EP25: The Impact of the 23andMe Breach: Protecting Personal Information Online

Speaker: 00:00:00

So by now.

2

: 00:00:01

You know that 23 and me.

3

: 00:00:03

Was breached.

4

: 00:00:05

And 23 and me is basically one of those

who am I related to ancestry type.

5

: 00:00:11

Services.

6

: 00:00:13

And it got breached because.

7

: 00:00:15

There were somewhat like 14,000.

8

: 00:00:18

People or accounts.

9

: 00:00:20

That had reused passwords.

10

: 00:00:23

And.

11

: 00:00:24

Whoever, whatever logged into those.

12

: 00:00:27

And then was able to use this DNA

family tree, something or other sharing.

13

: 00:00:32

And scrape a bunch of data

from, I don't know, 6.9 million

14

: 00:00:36

accounts, which is kind of a lot.

15

: 00:00:37

But you do have to wonder, like, I

understand that you log into these sites

16

: 00:00:41

and you've got to give away all this

PII, personally identifiable information.

17

: 00:00:46

I get that.

18

: 00:00:47

First of all, I don't know why you're

giving away to just check that out,

19

: 00:00:50

but I understand people do that.

20

: 00:00:52

Whatever.

21

: 00:00:53

But you're giving it away

to a private company.

22

: 00:00:55

And then they get breached

and all this data.

23

: 00:00:59

I get scraped now.

24

: 00:01:00

I don't think that whoever, whatever

did this is getting actual DNA.

25

: 00:01:04

That's not what it is.

26

: 00:01:05

You weren't giving DNA samples,

but you are giving away a lot of

27

: 00:01:08

information about who we related to.

28

: 00:01:11

Things like that.

29

: 00:01:11

That can be used later for really

good social engineering tactics.

30

: 00:01:15

And that's going to make.

31

: 00:01:17

That's going to make a huge difference.

32

: 00:01:18

And I don't know what the

ramifications of that are.

33

: 00:01:22

But the thing that's a little

bit disheartening is twofold.

34

: 00:01:26

One.

35

: 00:01:27

Quite a lot of cyber security community.

36

: 00:01:29

At least the pulse I got was well.

37

: 00:01:33

You know, basically it is the user's

fault because they're reusing passwords

38

: 00:01:37

and they shouldn't be doing that.

39

: 00:01:38

And.

40

: 00:01:39

Uh, while I agree that you should

not be reasoning passwords.

41

: 00:01:43

I completely disagree that

it's on the users to do that.

42

: 00:01:46

We're talking about.

43

: 00:01:48

P I.

44

: 00:01:49

And information.

45

: 00:01:50

This is not just some

news site or whatever.

46

: 00:01:53

This company had an

obligation to do something.

47

: 00:01:56

And what they're falling back on is the

definition of reasonable security, which

48

: 00:02:01

there really is no definition for that.

49

: 00:02:03

Right.

50

: 00:02:03

You could argue that, Hey, reasonable

security is username password.

51

: 00:02:06

Okay.

52

: 00:02:06

But there are so many

things they could have done.

53

: 00:02:09

From the start that they did

afterwards after the breach.

54

: 00:02:14

And this is about 10 things

and I got these 10 things from

55

: 00:02:17

chat GPT, my $20 subscription.

56

: 00:02:20

But I'm sure that they paid a lot of

money not to do any of these things

57

: 00:02:24

or be told that they should do these

and then said, okay, we'll do it.

58

: 00:02:26

And then never did.

59

: 00:02:27

One mandatory, mandatory,

two factor authentication.

60

: 00:02:31

They could have done mandatory

two factor authentication.

61

: 00:02:33

Now they did it after words, but

they didn't do it in the beginning.

62

: 00:02:37

I'm not even sure it was

an option in the beginning.

63

: 00:02:39

To be honest with you, I didn't

sign up for the services.

64

: 00:02:41

So I don't know.

65

: 00:02:42

But it's weird that they did it.

66

: 00:02:45

Much later.

67

: 00:02:46

And I think some of the excuses

were, well, it would stop people

68

: 00:02:50

from, you know, adopting as quickly.

69

: 00:02:53

As they normally would.

70

: 00:02:54

And I completely disagree.

71

: 00:02:55

Chat made me do two a Fe.

72

: 00:02:57

Now I am in tech.

73

: 00:02:58

So I'm going to adopt that anyway.

74

: 00:03:00

But if people are really interested in

their ancestry, which they were, and

75

: 00:03:03

that was something that was just so hot

three whatever years ago, they absolutely

76

: 00:03:08

would have said it to a Fe on their

phone to get past that, to continue on,

77

: 00:03:12

to figure out who they're related to.

78

: 00:03:14

There's just some things that are

not going to stop a user from doing.

79

: 00:03:17

And I think figuring out who

you're related to, when you're

80

: 00:03:20

really, really interested.

81

: 00:03:21

Setting up to a fire on your

phone is not going to stop you.

82

: 00:03:23

Advanced password policies, you know,

they could have enforced a strong

83

: 00:03:27

password policy mix of letters,

numbers, and special characters

84

: 00:03:30

and a minimum password length.

85

: 00:03:32

That most likely would have gotten

rid of the reuse passwords because

86

: 00:03:36

those aren't things that people

are going to remember necessarily.

87

: 00:03:39

Now they may, they may just say,

oh, I'll just use the same password

88

: 00:03:42

and I'll copy and paste it in there.

89

: 00:03:44

But it would have been

a little bit harder.

90

: 00:03:46

For people just to type things into a

box when you force them to do something.

91

: 00:03:52

Crazy now they may still

write it down somewhere.

92

: 00:03:55

But.

93

: 00:03:56

It may not be used in another

breach, things like that.

94

: 00:03:59

You also could check against

known password lists.

95

: 00:04:02

Like have I been poned to make sure,

oh, you can't use this password because

96

: 00:04:06

it's been found in a previous breach.

97

: 00:04:07

You need to use a new one, right?

98

: 00:04:09

Things like that.

99

: 00:04:10

Account lockout mechanisms so

they could have done, you know,

100

: 00:04:14

temporarily locked accounts, side

of number of failed login attempts.

101

: 00:04:17

Now what happened was

it's considered to be.

102

: 00:04:20

Brute force, but it was

really credential stuffing.

103

: 00:04:23

So they're just using usernames

and passwords that have been

104

: 00:04:25

reused in previous breaches.

105

: 00:04:27

So they weren't necessarily brute,

forcing to get into accounts like.

106

: 00:04:30

Trying someone's account

over and over and over again.

107

: 00:04:33

But before.

108

: 00:04:34

But credential stuffing

does fall under the us.

109

: 00:04:37

For brute force.

110

: 00:04:38

So you could have had account lockout.

111

: 00:04:41

Mechanisms, you don't know if

somebody tried these passwords in

112

: 00:04:45

the end, the user had changed them.

113

: 00:04:46

You could have locked it out and

seen a high number of lockouts,

114

: 00:04:49

which would be kind of weird.

115

: 00:04:51

Behavior analysts and machine learning.

116

: 00:04:54

That would have been nice if they

had behavior analytics like unusual

117

: 00:04:57

login patterns from unfamiliar

locations or multiple failed

118

: 00:05:01

login attempts, short period.

119

: 00:05:03

Uh, 14,000 people logging in, in a

short period of time, things like that.

120

: 00:05:07

Even if you didn't have to have

Fe enabled and I've had this on a

121

: 00:05:10

financial site where someone knew

my user and password shame on me.

122

: 00:05:14

But they knew that it was not

normal for me to log in there

123

: 00:05:17

and they locked my account.

124

: 00:05:18

So you could have had behavioral

analysts, uh, working on that and.

125

: 00:05:23

They did not.

126

: 00:05:24

You could have had a capture challenge.

127

: 00:05:26

The kind of lame for spam.

128

: 00:05:27

But it's possible that if they

were using an automate, well,

129

: 00:05:30

they were our, no, one's going

to sit down and do 14,000 logins.

130

: 00:05:34

If you'd had a capture challenge.

131

: 00:05:36

You potentially could have

blocked a lot of this stuff.

132

: 00:05:39

IP address monitoring and blocking.

133

: 00:05:41

Did they really use 14,000 different

IP addresses to log in in different

134

: 00:05:45

locations across the world?

135

: 00:05:47

Highly unlikely.

136

: 00:05:48

Therefore, if they were coming from

a VPN, you could have flagged that

137

: 00:05:51

and, and, and block that activity.

138

: 00:05:54

Which goes back to the.

139

: 00:05:55

Account lockout mechanisms where you're

seeing something coming in, you know, you.

140

: 00:05:58

Web application firewall sees that,

and you could have blocked that so they

141

: 00:06:02

could have done something like that.

142

: 00:06:04

Use your education and awareness.

143

: 00:06:05

Now nobody does this.

144

: 00:06:06

I mean, they do it internally, right?

145

: 00:06:09

But you could have encouraged your users

over time because this is a sensitive site

146

: 00:06:13

that they shouldn't reuse their passwords.

147

: 00:06:16

They should check if their email

address had been part of any data

148

: 00:06:18

breach, like have I been poned and

then use a different password, but no.

149

: 00:06:23

To be fair, no company does this, right.

150

: 00:06:25

You just sign in and they're not going

to educate you on security training.

151

: 00:06:28

That's for your employer to do.

152

: 00:06:30

Um, that could change though.

153

: 00:06:31

Uh, regular security audits and updates.

154

: 00:06:33

So somehow they got an ISO 27 0 1.

155

: 00:06:36

Aye.

156

: 00:06:37

Don't understand that.

157

: 00:06:38

And there's me give me much credit

that that's a useful search.

158

: 00:06:42

But they've had that for a while.

159

: 00:06:43

It could have been regular security audits

to updates and fix these kinds of things.

160

: 00:06:47

We don't know.

161

: 00:06:48

We don't know.

162

: 00:06:49

Uh, you don't know if that actually was

true and then no one did anything with it.

163

: 00:06:53

Who knows?

164

: 00:06:53

So I don't know about this one.

165

: 00:06:55

Multilayered security approach.

166

: 00:06:57

So defense in depth.

167

: 00:06:59

So firewalls intrusion, detection

systems, regular vulnerability scanning.

168

: 00:07:03

Now vulnerability scanning

wouldn't have helped this, but.

169

: 00:07:06

Honestly, you could have looked at, you

could have looked at the loss stuff and

170

: 00:07:09

you could have picked this stuff up.

171

: 00:07:10

And that was intrusion detection

systems may have flag that,

172

: 00:07:13

Hey, this is unusual activity.

173

: 00:07:14

You've got all these people

logging in from all different

174

: 00:07:16

places, all over the world.

175

: 00:07:17

And that's not normally

where they log in from.

176

: 00:07:20

Right.

177

: 00:07:20

If I'm from.

178

: 00:07:21

If I am from California.

179

: 00:07:23

And all of a sudden I'm logging in

from, you know, a different country.

180

: 00:07:26

Don't you think that's kind of weird.

181

: 00:07:27

I mean, it's not, it's not impossible, but

isn't it kind of weird that you'd want to

182

: 00:07:30

like, maybe prompt me for something else.

183

: 00:07:32

Like, Hey, you don't normally log in from.

184

: 00:07:34

Europe, maybe we should ask you

for some other thing, like your

185

: 00:07:38

two FFA, which they didn't enable.

186

: 00:07:41

And then of course encouraging

the use of password managers.

187

: 00:07:44

And promoting the use of password

managers to help maintain strong, unique

188

: 00:07:47

passwords for each of the online accounts.

189

: 00:07:49

Again, it goes back to the

user education awareness.

190

: 00:07:52

Nobody's doing that, right?

191

: 00:07:53

The people that are doing that at

the cybersecurity, people telling you

192

: 00:07:56

years using a password manager, right.

193

: 00:07:59

But.

194

: 00:08:00

If you want adoption to happen, sometimes

companies have to force adoption and

195

: 00:08:05

then everyone just starts doing it.

196

: 00:08:08

So if you want to have faith to happen.

197

: 00:08:11

Kind of like chat did at some

point, probably because they

198

: 00:08:13

had some kind of COVID incident.

199

: 00:08:16

You just force everyone to start

doing it and they're going to do

200

: 00:08:18

it because they'd rather use the

service to not use the service.

201

: 00:08:21

And so you force them to do that.

202

: 00:08:22

And it ends up being

something that they can do.

203

: 00:08:24

So when I, when I look at

these lists of things they

204

: 00:08:27

could have done, but didn't do.

205

: 00:08:28

It's just concerning.

206

: 00:08:30

And of course they've already,

they've already turned around and

207

: 00:08:33

blamed it on the user saying, Hey,

you guys used reuse passwords.

208

: 00:08:35

That's on you.

209

: 00:08:36

We have reasonable

security measures in place.

210

: 00:08:38

And if you're going to just, you know,

211

: 00:08:39

Reused.

212

: 00:08:40

His name is passwords and I,

there's not much we can do about it.

213

: 00:08:42

So that's, that's on you and I

completely disagree about disagree.

214

: 00:08:47

With that.

215

: 00:08:48

There's also the, it doesn't

fall under the HIPAA laws because

216

: 00:08:51

it's not medical information.

217

: 00:08:53

Right.

218

: 00:08:53

It's personally identifiable information,

but it's not medical information is

219

: 00:08:57

they're not actually getting DNA.

220

: 00:08:59

And then there's some other obscure laws.

221

: 00:09:02

That are going to say, well, they've

had this information, but what

222

: 00:09:05

exactly did they take that was used

against you that caused you harm?

223

: 00:09:10

Who knows man.

224

: 00:09:11

So.

225

: 00:09:12

And then they changed their terms of

service at the end that you had to.

226

: 00:09:15

You had to opt out so that you

couldn't do this class action lawsuit.

227

: 00:09:19

I had.

228

: 00:09:20

I forgot it had to be like individual

or something, but they kind of did

229

: 00:09:23

it right, right after Thanksgiving.

230

: 00:09:25

And they switched it and

gave you 30 days to opt out.

231

: 00:09:28

So, if you didn't opt out of

this and you opted in, then you

232

: 00:09:31

automatically opted into not being

part of some class action stuff.

233

: 00:09:35

So.

234

: 00:09:36

A lot of shady stuff, but you

know, it's an 85 cent stock.

235

: 00:09:39

My guess is that the lawyers on probably

both sides are gonna make a lot of money.

236

: 00:09:43

They'll go out.

237

: 00:09:44

They'll just file for bankruptcy.

238

: 00:09:46

They'll either stay in business

and just restructure or they'll

239

: 00:09:48

just completely go away.

240

: 00:09:50

Who cares?

241

: 00:09:50

It doesn't matter.

242

: 00:09:52

And then.

243

: 00:09:53

You the end user, you, the person

that was using this, you'll

244

: 00:09:56

just move on to something else.

245

: 00:09:57

Everybody got your data.

246

: 00:09:58

You're going to get nothing.

247

: 00:09:59

You're going to get some credit

monitoring for three years, right?

248

: 00:10:03

From another agency that was

breached that leaked all your data.

249

: 00:10:07

So, I mean, It's unfortunate

at the end, the end user here

250

: 00:10:11

is going to be like usual.

251

: 00:10:12

It's going to be the loser in

this, in this particular battle.

252

: 00:10:15

And.

253

: 00:10:16

You just have to start thinking if you,

yourself and your friends and your family,

254

: 00:10:21

you've got to just be better at security.

255

: 00:10:23

Use the tools that are

available on the site.

256

: 00:10:27

Most most major sites, maybe, obviously

not this one, but most, most major sites.

257

: 00:10:32

If you go to the number two.

258

: 00:10:34

F a.directory.

259

: 00:10:37

That's the number two F a doc directory.

260

: 00:10:42

You're going to see all

the different sites.

261

: 00:10:44

This is not, you know, this is not a

hundred percent, but you're going to

262

: 00:10:47

see a lot of sites and how to set up

to a Fe on all these major accounts,

263

: 00:10:52

all your social media, your email.

264

: 00:10:55

You should just have an

authenticator app on your phone.

265

: 00:10:58

They're free.

266

: 00:10:59

You should just go set up to a Fe

as much as you can just do, make a

267

: 00:11:03

goal, like one a day or something.

268

: 00:11:06

And just don't be that low hanging fruit.

269

: 00:11:08

Right.

270

: 00:11:09

Even if you reuse the username

and password, if you had

271

: 00:11:13

to have a, on your account.

272

: 00:11:15

That would not happen now.

273

: 00:11:16

In this case, there was that DNA,

whatever sharing kind of thing.

274

: 00:11:20

So even the PR even these poor people

that maybe really did have really long

275

: 00:11:25

and complex passwords and super secure.

276

: 00:11:27

The person that they were connected

with, obviously got hacked and then

277

: 00:11:30

their information gets scraped too.

278

: 00:11:32

So this goes back to one of

the thoughts that I had is.

279

: 00:11:36

You've got to assume a breach

mentality and it doesn't matter

280

: 00:11:39

how safe and secure you are.

281

: 00:11:40

If the place that's holding your data.

282

: 00:11:42

Isn't right.

283

: 00:11:44

So.

284

: 00:11:45

Again, you could have had to have Fe

you could have had a really strong

285

: 00:11:49

password on this particular site.

286

: 00:11:51

But because somehow in the backend,

somebody opted into this DNA sharing

287

: 00:11:55

or family tree sharing, and maybe

you were, or were not involved in

288

: 00:11:59

that your information gets scraped

because you're connected with

289

: 00:12:01

someone who's completely insecure.

290

: 00:12:03

And this is one of those rare use

cases, I guess you could say, but.

291

: 00:12:06

He just got to adopt better security

practices and this gets worse over time.

292

: 00:12:11

And identity theft is real and

identity theft is real painful.

293

: 00:12:15

And the simplest thing

you can possibly do.

294

: 00:12:18

The simplest thing you can possibly do.

295

: 00:12:21

Is freeze your credit.

296

: 00:12:23

Online.

297

: 00:12:25

For free.

298

: 00:12:26

At the major credit bureaus.

299

: 00:12:27

And what that does is that gives

you an additional pin code.

300

: 00:12:32

That you must use to log into

those agencies, additional pin

301

: 00:12:36

code, long pin code that you log

into those additional agencies.

302

: 00:12:40

That you can then unfreeze your credit.

303

: 00:12:43

For a certain thought, whatever you want

to call it for a certain period of time.

304

: 00:12:46

And then it gets frozen again.

305

: 00:12:48

And what that means is if somebody

has all my information, they can go

306

: 00:12:51

get a loan for a house or a car or

whatever, and they're gonna apply for

307

: 00:12:54

a loan and pretend that they're me.

308

: 00:12:57

When they go to run those credit checks.

309

: 00:12:59

Those those companies won't be able to

get a credit check because they're going

310

: 00:13:03

to say, oh, it looks like, you know,

Experian or TransUnion or whatever.

311

: 00:13:07

Is, um, They're not,

I'm not getting it back.

312

: 00:13:09

You're going to need to go and freeze

that and that person, that thing is not

313

: 00:13:12

going to have that pin code that you

set up and therefore you're not going

314

: 00:13:15

to have a loan outstanding in your name.

315

: 00:13:18

And this goes for kids too, which is odd.

316

: 00:13:21

But.

317

: 00:13:22

If you think about it, if your children

get their credentials stolen as well.

318

: 00:13:27

Whatever.

319

: 00:13:27

A person could theoretically get alone and

you wouldn't even really know about that.

320

: 00:13:32

You know, till much later it'd be

18 years later that your child's

321

: 00:13:35

credit has been used by somebody

and they have terrible credit.

322

: 00:13:38

Right.

323

: 00:13:39

I mean, there's all these possibilities.

324

: 00:13:41

People always talk about,

oh, you can get this thing.

325

: 00:13:43

That will monitor your credit

and do all this kind of stuff.

326

: 00:13:45

And you pay yearly fee and why.

327

: 00:13:48

Why.

328

: 00:13:49

You just go lock your credit.

329

: 00:13:51

The three major.

330

: 00:13:52

At the three major.

331

: 00:13:54

Credit unions.

332

: 00:13:55

You get that?

333

: 00:13:56

Pin code.

334

: 00:13:57

And that's it.

335

: 00:13:58

And then it's easy peasy and you know

what it, yeah, it'll stop you temporarily

336

: 00:14:03

from applying for credit cards online.

337

: 00:14:06

But.

338

: 00:14:06

You still, it's not hard to unfreeze it.

339

: 00:14:09

It's quick.

340

: 00:14:10

You can put a time limit on it.

341

: 00:14:13

It's not a big deal at all.

342

: 00:14:14

And in fact, you still get

the promos and bonuses.

343

: 00:14:16

I had my, I have my credit frozen.

344

: 00:14:19

And I wanted some.

345

: 00:14:20

Airline credit card.

346

: 00:14:22

And I went and applied for it.

347

: 00:14:24

And of course it said, Hey, it

looks like your credit's frozen.

348

: 00:14:27

So we're not able to do

this at this online for you.

349

: 00:14:31

But we're going to send you a met,

you know, mail and then you can

350

: 00:14:35

actually call in and blah, blah, blah.

351

: 00:14:37

And when I did actually call in,

I said, Hey, I need to unfreeze my

352

: 00:14:40

credit so I can get this promotion.

353

: 00:14:42

I just want to make sure

I'm still going to get it.

354

: 00:14:43

And they said, oh yeah, you're still

gonna get it because you applied for it.

355

: 00:14:46

During the promotional period, just

because the promo closes and you haven't

356

: 00:14:51

done it online or whatever you still got.

357

: 00:14:53

So I just on frozen my credit,

they were able to check online.

358

: 00:14:56

Yep.

359

: 00:14:56

And then they went ahead and did

it, and I still got the promotion.

360

: 00:14:59

So.

361

: 00:15:00

If you are worried like, well, if this

is a window and I want to get this thing.

362

: 00:15:04

B you still applied during that time.

363

: 00:15:06

And just because your credit's

frozen doesn't mean you're not

364

: 00:15:09

going to still hit that window.

365

: 00:15:10

It just, it just takes a few,

you know, a couple more days.

366

: 00:15:13

So I'm going to send you a piece

of mail and some number that you

367

: 00:15:16

have to call in for them to do

an additional verification check.

368

: 00:15:19

So it's not a big deal.

369

: 00:15:20

But people act like it's a big

deal and it's a huge hassle.

370

: 00:15:24

And I'm telling you the hassle is going

to be when you get that identity theft.

371

: 00:15:27

Uh, happens to you or your kid.

372

: 00:15:30

That's going to be a hassle for you.

373

: 00:15:32

So you're going to want to go out and,

you know, Get better security hygiene.

374

: 00:15:36

It's not that hard to do.

375

: 00:15:39

It really isn't.

376

: 00:15:40

You get an authenticator

app and a password manager.

377

: 00:15:43

Easy peasy.

378

: 00:15:44

You go to that to F a that's

number two F a.directory, and

379

: 00:15:47

you just do one thing day.

380

: 00:15:50

And he locked down all

your social media accounts.

381

: 00:15:52

You locked down your email

accounts and things like that.

382

: 00:15:56

And that just stops you from

being that low hanging fruit.

383

: 00:16:00

So I hope this has been an

informative podcast for you, and I

384

: 00:16:03

hope you weren't part of the breach.

385

: 00:16:04

Um, it's unfortunate.

386

: 00:16:06

But, you know, 20, 24 is just

starting and I'm sure there's plenty

387

: 00:16:09

more breaches where that came from.