well, my response is really threefold.

51
00:02:38,610 --> 00:02:43,170
One, was I notified by the site
that they had a compromise?

52
00:02:43,170 --> 00:02:44,490
Two, have I been sure

53
00:02:44,490 --> 00:02:47,160
to change my password post-compromised.

54
00:02:47,160 --> 00:02:50,071
Now, hopefully the site required
that I change my password

55
00:02:50,071 --> 00:02:53,370
but if they didn't, I wanna
make sure that I have.

56
00:02:53,370 --> 00:02:55,200
And most importantly,

57
00:02:55,200 --> 00:02:58,380
am I using those same
credentials anywhere else?

58
00:02:58,380 --> 00:03:01,440
Meaning am I using sari@sarigreene.com

59
00:03:01,440 --> 00:03:04,680
with the same password on any other site?

60
00:03:04,680 --> 00:03:07,530
Now, I shouldn't be, but if I am,

61
00:03:07,530 --> 00:03:10,680
I just handed an extraordinary
gift to the criminals,

62
00:03:10,680 --> 00:03:13,140
who will now use that
credential combination,

63
00:03:13,140 --> 00:03:17,010
that username and that
password on other sites

64
00:03:17,010 --> 00:03:19,800
to see if I have an account
and if that password

65
00:03:19,800 --> 00:03:21,573
will work on that account.

66
00:03:23,610 --> 00:03:26,263
So now I'm really curious
about what other sites

67
00:03:26,263 --> 00:03:29,310
they have in their database
that have been compromised.

68
00:03:29,310 --> 00:03:31,857
So I'm gonna come over
to "Who's been pawned",

69
00:03:33,330 --> 00:03:36,930
and that's going to bring
me to a very lengthy list

70
00:03:36,930 --> 00:03:40,800
of almost 500 sites that
have been compromised.

71
00:03:40,800 --> 00:03:42,511
It will tell me the date
that's been compromised,

72
00:03:42,511 --> 00:03:44,520
the compromised account,

73
00:03:44,520 --> 00:03:48,453
and what was the compromised data itself.

74
00:03:52,350 --> 00:03:54,270
Now I can scroll through them

75
00:03:54,270 --> 00:03:58,050
but this information is also
accessible programmatically

76
00:03:58,050 --> 00:04:01,953
via an API and also via an RSS feed.

77
00:04:03,630 --> 00:04:06,660
Lastly, let's take a
look at pwned passwords,

78
00:04:06,660 --> 00:04:09,670
meaning passwords that are commonly used

79
00:04:10,890 --> 00:04:13,620
so they show up a lot,
or maybe even passwords

80
00:04:13,620 --> 00:04:15,450
that are kind unique which means

81
00:04:15,450 --> 00:04:18,030
they should show up very rarely.

82
00:04:18,030 --> 00:04:19,470
Let's look.

83
00:04:19,470 --> 00:04:22,380
Let's start with some
really common passwords.

84
00:04:22,380 --> 00:04:25,017
I'm going to use the word "Password".

85
00:04:26,460 --> 00:04:27,453
Has that been pod?

86
00:04:30,270 --> 00:04:32,010
I don't think I spelled
it right 'cause I believe

87
00:04:32,010 --> 00:04:34,800
it's been pwned a lot
more than 1500 times.

88
00:04:34,800 --> 00:04:35,970
I must have misspelled it.

89
00:04:35,970 --> 00:04:37,440
Let's try it again.

90
00:04:37,440 --> 00:04:40,263
Password, P, A, S, S, W, O, R, D.

91
00:04:41,220 --> 00:04:42,660
Oh, that's more like it.

92
00:04:42,660 --> 00:04:47,660
3,759,315 times "Password" has been seen.

93
00:04:49,410 --> 00:04:52,560
The word "Password",
literally as a password.

94
00:04:52,560 --> 00:04:54,240
Let's try another really common one.

95
00:04:54,240 --> 00:04:57,753
One, two, three, four, five,
six, seven, eight, nine.

96
00:04:58,929 --> 00:05:00,453
Has that been pwned?

97
00:05:01,320 --> 00:05:06,320
Yikes, 7,870,694 times.

98
00:05:07,350 --> 00:05:10,860
Boy, our users really,
really need to be reminded

99
00:05:10,860 --> 00:05:13,229
not to use those simple common passwords

100
00:05:13,229 --> 00:05:16,110
like one, two, three, four,
five, six, seven, eight, nine,

101
00:05:16,110 --> 00:05:18,510
or the word "Password."

102
00:05:18,510 --> 00:05:22,053
But even trying perhaps
a more unique password,

103
00:05:24,815 --> 00:05:28,320
ah, good news, no pawning found.

104
00:05:28,320 --> 00:05:30,600
Now it doesn't mean it's
actually a good password,

105
00:05:30,600 --> 00:05:33,330
it just means it hasn't
been indexed on this site

106
00:05:33,330 --> 00:05:35,250
but it also means that it's probably

107
00:05:35,250 --> 00:05:38,520
a relatively unique
password, and that's good

108
00:05:38,520 --> 00:05:41,430
because then it indicates
it's not being used

109
00:05:41,430 --> 00:05:42,933
over and over again.

110
00:05:44,070 --> 00:05:45,690
You know, in a closer look segment,

111
00:05:45,690 --> 00:05:47,490
I suggested that demonstrating

112
00:05:47,490 --> 00:05:50,940
how easy it is to spoof
a phone or a text number

113
00:05:50,940 --> 00:05:54,660
would be like this real aha
moment for our user community.

114
00:05:54,660 --> 00:05:56,610
I think you should add this site

115
00:05:56,610 --> 00:05:59,040
to your training arsenal as well.

116
00:05:59,040 --> 00:06:03,780
Help users understand how
important a strong password is

117
00:06:03,780 --> 00:06:06,360
and how important a unique password is.

118
00:06:06,360 --> 00:06:08,640
And then definitely take the opportunity

119
00:06:08,640 --> 00:06:13,380
to reinforce the importance
of two-factor authentication.

120
00:06:13,380 --> 00:06:17,343
And that my friend, is a
closer look at pwned passwords.