Lessons from 220 Million Breached Records
CC Attribution - NonCommercial - ShareAlike 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal and non-commercial purpose as long as the work is attributed to the author in the manner specified by the author or licensor and the work or content is shared also in adapted form only under the conditions of this
Hunt, Troy
We can learn a huge amount about security by reviewing the failures of those who have come before us. In maintaining the data breach notification service "Have I been pwned?", I've dealt with literally hundreds of millions of breached records over time and have seen some fascinating things. In this talk we'll look at the patterns organisations who suffered data breaches were using, the types of data that were exposed and the things they could have done to protect themselves from malicious actors.
 I'm going to start my presentation without the screen because otherwise we might be waiting here for quite a while. So let us have a look at this. So what I want to talk about today is I run this service called Have I Been Poned. Does anyone use Have I Been Poned? Who's using it? Keep your hand up if you're in the data breaches. All right. Just the security guy. Oh, one other guy. What do you guys in? Which ones? Adobe. Adobe. Who's in Ashley Madison? That's exactly what you say when your significant other says, were you in Ashley Madison darling? No. Ashley what? So I was in, I was in Adobe originally. I was in Patreon. So Patreon for crowdfunding for fledgling artists. I was supporting a guy who does a podcast about security where he talks about data breaches and he asked me to sign up to Patreon in order to give him like $5 a month. And then Patreon got hacked, which he got to talk about on the show because it all kind of went round and round. So I was in that, I was in a triple O web host as well. So they had 13 million accounts which were leaked in about November. 13 million accounts or with plain text passwords as well, which wasn't, wasn't a real good look. But what's really interesting is a few months ago I realized as I was sort of going through and getting these data breaches and loading them into the system is that I was seeing some really, really interesting things. So really interesting discussions with everything from the organizations getting breached to the people trading the data to the hackers actually hacking into the system and even to authorities. Oh, we're getting somewhere. So while it warms up, even having some interesting discussions with the likes of the FBI. And I thought, let's make a really good talk because there's a lot of stuff that happens behind the scenes, which people don't normally get to see. And now I can actually show you what those discussions look like, which is good. Now if you are interested in doing the Slido thing, that's what you need. So Slido.com, I think there's an app and you need that number 1853. And if you use that, then you can ask questions that are related specifically to this event, which will work well. So now getting into the original intention of the talk. This is what I called it. And this was some months ago and I thought, wow, 220 million. Like this is a lot. I'll do a talk and I'll call it what I learned from 220 million breached records. And then while I was preparing the talk, I had to change the name of it because everything changed again. And suddenly it wasn't 220 million, it was 235 million. So, okay, I changed the name of the talk. And then a little bit more time went by and I had to change the name of the talk again. And it was getting so many, I went, I can't put an exact number on it. We'll just say a quarter of a billion. And I think now it's actually 269 million. I did this talk in London last week as well. And since then, there's about another 10 million results in there. So every time I go to do this talk, the thing changes. But I think that's sort of kind of the point as well, right? Everything is moving ahead really quickly. So this is a system I mentioned, have I been pwned? That's out of date. There's two more data breaches now with about another 10 million odd records in there. And if you haven't seen it before, it's very simple. Data gets hacked, it gets published publicly, usually by the hackers. I download it from publicly available locations and I make it searchable. So you can go through and say, where has my account been exposed? Which is kind of neat because then you see all the different places your information gets leaked. If it's a really sensitive data breach like Ashley Madison or adult friend finder, then I make sure that you only get to find out if you're in there if you can receive an email confirmation. So you can't go and search for your significant other, your co-workers, your boss. Although there are other companies that encourage you to do that and that's one of the things I'm going to show you today. So one of the things that's interesting when we talk about data breaches is the perception of hackers. And we get a lot of feedback via the media about what hackers are like. It's kind of curious, you can learn a lot from Google. If you go to Google images and you search for hacker. Now this is curious because there's a trend here, right? So hackers, and you see this on like every single newspaper, every single website that talks about hackers. What we know of hackers is they have hoodies, they have Guy Fawkes masks, they work a lot in binary as well. Curious fact. There's also a lot of green. And then some news stories, they sort of put all those things together and they go, this is a hacker. It's a Guy Fawkes mask with a hoodie with binary. And this is like sort of the ultimate personification of what the hacker is. Now we also see a lot of stuff about hackers in promotional material. So a lot of companies making a lot of money out of the fact we get hacked and they want to make a lot of, I guess they want to make people kind of scared. So they do stuff like this. This is a Kickstarter for a little application, a little device actually called Kujo. And here's what they do in their adverts. You may not know it, but you've probably already been hacked. Thousands of hacking attacks occur each day. Sounds scary, doesn't it? Listen to the music. You may not know it. You've already been hacked. And he's got a hoodie because he's a hacker. But here's the interesting thing, right? Like have a look at what he's typing into. This is a zoomed in bit. This is not a terminal. This is a browser. He's hacking in the browser. And I want to show you how you can impress your friends and colleagues about how you hack in the browser. What you do is you go over to hacketyper.net. Okay? And what you also got to do is press F11 to put it in full screen because then it looks pretty serious. And then this is how you hack. This is real. You got a hacker type and you just hit keys. And it does this. I zoomed in on the code block and it is from hacketyper. They are selling their device on the premise that a hacker is you can hacketyper to hack. Anyway, there are all sorts of websites that do exactly this and all sorts of news articles and things that basically prey on the fear of people by using resources such as hacketyper basically just to scare people, which is kind of sucky. Now this is the reality of it, right? So this is the reality of who the hackers are. This is Jake Davis. He was 19 in that photo. He was part of Lullsec in 2011 going around hacking lots of things. Look at his mum. How do you think his mum feels? They're in court, right? It's like a death stare. He's so grounded. He's really grounded. But he did a lot of damage. He's a 19 year old kid. Another kid, same sort of deal. Also in court, also with his mum. His mum doesn't look real happy either. But this is what happens, right? It's these kids going around breaking into things and clearly making their mothers very, very upset. And the interesting thing about this is this is what hackers are normally like. This is anonymous, right? This is kind of the sophistication level of the people that are breaking into these systems. And we kind of lose track of this a little bit. And then we see the media and we see the scary hoodies and things. And including when we see the bravado, the two kids in the previous shots were very much talking about how powerful they were, how unbeatable they were, how they could break into anything. You know, very, very bravado sort of behaviour. And clearly it didn't work out real well for them. Now this was a really good example. Did everyone see Talk Talk in the news just a little while ago? So Talk Talk is an English telecommunications company and Talk Talk had a major security incident. So they had a whole bunch of data sucked out. It was in the news. It was in the news a lot in Australia. So it must have been really, really big in the UK. And after the attack, this detective came out and he said, okay, here's what it was. It was Russian Islamic cyber jihadis. That's terrifying. It's like every single buzzword. Is anyone here Russian? Right, good. So I get the impression that Russians are scary. Like they sound scary. So we got that. Obviously in Islamic cyber jihad, he also sounds very scary as well. So this was the news, you know, trying to get everyone scared about these Russian Islamic cyber jihadis out there. Now here's what it really was. 15 year old boy in his bedroom, because where else is he going to be, right? If he's hacking away on computers. So there was him. There was also 16 year old boy, a little bit older. And then there was this really, really old guy. He was like 20. This is the senior citizen of the hacking circles. And the thing about it is that all these guys are the ones that broke into these systems. It wasn't the scary Russian Islamic cyber jihadis. It was just bored kids. And very frequently when I get data from people and get communications from people, I realize that it is just bored kids. And they often turn into scared kids too. I'm going to give you an example of that. Now monetization is a really interesting one because people want to make money out of data breaches. You can go to online marketplaces and buy data. You can buy credit cards. You can buy social security numbers for people in the US. You can buy dates of birth. You can buy all of these different attributes online. Elections are about a dollar each. You can find these sites sometimes on the ClearWeb, very often on tour. You open up the tour browser, you plug in a URL. There's a marketplace. The marketplace has sellers. The sellers have ratings. There are transactions. There's feedback. It's just a normal marketplace. It is like eBay, but for data breaches, drugs, guns, all this sort of thing. So all this sort of data has a value. Now it's interesting when I see things like this. So I get messages from people saying, I've got something I'd like to sell to you. So in this case, the guy wanted to sell Nexus mods. It was a forum. I would like a sum of Bitcoin. They're coming to me thinking I'm going to pay them money. And of course I never do. I go, okay, I'm not going to be part of your illegal activity and then document the whole thing on Twitter as well because sooner or later your account's going to be seized after you get caught if you're the one going around doing this sort of stuff. Now curiously, since I created this deck just last week, someone did actually give me Nexus mods. They said, here you go. We've been trading this in the underground forums. You might find it useful for your site. So eventually this sort of stuff turns up anyway. Now there's another good example. IPM offers a personal management. This was a big breach in the US. Have a look at how much they reckon it's worth. More than 100 Bitcoin. Bitcoin now at the moment is about 300 US dollars. So maybe $30,000. I don't know, like it's one guy on Twitter, but I've got other examples of the prices these things are being sold of. And when you think about it, the sort of data that was leaked about government personnel, pretty sensitive info. It's definitely got a price, probably a high price. So this sort of thing comes up quite a bit. This was after the triple O web host. So triple O web host got breached. It actually got traded quite significantly last year. It looks like it got breached in about March and eventually I got the data via a journalist later on in the year. And I put a question on Twitter, very vague question. Anyone have an account on triple O web host? And this guy got in contact with me via direct message. And this I found really interesting because he says the database is private and it's better kept that way. Now what he means by private is that someone had hacked into it and they were trading and selling it between themselves. That's what private was. They didn't want it to be traded and sold or publicized by anyone else. They wanted to keep it quiet. And they want to keep these data breaches quiet because whilst they're quiet and the victims don't know about it, the victims can be exploited. Once the victims know that triple O web host is hacked and the password they use there has been exposed and remember it's plain text stored in plain text. So no cryptography whatsoever. Same password they use on other accounts. Once the victims know the value goes down. He also said this, selling for upwards of $2,000 right now. I can't understand which moron would be considering just giving you a copy. Maybe a moron with a conscience could have been that. Because this is the thing like basically what he's saying is we are going around exploiting the people that were compromised in this data breach. What moron would want to stop that from happening? Like this is the level of sort of ethics and morality of a lot of the people that are dealing with this data. Now triple O web host was also for sale on other sites. This is a site that sells that sort of data. You can see it sells a few different things here. Triple O web host was selling for $1,500 at the time that this particular incident broke. In fact, just before it went public. Another guy said $2,000 triple O web host here $1,500. After I made it public and there was also a long lead into this where I was trying to get in touch with the company. They wouldn't respond and eventually we made it all public. After it went public it went from $1,500 down to $200. Because suddenly the value goes right down. So whilst it's private and the victims don't know about it, they can exploit the victims. Once it's public and the victims know it goes down. Then it went down even further. So it's now wiped off 90% of the value, which I'm kind of happy about. We have screwed the market for this data breach, which is good. We don't want it being monetized in that way. Here's another good example of monetization. So this goes back to Ashley Madison again. And when the Ashley Madison breach happens, so we go back to July. And in July hackers come out and they say we have broken to Ashley Madison. We have all the data either shut the site down or we're going to dump it all publicly. And of course they never shut it down. They were never going to shut it down. So it did go public. It went public in August. And after it went public, a bunch of companies started monetizing the data. Now in the case of a data breach, there are things that can be legitimately monetized. People are scared. They need things like identity theft protection. It's not a bad thing to have anyway, let alone after a data breach. But then we had companies like this, trustify, who took the data and the data was really broadly torrented. It would take any of you about five minutes to find that data and then about five hours to download it because it was pretty big. Five hours on Australian broadband speed, maybe half an hour in Norway. But the data is really easily available. So companies were downloading it and then creating services that made money from it. So what these guys are doing is saying, hey, check if you've been exposed. And this is not dissimilar to what I do with Have I Been Poned. The difference is Have I Been Poned is all free. People go in there. I don't make any money out of the fact that the public can do that. But what happened here, these guys allowed you to search for anyone. And then after you searched for them, they sent an email to the person you're searching for. So imagine this. You've got a wife suspicious of a husband. And this was the gender split. There's no gender equality in Ashley Madison. It was almost all guys and fembots. So fembot is basically just computer code which engages in discussion. In fact, they'd even call them engages. The engages would get them in to chat and pay more money to stay on there because they think they've got a chance of meeting a girl who is not their partner, who they're meant to be married to because the whole thing was meant to be about having affairs. So anyway, you've got this situation. Both searches for her husband gets an immediate confirmation on the screen that the husband was in the data breach. Husband gets an email. He's not the one who searched for it, but he gets an email. So the first, the husband knows of him being in the data breach is when he finds out that someone is actually searching for him in the data breach. Imagine that. So sort of suspend your moral judgment for a moment, regardless of how you feel about adultery. The very fact that his privacy is violated in this way where anyone can go and search for him and now he's getting an email, could have been his boss searching for him. And he gets an email. And of course, what they're trying to do here is solicit business. They're trying to sell private investigation services so that this guy can get his data removed from the internet. And that's what they're trying to do, get your data removed from the internet. How likely do you reckon that is when it's been torrented nonstop around the world? Never going to happen. So they did that. That line was shitty. They also did this. After you searched for someone and then you found them, there were social icons that allowed you to tweet that you'd found them. Now this is bad, but you can almost understand it insofar as, yeah, I found my ex-husband, you know, screw him. But what about this? I found my friend. These were preloaded social messages. This wasn't the person going, I'm just going to type in. I found my friend. Trustify presented you with the buttons so that you could say, I found my ex. I found my friend. You can search too. They're encouraging other people to go through and search and find their ex and find their friend. And the privacy implications of this is just sort of mind blowing. It seems that once that data goes out, it's like, you know, all bets are off. You can do whatever you want with it. So they were making money in a really, really underhanded sort of way. And they eventually did reverse quite a bit of this. They got a lot of pressure, a lot of public pressure. I wrote something, which is where I got some of those screenshots from, saying how bad it was. And then they started getting death threats. Like that's how the community reacted. They got some really, really nasty messages back. Fortunately, none of them got killed as far as I know, which is, I wouldn't want to feel partly responsible for that. But it gives you an indication of just how bad this was perceived by the community as well. I mean, on their behalf, just a really poor reading of the market and how people respond to these incidents. So that was that one. The other thing that came out of Ashley Madison was stuff like this. This is a ransom email. Now, you ever think about it, a bunch of you are probably developers, security professionals, you're used to writing scripts and things. How hard would it be to just enumerate through a great big file and do a mail merge? Because this is all it is. It's a mail merge. It's a ransom message, but it's also got a little bit of spearfishing to it because it's got information that is very particular about the victim, their name, their address, the last four digits of their credit card number. If you got this and it's asking for five bitcoins as well, that's a lot. That's like $1,500. And if you don't do that, they're going to let your Facebook friends know and your boss know and all that sort of thing. Now of course, the thing about all this is that if you didn't pay, nothing ever happened because this is just like a random send 30 million odd emails to everybody and then some people will pay a fractional 1% will pay and that will be a good earn for the 99. Whatever percent that don't pay, nothing happens. But what some of these messages were saying is they're saying this Bitcoin address is unique to you. And I had a lot of people email me because I wrote a few things that got a lot of press. These people would email me and they'd say, please don't share my Bitcoin address. I don't want anyone else to know. So I'd Google it and you get all these results from all these other people saying, I just got this ransom message. So the Bitcoin address was not unique. They were not tracking payments. There was no recourse if you didn't pay. But they're scaring the hell out of people and these are still going on today. So we're like five, six months on and these messages are still going out to victims because they're so easy. It's just sending email. Now one of the other things that I found very interesting when I thought about the experiences with Have I Been Poned is how I actually find data breaches. So where do I get these things from? And there's not one answer. They come from multiple different places. So a good example is often I'll get a message like this. So this is how I got the triple-O web host data. This guy sends me an email and says, hey, five months ago, this was in October, so back at about March or something, I've got this data. Would you like a copy of it? And in fact, what he said is he said, I'll give you the 2 million version. So there's actually 13 million. I'm going to give you the 2 million. Sends me a mega link. So megakim.com, his service. Often people share data breaches via mega because it's very easy to upload the data to there. They upload it anonymously. It's on a great big obfuscated URL. If you don't have the URL, you're not going to find it. Very, very easy for them to distribute data that way. So he sends me this and do not give me any credit for this. So what he's actually saying is he doesn't want anyone to know that it was him who had the data. And I'll show you a follow-up message from him in a moment. He had actually sent me the 13 million version. So I got the full data set. And this was kind of the first we knew of it back in October. I'm 99% sure they don't know they got hacked, too. They didn't know. They had no idea. And I tried really, really hard to get in touch with triple-O web host. I sent multiple email messages. I went through their ticketing system. I had people respond to me on the ticketing system because I'm saying, look, I've got a serious security incident. I want someone to talk to give me security contact because I don't know who's manning the help desk. You know, some low-paid worker on the other side of the world and an outsourcing center. Is that the person I want to give information on this to? Anyway, eventually when we found we couldn't get in touch with them, that's when it went public. But with this guy, later on, after it got a lot of press, because once it did go public, the media picked it up and the stories were all over the place. I got this, and when I read this last line in particular, I'm afraid they would still look for me. It sounds like a scared kid, right? It's probably the same sort of kid as what we saw on those earlier photos. Some kid in his bedroom in Northern Ireland or wherever who's just been handing this data around. And what struck me with it is I don't think that they are aware of the ramifications of what they're doing. They're sitting there in the comfort of their own bedroom and they're sharing this information around, having chats without any sort of sense of the real world consequences. And then when it hits the media and it's all over the press and suddenly they go, holy shit, look what I've done, I think that's when it hits home. And they say, wow, this is actually real. So I almost feel a little bit sorry. I do feel a little bit sorry actually for a lot of these kids because they don't know what they're getting themselves into. They don't know what's the actual real world ramifications of what they're doing. Other ways data comes to me. Just a pretty good example. So this guy just here is saying he wants to know what his password is. And one of the curious things that I'm finding with data breaches now is that after a breach, the victims of the breach really want to know what their data was, what was exposed. And this is kind of natural, right? Like I have just had personal information exposed. Tell me what it is. So I want to know what it is. And I get heaps and heaps and heaps of emails like this. I end up having to write a blog post which basically says, no, I can't share data because I can't respond to individual requests, go through, try and find their data, then try and send it to them in a secure fashion because often it's passwords and things I don't want to be emailing. But this happens all the time. Now after I told him I couldn't share it, he was, you know, sad face, which I understand. But I would really like to see organizations making this available. And I'm talking about this more at the end as well. But to me, it seems to be their responsibility. You lose the data, you're responsible for telling people what you've lost. Not in one generic message, we're really, really sorry, we lost your things. But this is exactly what we lost. This was the name you had, the password you had, the credit card details that got exposed. It's public anyway, it's doing the rounds. The company should just tell them. It's another way data comes to me. So this was someone who sent me some data about a Dutch financial institution. And what I find interesting about this particular picture is the fact that it's a console window with SQL map. So the guy has basically sent me an email and said, hey, I've got some data you might be interested in. I'll show you the discussion we had after this in a moment. But basically what he's done is he's gone, like he's literally, he's hacked into it using SQL map, which is an automated tool, you can see part of the command line up there. You basically run SQL map, pass a use switch with the URL that you want to hack. There's a few other parameters. You go outside and play. I shouldn't, that's what they do. And you come back and it's got all the data out. It's really, really, really simple. So he's pulled all this information out of the system and then said, hey, here it is. And I said, okay, well, what I think you should do is you should disclose it privately to the company. You should let the company know that they have a vulnerability because you're at this point now where no one actually knows about it. You know, once you make it public, it's like there's no going back. Now it's public and you're going to get yourself into a lot more hot water as well. So I said, disclose it privately. And he said, what's private disclosure? Like it just never crossed his mind that maybe he should get in touch with them and say, hey, you've got a vulnerability. And even after I said that, he's like, okay, well, do you still want the data? No, go to your room, think about what you've done. Don't do it again. This is often the way with the kids, right? They're not thinking about the real world ramifications. So ultimately I said, okay, I'm not going to go and take this data. I'm not going to publish it. You need to get in touch with them privately. And in fact, what happened in this case is I got in touch with some Dutch security people I know, let them know they got in touch with the organization that was impacted. There was a small amount of news on it, but basically the data never went public. I hope they actually let their customers know because it is their customers on the previous screen. But the whole thing ended up being a lot quieter than what it could have been otherwise. There's another good example of where I get data from. So this is a public website. It is it's on the clear web. This is not a tour hidden service. You can just type in the URL, go here and start downloading data breaches. It's that simple. This data is floating around the web everywhere. This is just one site of many that are on the clear web. There are many more on tour hidden services. And it's not even entirely clear why they run this. I mean, he's asking for Bitcoin donation. Maybe he gets a few Bitcoin thrown at him every now and then. But it goes on and on and on. There's about 25 records per page and there's about nine pages as well. So maybe a couple of hundred different data breaches just sitting here publicly searchable, publicly downloadable. And this is what some of them do. So another way I find data breaches. Often we'll see information leaked on Payspin. Payspin is a really popular means of leaking info because it's very, very easy just to go and create a paste, put whatever you want in it. It's anonymous. There's no authentication. There's no sign up. And then you share the URL. And Payspin in their terms and conditions say you shouldn't be sharing data breaches or things like this. I don't think they're quite as explicit as like you shouldn't be sharing other people's sense of information. But I don't think they mean it because it happens all the time. And they probably make the argument of look it's just a service. People can use it for good. They can use it for bad. But this sort of stuff happens a lot. And what we often see is stuff like this where this guy's going, okay, here is part one of the triple web host data breach. So people recycling the data breaches now. Go and get the full thing at triple web host dash leak dot blogspot dot com. So you can get the whole thing. So you go to get the whole thing and you end up somewhere like this. And then it goes, okay, there's part one and part two. Download this one first. Go over here. So you go there and you got to fill out a survey, right? So now we're starting to see the monetization because all of this sort of crap earns people fractions of a cent every time people go through into the survey. So you go, okay, I'll download. All right, so now I got to do this. I got to go back. I got to do another survey. And then it takes you to here. And now I got to do another survey so that I can get a gift card for $100. Guess what? You don't get a gift card for $100. And normally I get about to here and I go screw it. Like you guys are just trying to make money out of it. So again, it's the monetization thing. They're trying to trick people into going through and filling this stuff out with the promise of getting breached data. Just all the different ways this data is recycled and reused are kind of fascinating. Now this is another problem that I often have, which is that data is leaked and someone says, here it is. It is the, for example, the triple-O web host data breach. We want you to publish this data. It's serious. We hacked it. And I've got to try and figure out if it's legitimate or not. Because a lot of the time when I see this data, it's not legitimate. And there's a few different ways I can do this. So I can do things like Google some of the hashes. And if I find that the hashes in the data breach appear in many different other places under the names of other data breaches, well, it's probably not going to be real. But there's a few different ways that I do verification. So here's one good way. Now this is actually Madison again. So again, back in July, when we first heard they'd been hacked, but the data hadn't been leaked, one of the things I found quite fascinating about actually Madison is everyone got really, really upset, assuming everyone who was in the data breach got upset when that news came out. They said, oh, no, now people can discover that I was on the site. I thought, well, this is curious. I wonder if you can discover if they're on the site anyway. So I went to the password reset page and I said, OK, well, I'm going to put in an invalid email address and let's see what happens. Came up and said this. And when I saw this, I thought, OK, this is pretty good because if we look at the piece in bold, it says if that email address exists in our database, you receive an email to that address. And I thought, OK, that's good because it's non-committal, right? It's not saying, yes, you had an email and we've just let you know as opposed to no, you don't have one. Adult friend finder, by the way, who was breached in May, four million records, they still do that today. You can go to adult friend finder, put in an email address and it will tell you explicitly whether it exists or not exists. So they leak the presence of every person on that site via an enumeration risk. And curiously, just a little tip, if you are going to sign up to one of these sites, don't use your normal email address. Don't use your working email address. Make something up. Do not use your dot gov address. There are a lot of dot gov addresses in these things. And you could say that someone else signed you up until your payment records are leaked as well. And then it's really, really hard to make that argument. So this is what they're doing. They're going, OK, if you had an email address we're going to, or if you had an email in the system, we're going to send it to you. Sounds good. Now, this was invalid. Let's have a look at the message when you did have an email address in the system. You see any difference there? It's not subtle, is it? So I wrote about this and I said, look, you can find out anyway. That way, why are you getting all upset? I mean, I know why you're getting upset, but you could always do this anyway. So I actually made us and fixed it and I thought, that sounds like a challenge. I wonder if there is another way of finding out whether accounts actually exist on the site or not. So I went over and I did this. I thought, what I'll do is I'll log on 25 times, but what I'll do is I will use a valid account for research purposes. Number of times I said that to my wife. She's walked in. What are you doing? Research. I do a lot of research. Anyway, so I tried to log in 25 times, valid email address, invalid password, and I timed it. OK? Looks like this. It's a reasonable spread. This is how long the HCTP response takes between issuing the request and getting a response back. Login fails. Fine, but it's an invalid account. Around about 500 to 600 milliseconds. So then I said, OK, what happens if I take an account that does not exist on the system and I try and log in with that? That's curious, isn't it? Anyone know what it does is? Any guesses? Doesn't hash the passwords. Right. So here's how it works. Actually, often when I ask that, some people say, well, yes, because it's doing a database lookup. If your database lookup for an account takes 500 milliseconds, you have a different problem. It shouldn't be taking that long. So here's what happens, right? Ashley Madison used Bcrypt with a Work Factor 12. They screwed it up really, really badly, and we later found we could get basically 90% plus of the passwords out anyway. However, they were using Bcrypt Work Factor 12, so a fairly heavy workload in the hashing. And what happens is when you provide a valid email address, regardless whether the password is valid or not, valid email address, it goes to the database and it says, get me the record for this person. The record comes back with the salt and the salted hash, and then the new password gets added to the salt and everything gets hashed. And because it was a high Work Factor algorithm, it took several hundred milliseconds. When the account doesn't exist, the application goes to the database that says, get me the account for this email address. The database comes back with nothing, and the app says, well, now I don't have to hash. So this, from an efficiency perspective, is really good. But from a disclosure perspective, we have this. So things like enumeration risks are one way that I verify data breaches. And if I can pick three random email addresses from a data breach, plug them into the password reset, and it confirms whether the account exists or not, I've got a really high degree of confidence that that data is legitimate. Now three people are going to get password reset emails, three people out of a breach, in this case, of 30 million. I'm not feeling too bad about that because now they've got bigger problems. Now they've had all of their data leaked publicly. And it's taken me three emails to figure that out and then let potentially millions of people know what's happened. Because millions of people do find out whether they find out by notifications on my Heavobain Pone service or whether they watch the news. You could not miss the news on Ashley Madison. Here's another good one. So this is Strat4. Strat4 was an intelligence agency. They did reports for, particularly for governments, on things like the political landscape of certain countries. And they got hacked in 2011, and they had all of their data leaked. They went kind of offline for a little bit. And they had to sort of send this message and say, look, we're hacked by an unauthorized party. Everything got suspended for a while. I want to show you what that data breach looks like and a really easy way of verifying that. So again, this is a data breach that did get circulated pretty broadly. Looks like this. It's a pretty sort of typical structure here. It's just common delimited. User IDs, names, passwords, emails. These are the passwords. They're all MD5 hashes. Just straight MD5 hashes. No encryption. No salt. Nothing else. Just very, very simple. So the way I'd verify something like this is I'd search for hashes. And I thought, well, maybe one of the ways we can do this is I'll make it interesting and I will search for a.gov. Find someone with the.gov address and I'll take their hash. And then I'll go to Google. And Google is really good at cracking hashes because you can search for a hash when it's not salted because the salt adds randomness that should be unique for every record. But when it's just a straight hash, you can go and search for Google and you can often find the plain text version. So this was the strat for data breach. And that was one of the hashes. First government official hash. Now what do you reckon the password was? Stratfor. Who would do that? Who would sign up on a website called Stratfor and use the password Stratfor? But see, this is verification for me. OK, this hash was a password which is likely to be used by those people. Now what I could then do is I could turn my zoomer on because you're going to need to see this one closely. One of the things I found curious is I thought, OK, well then how many people might have actually used that same password? Because once we're actually talking about a case where it's just a straight hash and there's no salt, we can do this. We can go back into here. We can do a find and we can do a count for that hash. How many hashes do you reckon we're going to find? You got 12,000 people. There are 860,000 records in the breach, 12,000 people use the password Stratfor on the website Stratfor. Now that Stratfor all are a case because if it was Stratfor with a capital S, the hash should be completely different. So we'd inevitably find a whole bunch of people did that as well. So again, going back to the point of this, from a verification perspective, these are the sorts of ways I try and figure out is this data breach legitimate or is it fabricated? The other thing I started doing recently is this, because what I've realized is I have got a really good repository now of people that are interested in the Have I Been Pwn service. So I've got a little notification service. You can sign up for free, you put your email address in, you get an email, it says you've signed up for notifications. Are you sure you want notifications? And you click a link to say yes, so it verifies you and it's done. I've got about 330,000 people that have signed up for this. So what happens now is when I have a new data breach that I can't verify using the means I just showed you is I start emailing subscribers. So good example, VTech. VTech is a Hong Kong based toy maker. In October, November period, a reporter emailed me, a reporter I'd worked with before and he said, I've been given a data breach. I want you to help me verify it. So I got the data breach and I couldn't find anywhere on their website to go through and do like a password reset. There was nothing in the data breach that would allow me to do stuff like easily googling hashes, they were salted hashes. And what VTech actually did is they made tablets for kids. So think about like an iPad but it's all plastic and colourful and things like that. And you could give it to your kid and then the kid's mate could have one as well and then they could chat via the magic of the internet. So a lot of parents didn't realise these kids are chatting in different houses. It goes by the internet. You just put your kid's details on the internet. And this is what was in the data breach. Four million adults with names, email addresses, physical addresses, phone numbers, 280,000 kids with name, gender, age, average age is five years old and a foreign key to the parents record. So if you had this data you could basically decide what child would I like in a convenient location and find them. I didn't get the photos but the attacker later also gave the report of photos because the tablets had a camera. You take your photo. There's kids, 280,000. Later on after this all blew up VTech said it wasn't 280,000 kids, it was six million. Shit. That was a lot. But anyway, verification, because you signed up via a tablet and the tablet talked to an API I couldn't see an easily accessible interface anywhere where I could check things like password resets. So I did this. I took the email addresses from the data breach and I found the most recent 20 subscribers to have I been pwned. So people that were thinking about the service recently and I sent them this email and I didn't tell them what the service was or where it was. I just said, hey, look, would you help verify this? And I had about half the people respond and I'd get messages back like this. In fact, this is what I sent to the person. So one person came back and said, yes, I would like to know what the incident was. So I would send them a piece of information or three pieces of information which would give them a degree of confidence that it was their data without being too sensitive. So when did you first log in? It's not too bad. Where were you located? And your ISP. And your ISP from the IP address. This poor lady was in talk talk and VTech. She was really impressed when she emailed back. But, you know, like this is not sensitive data, but it's enough to have a pretty high degree of confidence whether it's legitimate or not. And she came back and said, yes, that's accurate. And that gives me a high degree of confidence for one person. And then I had about six actually come back and ultimately verify their data. So what I'm finding is that how I've been pwned becomes a really, really good verification channel. I actually get feedback from the individuals in the data breach before I make anything public that yes, it was actually legitimate. So that's been really useful. This is also really interesting. The way the organizations respond when these incidents happen. And you probably see, if you read the news, a really broad range of responses. But a lot of them are kind of like this. This is the first thing a lot of companies say, don't worry about your credit card. Now put this in context. Ashley Madison, a site designed for you to have affairs. If your wife finds out, she might leave you. You may never see your children again. Like really, really bad things are going to happen, life changing things. But don't worry, your credit card's fine. Same here. This is in VTEC. Your children have been leaked. People know where to find them. They know what they look like. They know their names. Don't worry, credit cards are all right. What are you worried about? And inevitably what we're doing here is we're trying to placate PCI. These organizations are worried that they're not going to be able to process credit card payments anymore. Their first concern is keeping the payment card industry happy, which is just really bad. It's just something that absolutely stinks about this. So we often see these really evasive sort of messages focusing on things that ultimately are in the company's best interest. I've got many, many examples. I wrote a blog post a while ago where I showed this. Initial responses focus on credit card data. Who's had their credit card defrauded before? Wow. You guys are lucky. I'll only refute you. I wrote something where I talked about this and I said, look, who really cares about the credit card? Because if it gets compromised, your bank gives you fraud protection. They give you the money back. The next week, and I'm sure it was coincidental, but the next week my wife's card was defrauded. We found out on a Monday morning we went into the bank. The bank canceled the card. We had the money back in the account by the end of the day. We had a new card in the mail at the end of the week. The greatest inconvenience of the whole episode was that we had to change some of our direct debits, which were trying to debit the old card number. That's what credit card theft means today. A bit different for debit cards, but credit cards, for me, is a consumer. It's kind of a non-event. This was a really good response. So Patreon, who I mentioned got hacked earlier on, Patreon did a number of things really well. So they did things like they stored all their passwords in Bcrypt with the Workfactor 12. They did something else that I have never seen any other company do in a data breach, which is that they encrypted the personal identifiable info. They encrypted addresses. They encrypted other aspects of your personal info that other companies never do. Not only did they encrypt it, but they managed not to lose the private key when they did get hacked, because that's the other trick, right? You can encrypt. It's no good if your key gets disclosed. So they actually got it right. When I like this message, it came from the CEO. What I like down here at the end of the third line, I am so sorry to our creators. He's actually apologetic. A lot of companies, the first thing they do is go, evil cyber hackers. These evil cyber hackers, it's illegal. They rant and they rave and they get angry at the people that breach them without focusing on the fact that they screwed up. And yes, they are evil cyber hackers and they should have legal recourse. They probably should end up in court if not jail, but those companies, companies like AvidLife Media that creates Ashley Madison, VTech, really, really screwed up. VTech in particular did terrible things with their app design. It took me about 10 minutes to find out that I could create two accounts, log into one and pull the data out of all the other ones. Took me 15 minutes. You know, and I'm not doing anything special. I just say there's an HTTP request. It has a number in it. I wonder if I add one. Could I get some different data back? Yes, there you go. Job done. So, this from Patreon. Patreon also said this, they went on to say we don't store credit cards. All right, they have to keep PCI happy, but they also actually give some detail encrypted with 2048 bit RSA key, no specific action required, and then they go on and they give technical details. So there's transparency. And finally again from the CEO, another apology. I sincerely apologize for this breach. Like this I think is about as good as you can do with the breach message. And they did screw up. They had debug settings in a publicly facing environment that had access to production data. They screwed up. They admitted it. They gave the details. From that we saw that they did those other things well. They did the B-crypt well. They did the encryption well. They had a good message. These things happen, but this organization was prepared for it and they responded in the right way. The other interesting thing that comes up is people often say a company gets hacked, but then they get over it and they move on and there's no sort of long lasting impact. It's not like their share price dives or anything like that. And I find that curious for a couple of reasons. Number one is that data breaches are expensive. Very often data breaches lead to having to do things like provide identity theft protection for everyone. It's a very standard response. Oh, we got hacked. Identity theft protection. There we go. And that happens. It ties up a lot of resources. It damages brand. It keeps services offline. VTech had to take all their services offline after this incident happened. I was in London last week and I went into to Hemley's, the big toy store, and there's a massive VTech stand. I was like, I'm going to go and ask them about how secure these things are. And they didn't have any of the tablets in stock. And it wouldn't surprise me if they were just not able to sell them at the moment because the service is still offline. Like their service. It's like a ground up rebuild. So it does have impact. And I wanted to find some examples of where it actually has real impact. So I looked at things like this. Now this one is curious. This was a few months ago. Again someone sent me some data. They contacted me via Skype and said I've got some data breaches. But I didn't compromise and I believed the guy because we had quite a long chat after that. But I've had them through sort of trading with other people. And one was called Nettela. Nettela, not like Nettela, the thing you put on your toast. And the other one was called Money Bookers. And these were gambling sites. And the data dated back, I think to about 2012, like it was quite old data. And the interesting thing here was that now that those two organisations have been bought by another company, and this other company was now responsible for it. So Listed Company. And the interesting thing is that we ended up sort of getting in touch with the company. They responded really, really well. I had quite a few chats with their security guys trying to figure out what was going on. The company's called PaySafe. And PaySafe, because they're listed as well, they have to disclose this sort of stuff. Like they can't hide it. They've actually got to take it seriously. So they had to put out a press release about it. And then this happened with their share price. Now there's two curious things here. So number one is that if you look at it on the aggregate, nothing happened. Number two is they did lose 300 million pounds there. 300 million pounds just for a moment. That's a lot of money. 300 million pounds. They dipped in direct response to that incident. 300 million pounds. That's like 20% of their share price. If you had prior knowledge of this, before it hit the news and you wanted to play the market, okay, it would probably be a little bit obvious, you don't normally play the share market. Well, you just had all these options out on something just before it dropped 20%. But that did have a serious ramification. And I wanted to show this because it shows that even though there might not be a lasting impact, that's a lot of money. 300 million pounds. Another good example. This was a few years ago. Associated Press had their Twitter account hacked. Let's just be clear about the news here. It wasn't Twitter being hacked. It was AP having a shitty password or getting phished. It was one of those two things, always is. This is what the tweet said when they got compromised. This did upset the market. The market responded and the market did this. That is some number of billions of dollars on the Dow Jones. And again, on aggregate, like it all evened out, it was all good. But holy shit, look at that. That's hundreds of, that's just a massive amount of money. So it does have an impact. It might not be a lasting impact, but it does have an impact. Out of that, many people would have lost a lot of money. Many people would have made a lot of money. This is the other thing that got a little bit interesting last year. I had a phone call from a very nice American man from there. And it was curious. In fact, it started with an email. So I got an email, the FBI would like to talk to you about one of the data breaches. And I said, okay, fine. We'll have a chat. And they sort of wanted more information on the background about what was in there, what had I found in investigating it. It also leads to discussions with the Australian Federal Police, who are also very nice. All of them are always very nice. I hope they stay nice. But when I thought about it, there are a few interesting things here. And one of them is that often the likes of the FBI, the NSA, et cetera, are perceived as being evil. Evil in the respect of, particularly for those who are in the security industry, we see a lot of news and things about how they're cracking down on people doing ethical things, disclosing vulnerabilities, how they're basically out there to do things that invade our privacy. And when I thought about it more, you know, one of the things about the likes of FBI, Federal Police, any sort of government security or intelligence agencies is that we do want them. We want them stopping a lot of the sort of stuff we've seen. I don't want things like AAA web hosts being hacked into and leaked all over the place. I want them to catch the people that did that. I'm not going to disclose who I've been talking to or violate private discussions, but I want them to make sure these things don't happen. We need these guys. And I guess it's like everyday police on the street. We want them there to keep us safe. They play a really valuable role. And it's curious when you look back at where there's been involvement that involve security people and the press has taken it really badly, it's interesting to look at the details. So for example, everyone remember this? This guy, Weave, if ever you follow him on Twitter, he's, let's just say he's an interesting character and leave it there. But he identified a vulnerability with AT&T where he could pass and identify from his iPad into one of their services and get back information about the account holder. And the news here is sort of going, security research have found guilty of conspiracy and you know, I'll get out of this. I'll be okay. You know, it was a real sort of beat up job. But the detail of it was is that basically he found a direct object reference risk. He could pass an ID, get a record back out. And then just to make sure it wasn't an accident, he did it another 114,000 times and then gave it to the press. That shouldn't happen. It's the same here. He's an Aussie guy. Happened with Australia first state superannuation, like our retirement plans. He found a vulnerability, direct object reference vulnerability. Found the risk just to make sure he did another 770,000 times, got all the data out and then wondered why the police knocked on his door. Police took away all these toys for a while. As it turns out, it worked out really badly for first state super because basically it showed that they had really gaping security holes and they were in negotiations. So it cost them a lot of money. But often when we see headlines like this, there's another story behind it. And we want the FBI, the Australian Federal Police, everyone else who's playing those sort of roles, we want them there to try and keep us safe from these sorts of incidents. So it leads me to here. Three things that I would really like to see change with the way data breaches are handled and the way organisations respond. So number one is this. A while ago, it must be about two years ago now, Forbes got hacked. Forbes had about a million records leaked. It took them a week to let anyone know. It took me less than 24 hours to let every subscriber to have I been pwned know. This should be an easy thing. You get hacked, you've got to let people know quickly. Because otherwise you get all this speculation in the media, people are going, well, I don't know what's going on. Like, are my details compromised? Do I need to go and get identity theft protection? Is that funny credit card transaction as a result of this? Like this should just be fundamental. This is the other one and I reckon this is actually really important. And it goes back to that earlier point of people start asking me for their data. The organisation is the one that lost it. If I'm able to obtain this data because it's been spread out all over the internet, then surely they can obtain it and surely they can give it to their customers in a secure fashion. This should be fundamental and I'd really, really like to see organisations doing this and I'm not aware of any that have done it in the wake of a data breach. And finally this one. I just can't see this data breach environment changing until there's enough incentivisation for organisations not to do it. The primary organisation or the primary penalty that organisations have at the moment is the risk of the threats from PCI. And that's why we saw those messages about payment cards. They don't want to lose the ability to process payments and they're scared of getting fines and that causes them to respond in a different way. We need to see government penalties and it's going to be really interesting to see now with this news about the EU potentially finding organisations up to, is it 4% of their annual revenue? Potentially up to 4% of your annual revenue if you have a data breach. Now it's early days we've got to see how that actually works but that is an incentive not to get compromised in the first place and certainly to take it seriously if you do because what gets me is when we look at some of these recent breaches, things like VTech. Now VTech was only a couple of months ago and it had SQL injection. I'm pretty sure it had SQL injection because when you logged on and you looked at the response that came back, the response that came back in JSON included the SQL statement that was executed in the data. I just have no idea why you do that. Maybe someone was debugging and they thought, you know, it would be helpful. Let's see the whole thing. They definitely had direct object reference risks. They had no transport layer security. They had all sorts of other serious issues. They should get slapped with a fine. I don't know what jurisdiction it happens in. They're a Hong Kong based company. They sell all over the world. But they should get hit with something. Because how can a CIO, CTO today sit there and not be aware of the likes of TalkTalk and Ashley Madison, all these things? They know. And at no point have they said, maybe we should get someone who knows what they're doing to look at our app. They definitely haven't done that because it would have taken anyone about five minutes to find the risks. So I don't know how this works, but I think until they get penalties, we're not going to see a lot change. All right. So that brings me to the end. And that is our first talk. That is the Slido info. So you guys can post questions and things. Does anyone want to ask a question right now, what we're here? Topical? Or you can put it in the Slido. We can talk about it later. Yes? So SQLMap is actually really powerful. I'll show you a quick overview because this is something that we're doing this week in one of my workshops as well. But if we go to SQLMap.org and you have a look at all the stuff it can do, it's actually really, really extensive. The documentation, to be honest, it's a terrible documentation, but it just goes on and on and on and on. And what you can do in its most basic form is you can just point it at a URL and let it discover the type of database and then what the risk might be. You can also do things like get it to run Google searches and then attack the results. You can get it to extract just the schema. It will do error-based SQL injection, union-based SQL injection, blind Boolean SQL injection, blind TimeBase SQL injection. It will do all these different styles of attack. And for people that actually know how to use this and can sort of use it properly in anger, it's enormously powerful. But what we often see, and I'm going to give you a demo of this on my next talk. We see kids running Google Docs, so Google searches to find very specific things, copying the results, pasting it into SQL map. Do we get data? Yes. Well, now we'll leak it and then we'll make up a reason why they deserved it. There'll be a reason. I'll give you an example that way. And if they don't find anything, then they'll just move on to the next one. So the tools are very good at automating the process. The kids that are using it have got absolutely no idea how SQL injection works. It's all they know is they copy URL, they paste into the tool, they get data out. Yes. Good question. So I showed Trustify, which was making money out of the fact data was stolen. And you're asking, would they get into any legal trouble? One of the things Trustify did is they had a Reddit thread. And in the Reddit thread, they said, the reason we're not getting shut down is that we've got more lawyers than employees. True story. They then went through and they deleted all of their comments. But that was one of the comments. And in fact, it's in my blog post where I explained this is why they're probably not getting shut down. So basically, they were just fighting off DMCA takedown requests. And this is sort of one of the other curious things that's happening now. They're seeing the Digital Millennium Copyright Act, which is meant to stop copyrighted material from being distributed, used to try and take down publicized data breaches. Which is kind of, I don't think it's ever actually been tested in court, but it's kind of enough scare tactics that a lot of people do just take the data down. But in the case of Trustify, they just fought it with lawyers and said, no, we're not going to do it. Lawyers. Yes. So, I guess the question is at what point should you disclose a vulnerability? Like how far do you need to go to establish it? The argument from the likes of the two guys I showed is that they need to get data out of the system and they need to get volumes in order for the company to take it seriously. But the thing is, once you change an ID once and you get someone else's data, and let's just ignore how you did that or why you did that. But for whatever reason, you mistyped the URL, for example, and you got someone else's record. That's the point where you contact the company privately and you say, funny thing happened today while I was browsing the web. Because that alone demonstrates the risk and all that did by sucking all the other data out is it made impact, no doubt about that, but then they ended up in a huge amount of trouble. Even things like SQL injection, yes, it is a really impactful thing to give the organisation the data that you've exfiltrated from the system, but that's going to make it really, really hard for you to stay on the ethical side of the disclosure. So for me, as soon as I find that there is a risk, and again, you've got to be careful about how you discover it as well, because a lot of things like SQL injection, they take constant probing in order to find the risk. So you might find something and disclose it, but if you've found it by hammering away at their system in an unauthorised fashion, then that could be a problem. This is also another reason to have bug bounties. I really like the idea of bug bounties, and I really like the idea of services like bug crowd. And what these guys do is that they run bug bounties for organisations. So you can say, I'm an organisation, I would like it if someone finds a vulnerability that instead of dumping all the data publicly, they send me an email and we fix it privately. And maybe we give them a thousand bucks for it. Thousand bucks isn't much compared to the cost of public disclosure. So this sort of thing allows people to find vulnerabilities and report them to you because they're incentivised to do it. So I really love this idea as well. Any other questions? All right, so I think we're running just a little bit over, but what do we do, Jacob? Do we have a break? Okay, and 15 minutes? Awesome. Okay, thanks everyone. Thanks everyone.
 I'm going to start my presentation without the screen because otherwise we might be waiting  here for quite a while.  So let us have a look at this.  So what I want to talk about today is I run this service called Have I Been Poned.  Does anyone use Have I Been Poned?  Who's using it?  Keep your hand up if you're in the data breaches.  All right.  Just the security guy.  Oh, one other guy.  What do you guys in?  Which ones?  Adobe.  Adobe.  Who's in Ashley Madison?  That's exactly what you say when your significant other says, were you in Ashley Madison darling?  No.  Ashley what?  So I was in, I was in Adobe originally.  I was in Patreon.  So Patreon for crowdfunding for fledgling artists.  I was supporting a guy who does a podcast about security where he talks about data breaches  and he asked me to sign up to Patreon in order to give him like $5 a month.  And then Patreon got hacked, which he got to talk about on the show because it all kind  of went round and round.  So I was in that, I was in a triple O web host as well.  So they had 13 million accounts which were leaked in about November.  13 million accounts or with plain text passwords as well, which wasn't, wasn't a real good  look.  But what's really interesting is a few months ago I realized as I was sort of going through  and getting these data breaches and loading them into the system is that I was seeing  some really, really interesting things.  So really interesting discussions with everything from the organizations getting breached to  the people trading the data to the hackers actually hacking into the system and even  to authorities.  Oh, we're getting somewhere.  So while it warms up, even having some interesting discussions with the likes of the FBI.  And I thought, let's make a really good talk because there's a lot of stuff that happens  behind the scenes, which people don't normally get to see.  And now I can actually show you what those discussions look like, which is good.  Now if you are interested in doing the Slido thing, that's what you need.  So Slido.com, I think there's an app and you need that number 1853.  And if you use that, then you can ask questions that are related specifically to this event,  which will work well.  So now getting into the original intention of the talk.  This is what I called it.  And this was some months ago and I thought, wow, 220 million.  Like this is a lot.  I'll do a talk and I'll call it what I learned from 220 million breached records.  And then while I was preparing the talk, I had to change the name of it because everything  changed again.  And suddenly it wasn't 220 million, it was 235 million.  So, okay, I changed the name of the talk.  And then a little bit more time went by and I had to change the name of the talk again.  And it was getting so many, I went, I can't put an exact number on it.  We'll just say a quarter of a billion.  And I think now it's actually 269 million.  I did this talk in London last week as well.  And since then, there's about another 10 million results in there.  So every time I go to do this talk, the thing changes.  But I think that's sort of kind of the point as well, right?  Everything is moving ahead really quickly.  So this is a system I mentioned, have I been pwned?  That's out of date.  There's two more data breaches now with about another 10 million odd records in there.  And if you haven't seen it before, it's very simple.  Data gets hacked, it gets published publicly, usually by the hackers.  I download it from publicly available locations and I make it searchable.  So you can go through and say, where has my account been exposed?  Which is kind of neat because then you see all the different places your information  gets leaked.  If it's a really sensitive data breach like Ashley Madison or adult friend finder, then  I make sure that you only get to find out if you're in there if you can receive an email  confirmation.  So you can't go and search for your significant other, your co-workers, your boss.  Although there are other companies that encourage you to do that and that's one of the things  I'm going to show you today.  So one of the things that's interesting when we talk about data breaches is the perception  of hackers.  And we get a lot of feedback via the media about what hackers are like.  It's kind of curious, you can learn a lot from Google.  If you go to Google images and you search for hacker.  Now this is curious because there's a trend here, right?  So hackers, and you see this on like every single newspaper, every single website that  talks about hackers.  What we know of hackers is they have hoodies, they have Guy Fawkes masks, they work a lot  in binary as well.  Curious fact.  There's also a lot of green.  And then some news stories, they sort of put all those things together and they go, this  is a hacker.  It's a Guy Fawkes mask with a hoodie with binary.  And this is like sort of the ultimate personification of what the hacker is.  Now we also see a lot of stuff about hackers in promotional material.  So a lot of companies making a lot of money out of the fact we get hacked and they want  to make a lot of, I guess they want to make people kind of scared.  So they do stuff like this.  This is a Kickstarter for a little application, a little device actually called Kujo.  And here's what they do in their adverts.  You may not know it, but you've probably already been hacked.  Thousands of hacking attacks occur each day.  Sounds scary, doesn't it?  Listen to the music.  You may not know it.  You've already been hacked.  And he's got a hoodie because he's a hacker.  But here's the interesting thing, right?  Like have a look at what he's typing into.  This is a zoomed in bit.  This is not a terminal.  This is a browser.  He's hacking in the browser.  And I want to show you how you can impress your friends and colleagues about how you  hack in the browser.  What you do is you go over to hacketyper.net.  Okay?  And what you also got to do is press F11 to put it in full screen because then it looks  pretty serious.  And then this is how you hack.  This is real.  You got a hacker type and you just hit keys.  And it does this.  I zoomed in on the code block and it is from hacketyper.  They are selling their device on the premise that a hacker is you can hacketyper to hack.  Anyway, there are all sorts of websites that do exactly this and all sorts of news articles  and things that basically prey on the fear of people by using resources such as hacketyper  basically just to scare people, which is kind of sucky.  Now this is the reality of it, right?  So this is the reality of who the hackers are.  This is Jake Davis.  He was 19 in that photo.  He was part of Lullsec in 2011 going around hacking lots of things.  Look at his mum.  How do you think his mum feels?  They're in court, right?  It's like a death stare.  He's so grounded.  He's really grounded.  But he did a lot of damage.  He's a 19 year old kid.  Another kid, same sort of deal.  Also in court, also with his mum.  His mum doesn't look real happy either.  But this is what happens, right?  It's these kids going around breaking into things and clearly making their mothers very,  very upset.  And the interesting thing about this is this is what hackers are normally like.  This is anonymous, right?  This is kind of the sophistication level of the people that are breaking into these systems.  And we kind of lose track of this a little bit.  And then we see the media and we see the scary hoodies and things.  And including when we see the bravado, the two kids in the previous shots were very much  talking about how powerful they were, how unbeatable they were, how they could break  into anything.  You know, very, very bravado sort of behaviour.  And clearly it didn't work out real well for them.  Now this was a really good example.  Did everyone see Talk Talk in the news just a little while ago?  So Talk Talk is an English telecommunications company and Talk Talk had a major security  incident.  So they had a whole bunch of data sucked out.  It was in the news.  It was in the news a lot in Australia.  So it must have been really, really big in the UK.  And after the attack, this detective came out and he said, okay, here's what it was.  It was Russian Islamic cyber jihadis.  That's terrifying.  It's like every single buzzword.  Is anyone here Russian?  Right, good.  So I get the impression that Russians are scary.  Like they sound scary.  So we got that.  Obviously in Islamic cyber jihad, he also sounds very scary as well.  So this was the news, you know, trying to get everyone scared about these Russian Islamic  cyber jihadis out there.  Now here's what it really was.  15 year old boy in his bedroom, because where else is he going to be, right?  If he's hacking away on computers.  So there was him.  There was also 16 year old boy, a little bit older.  And then there was this really, really old guy.  He was like 20.  This is the senior citizen of the hacking circles.  And the thing about it is that all these guys are the ones that broke into these systems.  It wasn't the scary Russian Islamic cyber jihadis.  It was just bored kids.  And very frequently when I get data from people and get communications from people,  I realize that it is just bored kids.  And they often turn into scared kids too.  I'm going to give you an example of that.  Now monetization is a really interesting one because people want to make money out of data  breaches.  You can go to online marketplaces and buy data.  You can buy credit cards.  You can buy social security numbers for people in the US.  You can buy dates of birth.  You can buy all of these different attributes online.  Elections are about a dollar each.  You can find these sites sometimes on the ClearWeb, very often on tour.  You open up the tour browser, you plug in a URL.  There's a marketplace.  The marketplace has sellers.  The sellers have ratings.  There are transactions.  There's feedback.  It's just a normal marketplace.  It is like eBay, but for data breaches, drugs, guns, all this sort of thing.  So all this sort of data has a value.  Now it's interesting when I see things like this.  So I get messages from people saying, I've got something I'd like to sell to you.  So in this case, the guy wanted to sell Nexus mods.  It was a forum.  I would like a sum of Bitcoin.  They're coming to me thinking I'm going to pay them money.  And of course I never do.  I go, okay, I'm not going to be part of your illegal activity and then document the whole  thing on Twitter as well because sooner or later your account's going to be seized after  you get caught if you're the one going around doing this sort of stuff.  Now curiously, since I created this deck just last week, someone did actually give me Nexus  mods.  They said, here you go.  We've been trading this in the underground forums.  You might find it useful for your site.  So eventually this sort of stuff turns up anyway.  Now there's another good example.  IPM offers a personal management.  This was a big breach in the US.  Have a look at how much they reckon it's worth.  More than 100 Bitcoin.  Bitcoin now at the moment is about 300 US dollars.  So maybe $30,000.  I don't know, like it's one guy on Twitter, but I've got other examples of the prices  these things are being sold of.  And when you think about it, the sort of data that was leaked about government personnel,  pretty sensitive info.  It's definitely got a price, probably a high price.  So this sort of thing comes up quite a bit.  This was after the triple O web host.  So triple O web host got breached.  It actually got traded quite significantly last year.  It looks like it got breached in about March and eventually I got the data via a journalist  later on in the year.  And I put a question on Twitter, very vague question.  Anyone have an account on triple O web host?  And this guy got in contact with me via direct message.  And this I found really interesting because he says the database is private and it's  better kept that way.  Now what he means by private is that someone had hacked into it and they were trading and  selling it between themselves.  That's what private was.  They didn't want it to be traded and sold or publicized by anyone else.  They wanted to keep it quiet.  And they want to keep these data breaches quiet because whilst they're quiet and the  victims don't know about it, the victims can be exploited.  Once the victims know that triple O web host is hacked and the password they use there  has been exposed and remember it's plain text stored in plain text.  So no cryptography whatsoever.  Same password they use on other accounts.  Once the victims know the value goes down.  He also said this, selling for upwards of $2,000 right now.  I can't understand which moron would be considering just giving you a copy.  Maybe a moron with a conscience could have been that.  Because this is the thing like basically what he's saying is we are going around exploiting  the people that were compromised in this data breach.  What moron would want to stop that from happening?  Like this is the level of sort of ethics and morality of a lot of the people that are dealing  with this data.  Now triple O web host was also for sale on other sites.  This is a site that sells that sort of data.  You can see it sells a few different things here.  Triple O web host was selling for $1,500 at the time that this particular incident broke.  In fact, just before it went public.  Another guy said $2,000 triple O web host here $1,500.  After I made it public and there was also a long lead into this where I was trying to  get in touch with the company.  They wouldn't respond and eventually we made it all public.  After it went public it went from $1,500 down to $200.  Because suddenly the value goes right down.  So whilst it's private and the victims don't know about it, they can exploit the victims.  Once it's public and the victims know it goes down.  Then it went down even further.  So it's now wiped off 90% of the value, which I'm kind of happy about.  We have screwed the market for this data breach, which is good.  We don't want it being monetized in that way.  Here's another good example of monetization.  So this goes back to Ashley Madison again.  And when the Ashley Madison breach happens, so we go back to July.  And in July hackers come out and they say we have broken to Ashley Madison.  We have all the data either shut the site down or we're going to dump it all publicly.  And of course they never shut it down.  They were never going to shut it down.  So it did go public.  It went public in August.  And after it went public, a bunch of companies started monetizing the data.  Now in the case of a data breach, there are things that can be legitimately monetized.  People are scared.  They need things like identity theft protection.  It's not a bad thing to have anyway, let alone after a data breach.  But then we had companies like this, trustify, who took the data and the data was really  broadly torrented.  It would take any of you about five minutes to find that data and then about five hours  to download it because it was pretty big.  Five hours on Australian broadband speed, maybe half an hour in Norway.  But the data is really easily available.  So companies were downloading it and then creating services that made money from it.  So what these guys are doing is saying, hey, check if you've been exposed.  And this is not dissimilar to what I do with Have I Been Poned.  The difference is Have I Been Poned is all free.  People go in there.  I don't make any money out of the fact that the public can do that.  But what happened here, these guys allowed you to search for anyone.  And then after you searched for them, they sent an email to the person you're searching  for.  So imagine this.  You've got a wife suspicious of a husband.  And this was the gender split.  There's no gender equality in Ashley Madison.  It was almost all guys and fembots.  So fembot is basically just computer code which engages in discussion.  In fact, they'd even call them engages.  The engages would get them in to chat and pay more money to stay on there because they  think they've got a chance of meeting a girl who is not their partner, who they're meant  to be married to because the whole thing was meant to be about having affairs.  So anyway, you've got this situation.  Both searches for her husband gets an immediate confirmation on the screen that the husband  was in the data breach.  Husband gets an email.  He's not the one who searched for it, but he gets an email.  So the first, the husband knows of him being in the data breach is when he finds out that  someone is actually searching for him in the data breach.  Imagine that.  So sort of suspend your moral judgment for a moment, regardless of how you feel about  adultery.  The very fact that his privacy is violated in this way where anyone can go and search  for him and now he's getting an email, could have been his boss searching for him.  And he gets an email.  And of course, what they're trying to do here is solicit business.  They're trying to sell private investigation services so that this guy can get his data  removed from the internet.  And that's what they're trying to do, get your data removed from the internet.  How likely do you reckon that is when it's been torrented nonstop around the world?  Never going to happen.  So they did that.  That line was shitty.  They also did this.  After you searched for someone and then you found them, there were social icons that allowed  you to tweet that you'd found them.  Now this is bad, but you can almost understand it insofar as, yeah, I found my ex-husband,  you know, screw him.  But what about this?  I found my friend.  These were preloaded social messages.  This wasn't the person going, I'm just going to type in.  I found my friend.  Trustify presented you with the buttons so that you could say, I found my ex.  I found my friend.  You can search too.  They're encouraging other people to go through and search and find their ex and find their  friend.  And the privacy implications of this is just sort of mind blowing.  It seems that once that data goes out, it's like, you know, all bets are off.  You can do whatever you want with it.  So they were making money in a really, really underhanded sort of way.  And they eventually did reverse quite a bit of this.  They got a lot of pressure, a lot of public pressure.  I wrote something, which is where I got some of those screenshots from, saying how bad  it was.  And then they started getting death threats.  Like that's how the community reacted.  They got some really, really nasty messages back.  Fortunately, none of them got killed as far as I know, which is, I wouldn't want to feel  partly responsible for that.  But it gives you an indication of just how bad this was perceived by the community as  well.  I mean, on their behalf, just a really poor reading of the market and how people respond  to these incidents.  So that was that one.  The other thing that came out of Ashley Madison was stuff like this.  This is a ransom email.  Now, you ever think about it, a bunch of you are probably developers, security professionals,  you're used to writing scripts and things.  How hard would it be to just enumerate through a great big file and do a mail merge?  Because this is all it is.  It's a mail merge.  It's a ransom message, but it's also got a little bit of spearfishing to it because  it's got information that is very particular about the victim, their name, their address,  the last four digits of their credit card number.  If you got this and it's asking for five bitcoins as well, that's a lot.  That's like $1,500.  And if you don't do that, they're going to let your Facebook friends know and your boss  know and all that sort of thing.  Now of course, the thing about all this is that if you didn't pay, nothing ever happened  because this is just like a random send 30 million odd emails to everybody and then some  people will pay a fractional 1% will pay and that will be a good earn for the 99.  Whatever percent that don't pay, nothing happens.  But what some of these messages were saying is they're saying this Bitcoin address is  unique to you.  And I had a lot of people email me because I wrote a few things that got a lot of press.  These people would email me and they'd say, please don't share my Bitcoin address.  I don't want anyone else to know.  So I'd Google it and you get all these results from all these other people saying, I just  got this ransom message.  So the Bitcoin address was not unique.  They were not tracking payments.  There was no recourse if you didn't pay.  But they're scaring the hell out of people and these are still going on today.  So we're like five, six months on and these messages are still going out to victims because  they're so easy.  It's just sending email.  Now one of the other things that I found very interesting when I thought about the experiences  with Have I Been Poned is how I actually find data breaches.  So where do I get these things from?  And there's not one answer.  They come from multiple different places.  So a good example is often I'll get a message like this.  So this is how I got the triple-O web host data.  This guy sends me an email and says, hey, five months ago, this was in October, so back at  about March or something, I've got this data.  Would you like a copy of it?  And in fact, what he said is he said, I'll give you the 2 million version.  So there's actually 13 million.  I'm going to give you the 2 million.  Sends me a mega link.  So megakim.com, his service.  Often people share data breaches via mega because it's very easy to upload the data  to there.  They upload it anonymously.  It's on a great big obfuscated URL.  If you don't have the URL, you're not going to find it.  Very, very easy for them to distribute data that way.  So he sends me this and do not give me any credit for this.  So what he's actually saying is he doesn't want anyone to know that it was him who had  the data.  And I'll show you a follow-up message from him in a moment.  He had actually sent me the 13 million version.  So I got the full data set.  And this was kind of the first we knew of it back in October.  I'm 99% sure they don't know they got hacked, too.  They didn't know.  They had no idea.  And I tried really, really hard to get in touch with triple-O web host.  I sent multiple email messages.  I went through their ticketing system.  I had people respond to me on the ticketing system because I'm saying, look, I've got  a serious security incident.  I want someone to talk to give me security contact because I don't know who's manning  the help desk.  You know, some low-paid worker on the other side of the world and an outsourcing center.  Is that the person I want to give information on this to?  Anyway, eventually when we found we couldn't get in touch with them, that's when it went  public.  But with this guy, later on, after it got a lot of press, because once it did go public,  the media picked it up and the stories were all over the place.  I got this, and when I read this last line in particular, I'm afraid they would still  look for me.  It sounds like a scared kid, right?  It's probably the same sort of kid as what we saw on those earlier photos.  Some kid in his bedroom in Northern Ireland or wherever who's just been handing this  data around.  And what struck me with it is I don't think that they are aware of the ramifications of  what they're doing.  They're sitting there in the comfort of their own bedroom and they're sharing this information  around, having chats without any sort of sense of the real world consequences.  And then when it hits the media and it's all over the press and suddenly they go, holy  shit, look what I've done, I think that's when it hits home.  And they say, wow, this is actually real.  So I almost feel a little bit sorry.  I do feel a little bit sorry actually for a lot of these kids because they don't know  what they're getting themselves into.  They don't know what's the actual real world ramifications of what they're doing.  Other ways data comes to me.  Just a pretty good example.  So this guy just here is saying he wants to know what his password is.  And one of the curious things that I'm finding with data breaches now is that after a breach,  the victims of the breach really want to know what their data was, what was exposed.  And this is kind of natural, right?  Like I have just had personal information exposed.  Tell me what it is.  So I want to know what it is.  And I get heaps and heaps and heaps of emails like this.  I end up having to write a blog post which basically says, no, I can't share data because  I can't respond to individual requests, go through, try and find their data, then try  and send it to them in a secure fashion because often it's passwords and things I don't want  to be emailing.  But this happens all the time.  Now after I told him I couldn't share it, he was, you know, sad face, which I understand.  But I would really like to see organizations making this available.  And I'm talking about this more at the end as well.  But to me, it seems to be their responsibility.  You lose the data, you're responsible for telling people what you've lost.  Not in one generic message, we're really, really sorry, we lost your things.  But this is exactly what we lost.  This was the name you had, the password you had, the credit card details that got exposed.  It's public anyway, it's doing the rounds.  The company should just tell them.  It's another way data comes to me.  So this was someone who sent me some data about a Dutch financial institution.  And what I find interesting about this particular picture is the fact that it's a console window  with SQL map.  So the guy has basically sent me an email and said, hey, I've got some data you might  be interested in.  I'll show you the discussion we had after this in a moment.  But basically what he's done is he's gone, like he's literally, he's hacked into it using  SQL map, which is an automated tool, you can see part of the command line up there.  You basically run SQL map, pass a use switch with the URL that you want to hack.  There's a few other parameters.  You go outside and play.  I shouldn't, that's what they do.  And you come back and it's got all the data out.  It's really, really, really simple.  So he's pulled all this information out of the system and then said, hey, here it is.  And I said, okay, well, what I think you should do is you should disclose it privately to the  company.  You should let the company know that they have a vulnerability because you're at this  point now where no one actually knows about it.  You know, once you make it public, it's like there's no going back.  Now it's public and you're going to get yourself into a lot more hot water as well.  So I said, disclose it privately.  And he said, what's private disclosure?  Like it just never crossed his mind that maybe he should get in touch with them and say,  hey, you've got a vulnerability.  And even after I said that, he's like, okay, well, do you still want the data?  No, go to your room, think about what you've done.  Don't do it again.  This is often the way with the kids, right?  They're not thinking about the real world ramifications.  So ultimately I said, okay, I'm not going to go and take this data.  I'm not going to publish it.  You need to get in touch with them privately.  And in fact, what happened in this case is I got in touch with some Dutch security people  I know, let them know they got in touch with the organization that was impacted.  There was a small amount of news on it, but basically the data never went public.  I hope they actually let their customers know because it is their customers on the previous  screen.  But the whole thing ended up being a lot quieter than what it could have been otherwise.  There's another good example of where I get data from.  So this is a public website.  It is it's on the clear web.  This is not a tour hidden service.  You can just type in the URL, go here and start downloading data breaches.  It's that simple.  This data is floating around the web everywhere.  This is just one site of many that are on the clear web.  There are many more on tour hidden services.  And it's not even entirely clear why they run this.  I mean, he's asking for Bitcoin donation.  Maybe he gets a few Bitcoin thrown at him every now and then.  But it goes on and on and on.  There's about 25 records per page and there's about nine pages as well.  So maybe a couple of hundred different data breaches just sitting here publicly searchable,  publicly downloadable.  And this is what some of them do.  So another way I find data breaches.  Often we'll see information leaked on Payspin.  Payspin is a really popular means of leaking info because it's very, very easy just to  go and create a paste, put whatever you want in it.  It's anonymous.  There's no authentication.  There's no sign up.  And then you share the URL.  And Payspin in their terms and conditions say you shouldn't be sharing data breaches or  things like this.  I don't think they're quite as explicit as like you shouldn't be sharing other people's  sense of information.  But I don't think they mean it because it happens all the time.  And they probably make the argument of look it's just a service.  People can use it for good.  They can use it for bad.  But this sort of stuff happens a lot.  And what we often see is stuff like this where this guy's going, okay, here is part one of  the triple web host data breach.  So people recycling the data breaches now.  Go and get the full thing at triple web host dash leak dot blogspot dot com.  So you can get the whole thing.  So you go to get the whole thing and you end up somewhere like this.  And then it goes, okay, there's part one and part two.  Download this one first.  Go over here.  So you go there and you got to fill out a survey, right?  So now we're starting to see the monetization because all of this sort of crap earns people  fractions of a cent every time people go through into the survey.  So you go, okay, I'll download.  All right, so now I got to do this.  I got to go back.  I got to do another survey.  And then it takes you to here.  And now I got to do another survey so that I can get a gift card for $100.  Guess what?  You don't get a gift card for $100.  And normally I get about to here and I go screw it.  Like you guys are just trying to make money out of it.  So again, it's the monetization thing.  They're trying to trick people into going through and filling this stuff out with the  promise of getting breached data.  Just all the different ways this data is recycled and reused are kind of fascinating.  Now this is another problem that I often have, which is that data is leaked and someone says,  here it is.  It is the, for example, the triple-O web host data breach.  We want you to publish this data.  It's serious.  We hacked it.  And I've got to try and figure out if it's legitimate or not.  Because a lot of the time when I see this data, it's not legitimate.  And there's a few different ways I can do this.  So I can do things like Google some of the hashes.  And if I find that the hashes in the data breach appear in many different other places  under the names of other data breaches, well, it's probably not going to be real.  But there's a few different ways that I do verification.  So here's one good way.  Now this is actually Madison again.  So again, back in July, when we first heard they'd been hacked, but the data hadn't been  leaked, one of the things I found quite fascinating about actually Madison is everyone got really,  really upset, assuming everyone who was in the data breach got upset when that news came  out.  They said, oh, no, now people can discover that I was on the site.  I thought, well, this is curious.  I wonder if you can discover if they're on the site anyway.  So I went to the password reset page and I said, OK, well, I'm going to put in an invalid  email address and let's see what happens.  Came up and said this.  And when I saw this, I thought, OK, this is pretty good because if we look at the piece  in bold, it says if that email address exists in our database, you receive an email to that  address.  And I thought, OK, that's good because it's non-committal, right?  It's not saying, yes, you had an email and we've just let you know as opposed to no,  you don't have one.  Adult friend finder, by the way, who was breached in May, four million records, they still do  that today.  You can go to adult friend finder, put in an email address and it will tell you explicitly  whether it exists or not exists.  So they leak the presence of every person on that site via an enumeration risk.  And curiously, just a little tip, if you are going to sign up to one of these sites, don't  use your normal email address.  Don't use your working email address.  Make something up.  Do not use your dot gov address.  There are a lot of dot gov addresses in these things.  And you could say that someone else signed you up until your payment records are leaked  as well.  And then it's really, really hard to make that argument.  So this is what they're doing.  They're going, OK, if you had an email address we're going to, or if you had an email in  the system, we're going to send it to you.  Sounds good.  Now, this was invalid.  Let's have a look at the message when you did have an email address in the system.  You see any difference there?  It's not subtle, is it?  So I wrote about this and I said, look, you can find out anyway.  That way, why are you getting all upset?  I mean, I know why you're getting upset, but you could always do this anyway.  So I actually made us and fixed it and I thought, that sounds like a challenge.  I wonder if there is another way of finding out whether accounts actually exist on the  site or not.  So I went over and I did this.  I thought, what I'll do is I'll log on 25 times, but what I'll do is I will use a valid  account for research purposes.  Number of times I said that to my wife.  She's walked in.  What are you doing?  Research.  I do a lot of research.  Anyway, so I tried to log in 25 times, valid email address, invalid password, and I timed  it.  OK?  Looks like this.  It's a reasonable spread.  This is how long the HCTP response takes between issuing the request and getting a response  back.  Login fails.  Fine, but it's an invalid account.  Around about 500 to 600 milliseconds.  So then I said, OK, what happens if I take an account that does not exist on the system  and I try and log in with that?  That's curious, isn't it?  Anyone know what it does is?  Any guesses?  Doesn't hash the passwords.  Right.  So here's how it works.  Actually, often when I ask that, some people say, well, yes, because it's doing a database  lookup.  If your database lookup for an account takes 500 milliseconds, you have a different problem.  It shouldn't be taking that long.  So here's what happens, right?  Ashley Madison used Bcrypt with a Work Factor 12.  They screwed it up really, really badly, and we later found we could get basically 90%  plus of the passwords out anyway.  However, they were using Bcrypt Work Factor 12, so a fairly heavy workload in the hashing.  And what happens is when you provide a valid email address, regardless whether the password  is valid or not, valid email address, it goes to the database and it says, get me the record  for this person.  The record comes back with the salt and the salted hash, and then the new password gets  added to the salt and everything gets hashed.  And because it was a high Work Factor algorithm, it took several hundred milliseconds.  When the account doesn't exist, the application goes to the database that says, get me the  account for this email address.  The database comes back with nothing, and the app says, well, now I don't have to hash.  So this, from an efficiency perspective, is really good.  But from a disclosure perspective, we have this.  So things like enumeration risks are one way that I verify data breaches.  And if I can pick three random email addresses from a data breach, plug them into the password  reset, and it confirms whether the account exists or not, I've got a really high degree  of confidence that that data is legitimate.  Now three people are going to get password reset emails, three people out of a breach,  in this case, of 30 million.  I'm not feeling too bad about that because now they've got bigger problems.  Now they've had all of their data leaked publicly.  And it's taken me three emails to figure that out and then let potentially millions of people  know what's happened.  Because millions of people do find out whether they find out by notifications on my Heavobain  Pone service or whether they watch the news.  You could not miss the news on Ashley Madison.  Here's another good one.  So this is Strat4.  Strat4 was an intelligence agency.  They did reports for, particularly for governments, on things like the political landscape of certain  countries.  And they got hacked in 2011, and they had all of their data leaked.  They went kind of offline for a little bit.  And they had to sort of send this message and say, look, we're hacked by an unauthorized  party.  Everything got suspended for a while.  I want to show you what that data breach looks like and a really easy way of verifying that.  So again, this is a data breach that did get circulated pretty broadly.  Looks like this.  It's a pretty sort of typical structure here.  It's just common delimited.  User IDs, names, passwords, emails.  These are the passwords.  They're all MD5 hashes.  Just straight MD5 hashes.  No encryption.  No salt.  Nothing else.  Just very, very simple.  So the way I'd verify something like this is I'd search for hashes.  And I thought, well, maybe one of the ways we can do this is I'll make it interesting  and I will search for a.gov.  Find someone with the.gov address and I'll take their hash.  And then I'll go to Google.  And Google is really good at cracking hashes because you can search for a hash when it's  not salted because the salt adds randomness that should be unique for every record.  But when it's just a straight hash, you can go and search for Google and you can often  find the plain text version.  So this was the strat for data breach.  And that was one of the hashes.  First government official hash.  Now what do you reckon the password was?  Stratfor.  Who would do that?  Who would sign up on a website called Stratfor and use the password Stratfor?  But see, this is verification for me.  OK, this hash was a password which is likely to be used by those people.  Now what I could then do is I could turn my zoomer on because you're going to need to  see this one closely.  One of the things I found curious is I thought, OK, well then how many people might have actually  used that same password?  Because once we're actually talking about a case where it's just a straight hash and  there's no salt, we can do this.  We can go back into here.  We can do a find and we can do a count for that hash.  How many hashes do you reckon we're going to find?  You got 12,000 people.  There are 860,000 records in the breach, 12,000 people use the password Stratfor on the website  Stratfor.  Now that Stratfor all are a case because if it was Stratfor with a capital S, the hash  should be completely different.  So we'd inevitably find a whole bunch of people did that as well.  So again, going back to the point of this, from a verification perspective, these are  the sorts of ways I try and figure out is this data breach legitimate or is it fabricated?  The other thing I started doing recently is this, because what I've realized is I have  got a really good repository now of people that are interested in the Have I Been Pwn  service.  So I've got a little notification service.  You can sign up for free, you put your email address in, you get an email, it says you've  signed up for notifications.  Are you sure you want notifications?  And you click a link to say yes, so it verifies you and it's done.  I've got about 330,000 people that have signed up for this.  So what happens now is when I have a new data breach that I can't verify using the means  I just showed you is I start emailing subscribers.  So good example, VTech.  VTech is a Hong Kong based toy maker.  In October, November period, a reporter emailed me, a reporter I'd worked with before and  he said, I've been given a data breach.  I want you to help me verify it.  So I got the data breach and I couldn't find anywhere on their website to go through and  do like a password reset.  There was nothing in the data breach that would allow me to do stuff like easily googling  hashes, they were salted hashes.  And what VTech actually did is they made tablets for kids.  So think about like an iPad but it's all plastic and colourful and things like that.  And you could give it to your kid and then the kid's mate could have one as well and  then they could chat via the magic of the internet.  So a lot of parents didn't realise these kids are chatting in different houses.  It goes by the internet.  You just put your kid's details on the internet.  And this is what was in the data breach.  Four million adults with names, email addresses, physical addresses, phone numbers, 280,000  kids with name, gender, age, average age is five years old and a foreign key to the parents  record.  So if you had this data you could basically decide what child would I like in a convenient  location and find them.  I didn't get the photos but the attacker later also gave the report of photos because  the tablets had a camera.  You take your photo.  There's kids, 280,000.  Later on after this all blew up VTech said it wasn't 280,000 kids, it was six million.  Shit.  That was a lot.  But anyway, verification, because you signed up via a tablet and the tablet talked to an  API I couldn't see an easily accessible interface anywhere where I could check things like password  resets.  So I did this.  I took the email addresses from the data breach and I found the most recent 20 subscribers  to have I been pwned.  So people that were thinking about the service recently and I sent them this email and I  didn't tell them what the service was or where it was.  I just said, hey, look, would you help verify this?  And I had about half the people respond and I'd get messages back like this.  In fact, this is what I sent to the person.  So one person came back and said, yes, I would like to know what the incident was.  So I would send them a piece of information or three pieces of information which would  give them a degree of confidence that it was their data without being too sensitive.  So when did you first log in?  It's not too bad.  Where were you located?  And your ISP.  And your ISP from the IP address.  This poor lady was in talk talk and VTech.  She was really impressed when she emailed back.  But, you know, like this is not sensitive data, but it's enough to have a pretty high  degree of confidence whether it's legitimate or not.  And she came back and said, yes, that's accurate.  And that gives me a high degree of confidence for one person.  And then I had about six actually come back and ultimately verify their data.  So what I'm finding is that how I've been pwned becomes a really, really good verification  channel.  I actually get feedback from the individuals in the data breach before I make anything  public that yes, it was actually legitimate.  So that's been really useful.  This is also really interesting.  The way the organizations respond when these incidents happen.  And you probably see, if you read the news, a really broad range of responses.  But a lot of them are kind of like this.  This is the first thing a lot of companies say, don't worry about your credit card.  Now put this in context.  Ashley Madison, a site designed for you to have affairs.  If your wife finds out, she might leave you.  You may never see your children again.  Like really, really bad things are going to happen, life changing things.  But don't worry, your credit card's fine.  Same here.  This is in VTEC.  Your children have been leaked.  People know where to find them.  They know what they look like.  They know their names.  Don't worry, credit cards are all right.  What are you worried about?  And inevitably what we're doing here is we're trying to placate PCI.  These organizations are worried that they're not going to be able to process credit card  payments anymore.  Their first concern is keeping the payment card industry happy, which is just really  bad.  It's just something that absolutely stinks about this.  So we often see these really evasive sort of messages focusing on things that ultimately  are in the company's best interest.  I've got many, many examples.  I wrote a blog post a while ago where I showed this.  Initial responses focus on credit card data.  Who's had their credit card defrauded before?  Wow.  You guys are lucky.  I'll only refute you.  I wrote something where I talked about this and I said, look, who really cares about the  credit card?  Because if it gets compromised, your bank gives you fraud protection.  They give you the money back.  The next week, and I'm sure it was coincidental, but the next week my wife's card was defrauded.  We found out on a Monday morning we went into the bank.  The bank canceled the card.  We had the money back in the account by the end of the day.  We had a new card in the mail at the end of the week.  The greatest inconvenience of the whole episode was that we had to change some of our direct  debits, which were trying to debit the old card number.  That's what credit card theft means today.  A bit different for debit cards, but credit cards, for me, is a consumer.  It's kind of a non-event.  This was a really good response.  So Patreon, who I mentioned got hacked earlier on, Patreon did a number of things really  well.  So they did things like they stored all their passwords in Bcrypt with the Workfactor 12.  They did something else that I have never seen any other company do in a data breach,  which is that they encrypted the personal identifiable info.  They encrypted addresses.  They encrypted other aspects of your personal info that other companies never do.  Not only did they encrypt it, but they managed not to lose the private key when they did  get hacked, because that's the other trick, right?  You can encrypt.  It's no good if your key gets disclosed.  So they actually got it right.  When I like this message, it came from the CEO.  What I like down here at the end of the third line, I am so sorry to our creators.  He's actually apologetic.  A lot of companies, the first thing they do is go, evil cyber hackers.  These evil cyber hackers, it's illegal.  They rant and they rave and they get angry at the people that breach them without focusing  on the fact that they screwed up.  And yes, they are evil cyber hackers and they should have legal recourse.  They probably should end up in court if not jail, but those companies, companies like  AvidLife Media that creates Ashley Madison, VTech, really, really screwed up.  VTech in particular did terrible things with their app design.  It took me about 10 minutes to find out that I could create two accounts, log into one  and pull the data out of all the other ones.  Took me 15 minutes.  You know, and I'm not doing anything special.  I just say there's an HTTP request.  It has a number in it.  I wonder if I add one.  Could I get some different data back?  Yes, there you go.  Job done.  So, this from Patreon.  Patreon also said this, they went on to say we don't store credit cards.  All right, they have to keep PCI happy, but they also actually give some detail encrypted  with 2048 bit RSA key, no specific action required, and then they go on and they give  technical details.  So there's transparency.  And finally again from the CEO, another apology.  I sincerely apologize for this breach.  Like this I think is about as good as you can do with the breach message.  And they did screw up.  They had debug settings in a publicly facing environment that had access to production  data.  They screwed up.  They admitted it.  They gave the details.  From that we saw that they did those other things well.  They did the B-crypt well.  They did the encryption well.  They had a good message.  These things happen, but this organization was prepared for it and they responded in  the right way.  The other interesting thing that comes up is people often say a company gets hacked,  but then they get over it and they move on and there's no sort of long lasting impact.  It's not like their share price dives or anything like that.  And I find that curious for a couple of reasons.  Number one is that data breaches are expensive.  Very often data breaches lead to having to do things like provide identity theft protection  for everyone.  It's a very standard response.  Oh, we got hacked.  Identity theft protection.  There we go.  And that happens.  It ties up a lot of resources.  It damages brand.  It keeps services offline.  VTech had to take all their services offline after this incident happened.  I was in London last week and I went into to Hemley's, the big toy store, and there's  a massive VTech stand.  I was like, I'm going to go and ask them about how secure these things are.  And they didn't have any of the tablets in stock.  And it wouldn't surprise me if they were just not able to sell them at the moment because  the service is still offline.  Like their service.  It's like a ground up rebuild.  So it does have impact.  And I wanted to find some examples of where it actually has real impact.  So I looked at things like this.  Now this one is curious.  This was a few months ago.  Again someone sent me some data.  They contacted me via Skype and said I've got some data breaches.  But I didn't compromise and I believed the guy because we had quite a long chat after  that.  But I've had them through sort of trading with other people.  And one was called Nettela.  Nettela, not like Nettela, the thing you put on your toast.  And the other one was called Money Bookers.  And these were gambling sites.  And the data dated back, I think to about 2012, like it was quite old data.  And the interesting thing here was that now that those two organisations have been bought  by another company, and this other company was now responsible for it.  So Listed Company.  And the interesting thing is that we ended up sort of getting in touch with the company.  They responded really, really well.  I had quite a few chats with their security guys trying to figure out what was going on.  The company's called PaySafe.  And PaySafe, because they're listed as well, they have to disclose this sort of stuff.  Like they can't hide it.  They've actually got to take it seriously.  So they had to put out a press release about it.  And then this happened with their share price.  Now there's two curious things here.  So number one is that if you look at it on the aggregate, nothing happened.  Number two is they did lose 300 million pounds there.  300 million pounds just for a moment.  That's a lot of money.  300 million pounds.  They dipped in direct response to that incident.  300 million pounds.  That's like 20% of their share price.  If you had prior knowledge of this, before it hit the news and you wanted to play the  market, okay, it would probably be a little bit obvious, you don't normally play the share  market.  Well, you just had all these options out on something just before it dropped 20%.  But that did have a serious ramification.  And I wanted to show this because it shows that even though there might not be a lasting  impact, that's a lot of money.  300 million pounds.  Another good example.  This was a few years ago.  Associated Press had their Twitter account hacked.  Let's just be clear about the news here.  It wasn't Twitter being hacked.  It was AP having a shitty password or getting phished.  It was one of those two things, always is.  This is what the tweet said when they got compromised.  This did upset the market.  The market responded and the market did this.  That is some number of billions of dollars on the Dow Jones.  And again, on aggregate, like it all evened out, it was all good.  But holy shit, look at that.  That's hundreds of, that's just a massive amount of money.  So it does have an impact.  It might not be a lasting impact, but it does have an impact.  Out of that, many people would have lost a lot of money.  Many people would have made a lot of money.  This is the other thing that got a little bit interesting last year.  I had a phone call from a very nice American man from there.  And it was curious.  In fact, it started with an email.  So I got an email, the FBI would like to talk to you about one of the data breaches.  And I said, okay, fine.  We'll have a chat.  And they sort of wanted more information on the background about what was in there, what  had I found in investigating it.  It also leads to discussions with the Australian Federal Police, who are also very nice.  All of them are always very nice.  I hope they stay nice.  But when I thought about it, there are a few interesting things here.  And one of them is that often the likes of the FBI, the NSA, et cetera, are perceived  as being evil.  Evil in the respect of, particularly for those who are in the security industry, we see a  lot of news and things about how they're cracking down on people doing ethical things, disclosing  vulnerabilities, how they're basically out there to do things that invade our privacy.  And when I thought about it more, you know, one of the things about the likes of FBI,  Federal Police, any sort of government security or intelligence agencies is that we do want  them.  We want them stopping a lot of the sort of stuff we've seen.  I don't want things like AAA web hosts being hacked into and leaked all over the place.  I want them to catch the people that did that.  I'm not going to disclose who I've been talking to or violate private discussions, but I want  them to make sure these things don't happen.  We need these guys.  And I guess it's like everyday police on the street.  We want them there to keep us safe.  They play a really valuable role.  And it's curious when you look back at where there's been involvement that involve security  people and the press has taken it really badly, it's interesting to look at the details.  So for example, everyone remember this?  This guy, Weave, if ever you follow him on Twitter, he's, let's just say he's an interesting  character and leave it there.  But he identified a vulnerability with AT&T where he could pass and identify from his  iPad into one of their services and get back information about the account holder.  And the news here is sort of going, security research have found guilty of conspiracy and  you know, I'll get out of this.  I'll be okay.  You know, it was a real sort of beat up job.  But the detail of it was is that basically he found a direct object reference risk.  He could pass an ID, get a record back out.  And then just to make sure it wasn't an accident, he did it another 114,000 times and then gave  it to the press.  That shouldn't happen.  It's the same here.  He's an Aussie guy.  Happened with Australia first state superannuation, like our retirement plans.  He found a vulnerability, direct object reference vulnerability.  Found the risk just to make sure he did another 770,000 times, got all the data out and then  wondered why the police knocked on his door.  Police took away all these toys for a while.  As it turns out, it worked out really badly for first state super because basically it  showed that they had really gaping security holes and they were in negotiations.  So it cost them a lot of money.  But often when we see headlines like this, there's another story behind it.  And we want the FBI, the Australian Federal Police, everyone else who's playing those  sort of roles, we want them there to try and keep us safe from these sorts of incidents.  So it leads me to here.  Three things that I would really like to see change with the way data breaches are handled  and the way organisations respond.  So number one is this.  A while ago, it must be about two years ago now, Forbes got hacked.  Forbes had about a million records leaked.  It took them a week to let anyone know.  It took me less than 24 hours to let every subscriber to have I been pwned know.  This should be an easy thing.  You get hacked, you've got to let people know quickly.  Because otherwise you get all this speculation in the media, people are going, well, I don't  know what's going on.  Like, are my details compromised?  Do I need to go and get identity theft protection?  Is that funny credit card transaction as a result of this?  Like this should just be fundamental.  This is the other one and I reckon this is actually really important.  And it goes back to that earlier point of people start asking me for their data.  The organisation is the one that lost it.  If I'm able to obtain this data because it's been spread out all over the internet, then  surely they can obtain it and surely they can give it to their customers in a secure  fashion.  This should be fundamental and I'd really, really like to see organisations doing this  and I'm not aware of any that have done it in the wake of a data breach.  And finally this one.  I just can't see this data breach environment changing until there's enough incentivisation  for organisations not to do it.  The primary organisation or the primary penalty that organisations have at the moment is the  risk of the threats from PCI.  And that's why we saw those messages about payment cards.  They don't want to lose the ability to process payments and they're scared of getting fines  and that causes them to respond in a different way.  We need to see government penalties and it's going to be really interesting to see now  with this news about the EU potentially finding organisations up to, is it 4% of their annual  revenue?  Potentially up to 4% of your annual revenue if you have a data breach.  Now it's early days we've got to see how that actually works but that is an incentive  not to get compromised in the first place and certainly to take it seriously if you  do because what gets me is when we look at some of these recent breaches, things like  VTech.  Now VTech was only a couple of months ago and it had SQL injection.  I'm pretty sure it had SQL injection because when you logged on and you looked at the  response that came back, the response that came back in JSON included the SQL statement  that was executed in the data.  I just have no idea why you do that.  Maybe someone was debugging and they thought, you know, it would be helpful.  Let's see the whole thing.  They definitely had direct object reference risks.  They had no transport layer security.  They had all sorts of other serious issues.  They should get slapped with a fine.  I don't know what jurisdiction it happens in.  They're a Hong Kong based company.  They sell all over the world.  But they should get hit with something.  Because how can a CIO, CTO today sit there and not be aware of the likes of TalkTalk  and Ashley Madison, all these things?  They know.  And at no point have they said, maybe we should get someone who knows what they're doing to  look at our app.  They definitely haven't done that because it would have taken anyone about five minutes  to find the risks.  So I don't know how this works, but I think until they get penalties, we're not going  to see a lot change.  All right.  So that brings me to the end.  And that is our first talk.  That is the Slido info.  So you guys can post questions and things.  Does anyone want to ask a question right now, what we're here?  Topical?  Or you can put it in the Slido.  We can talk about it later.  Yes?  So SQLMap is actually really powerful.  I'll show you a quick overview because this is something that we're doing this week in  one of my workshops as well.  But if we go to SQLMap.org and you have a look at all the stuff it can do, it's actually  really, really extensive.  The documentation, to be honest, it's a terrible documentation, but it just goes on and on  and on and on.  And what you can do in its most basic form is you can just point it at a URL and let  it discover the type of database and then what the risk might be.  You can also do things like get it to run Google searches and then attack the results.  You can get it to extract just the schema.  It will do error-based SQL injection, union-based SQL injection, blind Boolean SQL injection,  blind TimeBase SQL injection.  It will do all these different styles of attack.  And for people that actually know how to use this and can sort of use it properly in anger,  it's enormously powerful.  But what we often see, and I'm going to give you a demo of this on my next talk.  We see kids running Google Docs, so Google searches to find very specific things, copying  the results, pasting it into SQL map.  Do we get data?  Yes.  Well, now we'll leak it and then we'll make up a reason why they deserved it.  There'll be a reason.  I'll give you an example that way.  And if they don't find anything, then they'll just move on to the next one.  So the tools are very good at automating the process.  The kids that are using it have got absolutely no idea how SQL injection works.  It's all they know is they copy URL, they paste into the tool, they get data out.  Yes.  Good question.  So I showed Trustify, which was making money out of the fact data was stolen.  And you're asking, would they get into any legal trouble?  One of the things Trustify did is they had a Reddit thread.  And in the Reddit thread, they said, the reason we're not getting shut down is that  we've got more lawyers than employees.  True story.  They then went through and they deleted all of their comments.  But that was one of the comments.  And in fact, it's in my blog post where I explained this is why they're probably not  getting shut down.  So basically, they were just fighting off DMCA takedown requests.  And this is sort of one of the other curious things that's happening now.  They're seeing the Digital Millennium Copyright Act, which is meant to stop copyrighted material  from being distributed, used to try and take down publicized data breaches.  Which is kind of, I don't think it's ever actually been tested in court, but it's kind  of enough scare tactics that a lot of people do just take the data down.  But in the case of Trustify, they just fought it with lawyers and said, no, we're not going  to do it.  Lawyers.  Yes.  So, I guess the question is at what point should you disclose a vulnerability?  Like how far do you need to go to establish it?  The argument from the likes of the two guys I showed is that they need to get data out  of the system and they need to get volumes in order for the company to take it seriously.  But the thing is, once you change an ID once and you get someone else's data, and let's  just ignore how you did that or why you did that.  But for whatever reason, you mistyped the URL, for example, and you got someone else's  record.  That's the point where you contact the company privately and you say, funny thing happened  today while I was browsing the web.  Because that alone demonstrates the risk and all that did by sucking all the other data  out is it made impact, no doubt about that, but then they ended up in a huge amount of  trouble.  Even things like SQL injection, yes, it is a really impactful thing to give the organisation  the data that you've exfiltrated from the system, but that's going to make it really,  really hard for you to stay on the ethical side of the disclosure.  So for me, as soon as I find that there is a risk, and again, you've got to be careful  about how you discover it as well, because a lot of things like SQL injection, they take  constant probing in order to find the risk.  So you might find something and disclose it, but if you've found it by hammering away at  their system in an unauthorised fashion, then that could be a problem.  This is also another reason to have bug bounties.  I really like the idea of bug bounties, and I really like the idea of services like bug  crowd.  And what these guys do is that they run bug bounties for organisations.  So you can say, I'm an organisation, I would like it if someone finds a vulnerability that  instead of dumping all the data publicly, they send me an email and we fix it privately.  And maybe we give them a thousand bucks for it.  Thousand bucks isn't much compared to the cost of public disclosure.  So this sort of thing allows people to find vulnerabilities and report them to you because  they're incentivised to do it.  So I really love this idea as well.  Any other questions?  All right, so I think we're running just a little bit over, but what do we do, Jacob?  Do we have a break?  Okay, and 15 minutes?  Awesome.  Okay, thanks everyone.  Thanks everyone.
Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_0_239.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_240_515.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_516_575.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_576_623.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_624_1019.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_1020_1271.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_1272_1475.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_1476_1631.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_1632_1787.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_1788_1883.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_1884_1943.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_1944_2159.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_2160_2255.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_2256_2351.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_2352_2423.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_2424_2639.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_2640_2687.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_2688_2891.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_2892_3107.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_3108_3575.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_3576_4895.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_4896_14255.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_14256_15491.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_15492_16607.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_16608_40607.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_40608_43835.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_43836_49319.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_49320_54371.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_54372_58523.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_58524_68027.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_68028_71927.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_71928_89411.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_89412_89471.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_89472_89639.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_89640_89711.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_89712_94067.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_94068_94163.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_94164_94247.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_94248_94667.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_94668_94823.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_94824_94871.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_94872_95039.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_95040_95255.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_95256_95459.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_95460_95543.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_95544_96299.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_96300_97223.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_97224_97295.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_97296_97475.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_97476_97715.png Lessons_from_220_Million_Breached_Records_-_Troy_Hunt-_Security_Day_2016_97716_97771.png