Having your personal accounts hacked can range from embarrassing to downright panic inducing,
but imagine how awful it would be to lose data worth billions of dollars.
This was exactly what happened to the United States Securities and Exchange Commission's
EDGAR system, which has been called the Fort Knox of America's financial sector.
EDGAR is basically a big database where companies file their financial statements
so that the government regulators can then have a look at the books.
Although EDGAR records are public, submissions aren't made public immediately, meaning that
if someone got their hands on statements early, they could use that information for insider
trading on the stock market. And that's exactly what happened in 2016. An international hacker
network took advantage of EDGAR's vulnerabilities by sending phishing emails to SEC employees,
and then used information that had not yet been made public to make over 4 million dollars in
profits off of early trades. But while the hackers were caught and forced to pay restitution,
the hack exposed some serious issues with the SEC's systems, including a lack of full encryption
and misconfigured firewalls. Not exactly confidence-inspiring for the massive banks
and other companies that assumed that the federal government could keep their information safe.
It was especially embarrassing considering that the SEC took months to discover the hack,
even after they had been warned for years that their security simply wasn't good enough.
But while the SEC might be forgiven a little bit for not being super familiar with cybersecurity,
we can't say the same for LastPass, one of the leading password management services.
Although the nature of their business makes them a prime target for cyber attacks, LastPass had a
breach in 2022 that went far beyond anything they had faced before. Hackers broke into a
LastPass engineer's laptop, which helped them conduct a second attack that then led to the theft
of encrypted passwords as well, as quite a bit of customer information that for some reason
LastPass was just storing as plaintext instead of encrypted data. This plaintext data included
URLs of the websites that customers were storing passwords for, meaning that hackers could decide
exactly which passwords to crack first, as banking sites would be more valuable to them
than, say, your password for fancfiction.net. Probably. And somewhat similarly to the SEC,
LastPass had previously been criticized for not storing all of its information in an encrypted
format. Even though LastPass stated that properly implemented passwords would take millions of years
to properly brute force, what made the situation positively silly was that this attack occurred
through an engineer's home computer, which was targeted because of a vulnerability in Plex of
all things, which the engineer also had installed. This is why you don't mix business with pleasure.
But as bad as the LastPass breach was, it still doesn't quite compare to the incident in 2021
that ended up being the biggest password breach of all time. Rocky 2021 leaked over 8 billion
different passwords, so well over one password for every human on earth. It didn't appear that
the passwords were the product of one single attack. Rather, the leak was a huge compilation
of passwords that were exposed due to multiple earlier breaches. All these passwords were combined
into a single text file of around 100 gigabytes in size. Although the passwords themselves were
already floating around in the dark web, having so many in one simple plaintext file would make it
very easy for attackers to use them for dictionary attacks, where software just automatically goes
through a list of all the passwords until they find one that hits. This is a great example of why,
even if you have a lengthy, difficult to guess password, you should be using two-factor authentication
any time it's offered. And remember that replacing an S with a dollar sign is neither secure nor
clever. Thanks for watching, guys. Like, dislike, check out some of our other videos,
comment with video suggestions down below, and don't forget to subscribe and follow.