WEBVTT 00:00.740 --> 00:02.120 Hey, you know what time it is? 00:02.120 --> 00:07.430 It's time for us to take a look at ethical hacking in the headlines once again. 00:07.430 --> 00:13.010 And I wanted to talk to you about the Equifax breach of 2017. 00:13.550 --> 00:22.700 Why I picked this one is it is in the top ten list of just incredibly devastating attacks to an organization. 00:23.030 --> 00:30.710 You can only imagine Equifax is here in the United States, and they are the entity that is checking 00:30.710 --> 00:36.350 and maintaining and reporting on U.S. citizens credit. 00:36.650 --> 00:43.100 So they have an incredible amount of detailed, personal, identifiable information about individuals 00:43.100 --> 00:46.130 and their accounts with financial organizations. 00:46.400 --> 00:48.590 And yes, they were hacked. 00:48.950 --> 00:58.550 They ended up paying the largest fine in history for the attack taking place against all of our citizens 00:58.550 --> 00:59.390 information. 00:59.900 --> 01:01.580 So how did it go down? 01:01.820 --> 01:08.900 Well, one of the things that I think you're going to love here is it went down just like we described. 01:08.900 --> 01:10.580 It would go down. 01:10.880 --> 01:14.750 Attackers had a tremendous amount of time on their hands. 01:14.960 --> 01:21.740 So they were scanning the Internet, the Internet facing servers of Equifax. 01:21.740 --> 01:27.650 They were scanning those servers tirelessly looking for vulnerabilities. 01:27.920 --> 01:36.440 In the second step, you guessed it, they found a key vulnerability within the actual Equifax dispute 01:36.440 --> 01:37.160 servers. 01:37.430 --> 01:39.620 So these were public servers. 01:39.620 --> 01:48.590 Public facing users could go in and report a dispute on their credit history with Equifax. 01:48.590 --> 01:53.270 And those servers had the vulnerability that allowed the attackers in. 01:53.810 --> 02:00.890 Attackers immediately started obtaining dispute documents that contain the user's PII. 02:01.490 --> 02:04.910 But these attackers were not satisfied with this. 02:05.270 --> 02:10.130 They wanted the username information. 02:10.130 --> 02:17.330 They wanted Social Security numbers, they wanted the information that was in additional databases. 02:17.330 --> 02:25.460 So sure enough, the attackers, once they were in the dispute servers, they started doing additional 02:25.460 --> 02:30.470 levels of reconnaissance against additional servers and login credentials. 02:30.470 --> 02:33.500 And you guessed it, they were successful. 02:34.010 --> 02:38.960 Once they got in to the additional servers, they entered the phase. 02:38.960 --> 02:40.340 We knew what would happen. 02:40.580 --> 02:46.670 They began to cover their tracks and they covered their tracks very effectively. 02:47.090 --> 02:55.610 Equifax turned in documentation about this attack and admitted that the data extraction period lasted 02:55.610 --> 02:58.520 over 76 days. 02:58.940 --> 03:08.240 So they got in undetected, they covered their tracks, they maintained access, and then very smartly, 03:08.450 --> 03:17.270 they started to extract small amounts of data, only small amounts of data each day from 51 different 03:17.270 --> 03:19.010 Equifax databases. 03:19.310 --> 03:28.220 So they stayed in, they did very small amounts of data extraction, and they did this for week after 03:28.220 --> 03:33.500 week after week after week, over 51 different databases. 03:33.770 --> 03:40.010 So was the Equifax breach an example of hacking in phases? 03:40.280 --> 03:41.750 It most certainly was. 03:41.930 --> 03:47.990 And again, from a punishment perspective, the largest in U.S. history.