How Hacks Happen

Black Friday, the day after American Thanksgiving, is traditionally one of the biggest holiday shopping days of the year. But hackers aren't going to take a holiday--they'll use Black Friday as an opportunity to try and scam you. If you get a text about an order or a gift card, don't tap the link! Instead, go to the retailer's site and see if there's a message for you. Let's all have a holly jolly holiday season with no scams!

You've heard of Bitcoin, but how does it work, and why are so many people talking about it? Let's talk about blockchain--the tech behind Bitcoin and other cryptocurrency--in plain English, including hashing, a key part of blockchain technology. We'll also talk about why people invest in cryptocurrency.

Resources for this episode
Development of blockchain:
"A Peer-to-Peer Electronic Cash System" by Satoshi Nakamoto: https://bitcoin.org/bitcoin.pdf
Rising Bitcoin value:
https://www.businessinsider.com/bitcoin-surge-means-laszlo-hanyecz-paid-316-million-two-pizzas-2021-3
The fascinating original forum conversation about the pizza buy: https://bitcointalk.org/index.php?topic=137.0
https://www.theguardian.com/technology/2015/dec/09/bitcoin-forgotten-currency-norway-oslo-home
https://cointelegraph.com/news/satoshi-nakamoto-s-bitcoin-white-paper-is-now-a-13-year-old-teenager
Bitcoin accepted as currency:
https://cointelegraph.com/news/el-salvador-president-bitcoin-law-will-be-approved-tonight
https://www.buybitcoinworldwide.com/who-accepts-bitcoin/
Losing the key:
https://www.wired.com/story/i-forgot-my-pin-an-epic-tale-of-losing-dollar30000-in-bitcoin/
https://www.wired.com/story/wired-lost-bitcoin/
https://www.cnbc.com/2021/01/15/uk-man-makes-last-ditch-effort-to-recover-lost-bitcoin-hard-drive.html
https://medium.com/luno/where-do-lost-bitcoins-go-7e8dd24abd0f
How blockchain works:
https://www.guru99.com/blockchain-tutorial.html
https://www.investopedia.com/terms/b/blockchain.asp

If anyone--the IRS, the electric company, the police--calls you and asks you to buy a prepaid Visa card or a gift card to pay your bill over the phone, it's not who you think it is. They'll tell you to scratch the numbers off the back and read them the numbers. This is a ploy by scammers to get money from you. Don't fall for it! 

This tip was inspired by a recent real-life story of a phone scam that terrified a woman in the San Francisco area: https://www.sfchronicle.com/bayarea/article/phone-scam-therapists-16483251.php

Hackers operate off of fear. They'll call you with an urgent problem: Your bill is overdue! Pay now! But if they don't know your name, social security number, or anything else about you, it's a scam. Hang up and be satisfied that you thwarted yet another hack.

Support the show (https://www.patreon.com/howhackshappen)

In July 2015, a very polite group of hackers called The Impact Team stole the data of over 30 million users from Ashley Madison, a website for cheating spouses, and threatened to dump it all over the dark web if the site wasn't shut down. The site stayed up, and the data went out. Learn about how hackers worldwide have used the data to blackmail users, the denials (and eventual resignations) of Ashley Madison executives, and the many clues, including the hackers' unusual level of politeness, that point to certain culprits.

Resources

• Pastebin notice of July 20: https://pastebin.com/ZGXmk8R9
• Krebs on Security report on breach: https://krebsonsecurity.com/2015/07/online-cheating-site-ashleymadison-hacked/
• Suicides attributed to Ashley Madison breach:
• https://money.cnn.com/2015/09/08/technology/ashley-madison-suicide/
• https://www.bbc.com/news/technology-34044506
• https://toronto.citynews.ca/2013/11/10/woman-hurt-typing-fake-profiles-for-dating-site-20m-suit-alleges/
• https://krebsonsecurity.com/2015/08/ashleymadison-500k-bounty-for-hackers/
• https://krebsonsecurity.com/2015/08/who-hacked-ashley-madison/
• https://krebsonsecurity.com/2015/08/was-the-ashley-madison-database-leaked/
• https://grahamcluley.com/ashley-madisons-leaked-database-available-download-read-this/
• https://grahamcluley.com/ashley-madison-fake/
• https://www.businessinsider.in/tech/the-strange-rise-and-sudden-fall-of-noel-biderman-the-former-ceo-of-ashley-madison/slidelist/48716152.cms
• https://www.priv.gc.ca/en/privacy-topics/business-privacy/safeguards-and-breaches/privacy-breaches/respond-to-a-privacy-breach-at-your-business/gd_pb_201810/
• https://www.wired.com/2015/08/happened-hackers-posted-stolen-ashley-madison-data/
• https://grahamcluley.com/ashley-madison-wives-receiving-blackmail-letters/
• https://grahamcluley.com/ashley-madison-slammed-with-1-6m-fine-for-data-breach/
• https://grahamcluley.com/ashley-madisons-leaked-database-available-download-read-this/
• https://digitalguardian.com/blog/timeline-ashley-madison-hack
• "American Kingpin": https://www.amazon.com/American-Kingpin-Nick-Bilton-audiobook/dp

Let's look at the impact of credit card fraud, and talk about how they're stolen, and what you can do to keep your data safe. Jiggle that cover, man!

Resources for this episode:

• Credit card safety: 8 tips to help keep you safe: https://www.zdnet.com/article/how-hackers-stole-millions-of-credit-card-records-from-target/
• Verizon 2020 Payment Security Report, available from https://www.verizon.com/business/resources/reports/payment-security-report/
• History of credit cards: https://www.creditcards.com/credit-card-news/history-of-credit-cards/
• Credit card safety: 8 tips to help keep you safe: https://bettermoneyhabits.bankofamerica.com/en/credit/credit-card-protection

Say No to the NSA! Until the mid-1970s, the National Security Agency held an iron grip on all research into computer-based cryptography in the USA. In this episode, we talk about how the NSA squashed all public research into cryptography in the 1950s and 1960s, but loosened its grip to work to develop the Digital Encryption Standard (DES) with IBM. Then, in the 1970s, mathematicians Whitfield Diffie, Martin Hellman, and others went head-to-head with the NSA to make cryptography available to us all. Their research, and their courage, forever changed the face of modern cybersecurity.

Resources:

• Truman original memo regarding formation of NSA: https://www.nsa.gov/Portals/70/documents/news-features/declassified-documents/truman/truman-memo.pdf
• NSA American Cryptology During the Cold War 1945-1989: https://www.nsa.gov/Portals/70/documents/news-features/declassified-documents/cryptologic-histories/cold_war_iii.pdf
• Crypto: How the Code Rebels Beat the Government - Saving Privacy in the Digital Age: https://www.amazon.com/Crypto-Rebels-Government-Privacy-Digital/dp/B092RLYFTR/
• Paper: "A Mathematical Theory of Communication" by Claude Shannon:  https://people.math.harvard.edu/~ctm/home/text/others/shannon/entropy/entropy.pdf
• J. A. Meyer letter to IEEE in July 1977: https://cryptome.org/hellman/1977-0707-Meyer-letter.pdf

Support the show (https://www.patreon.com/howhackshappen)

When consumer reporting agency Equifax was breached in 2017, the records of over 140 million people (more than half the adults in the USA!) were stolen. Three years later, we take a closer look at the mistakes Equifax's security team made, how hackers leveraged a compromised Equifax web page to gain access to logins, passwords, and dozens of additional databases, and how they got the stolen data out of Equifax's network through a flawed router setup. We wrap up what you can do to keep yourself safe from identity theft as a result of this and other breaches. 

Resources for this episode:

• Website where you can check if your identity was compromised in the Equifax breach
• Business Insider: Literally everyone should be thinking about suing Equifax. September 2017.
• U.S. House of Representatives Committee on Oversight and Government Reform: The Equifax Data Breach. December 2018.
• CHINESE PLA MEMBERS, 54th RESEARCH INSTITUTE - The fellas charged with the Equifax breach, now on the FBI's wanted list.
• United States Government Accountability Office Report to Congressional Requesters