Security Confidential S14 E7 Troy Hunt

Manoj Tandon: Hello everyone, this is your host, Manoj Tandon. Welcome to another episode of Dark Rhino Security: Security Confidential. Today we have another Rockstar guest who really doesn’t need an intro, but we will give him one. He is Mr. Troy Hunt. A lot of you who are listening probably know him well or have heard of him. He is the creator of Have I Been Pwned. He’s been in numerous publications, from Forbes to Time Magazine to Mashable to ZDNet. I mean, he’s trying to do the world a lot of good in cybersecurity. And then when he finds some spare time, what you guys may not know about him is that he is a windsurfer, a snowboarder, and a tennis player. So, with that, thank you, Troy, for being here. I really appreciate you gracing us with your presence today. That’s fantastic. We’re looking forward to it.

Troy Hunt: Yeah, thanks for having me.

Manoj Tandon: So, we got to start off with, you know, I tell you, the origin story thing is a time-honored favorite here, and everybody loves to know how someone got started. It’s really unique in that, in our industry, we’ve not yet found any cookie-cutter ways of how people got into cyber, or cybersecurity, or InfoSec. So please, tell us a little bit about how you got into this world and what happened.

Troy Hunt: Yeah, and you know, I think that’s one of the fascinating things about this industry: people are from so many different backgrounds. I almost feel like mine’s a little bit more predictable because I came from a software background. I was a software developer since sort of—even pre-Doom days. I got on the web in ’95 and started building software.

And then I ended up having a bunch of roles, probably most notably, I was at Pfizer for 14 years. Initially doing software development, and then I looked after our application architecture for Asia Pacific. And during that time, we sort of went through this shift, like many companies do, where they start saying, “All you technical people are expensive; we’re going to outsource you.” I believe the term was “unburden,” which really makes you feel valuable.

I became the person managing the vendors who were doing all the outsourcing, and we would outsource to the cheapest possible markets around Asia Pacific. You’ll never believe what sort of software came back when you do that.

Manoj Tandon: Oh, I believe it. I’ve been in that business before.

Troy Hunt: Oh, it’s like opening a fortune cookie; you’re not going to know what’s going to happen. I’m still healing.

Anyway, so we’re going through this process and I just kept getting back just egregiously bad software—everything from the user interface to the performance to, of course, the security. I think there was a little bit of me that just started to enjoy pulling it apart. It’s like, “How bad is this? What can we find here?” So I really started to enjoy the security aspects of it.

Particularly around this time—the late 2000s—I started my blog in 2009. I found that there wasn’t a lot of good content for Microsoft .NET developers around security. So I started writing blog posts when I’d see bad security. I couldn’t say, “Hey, Pfizer got this bad software,” but I could say, “Here’s the anti-pattern; here’s the fix.”

There was a lot of appetite for that. Developers were like, “Oh, this is useful.” I’d write about SQL injection and explain how it actually works, not just how to fix it.

And then I started looking more at data breaches because they were fascinating. They give you a view behind the curtain of how systems really work. That was the beginning of Have I Been Pwned. I thought, “How many people don’t know they’ve been in a breach?”

Manoj Tandon: Well, and you know, it’s sad to say, but even today there are some people who have stored passwords in plain text.

Troy Hunt: Yeah, and one of the things I hoped with Have I Been Pwned is that if you do bad things in your code, eventually it comes out. Ashley Madison was a perfect example—we learned fascinating things about how that business worked because all the dirty laundry was exposed.

Manoj Tandon: So Have I Been Pwned wasn’t originally commercial—this was a public service?

Troy Hunt: Yeah, absolutely. It started as, “This might be fun.” I like building things. But also, I wanted to experiment with Microsoft Azure, which was new at the time. I needed something cheap and easy to build.

It scratched multiple itches: building something, answering whether people were breached, and demonstrating cloud capabilities.

Manoj Tandon: I’ve used it in presentations myself. It’s a great resource.

Troy Hunt: Awesome. It’s amazing where it shows up—even law enforcement uses it for education and outreach.

Manoj Tandon: Is this mostly just you running it?

Troy Hunt: Mostly, yes. I started the whole thing; it was 100% me until a few years ago when my wife started getting involved in it. So she basically does everything that she can, and then I do the things that only I can do. She’s not technical, but she comes to a lot of my talks, she learns, and then we have a guy in Iceland. We’ve got another Microsoft Most Valuable Professional, a friend we know really well, who devotes some development cycles.

But we do also have revenue streams as well, which was never the intention. But we’ve got product placement from 1Password on the front of the website, because I think that’s the best possible thing you can do if you find yourself in a data breach: go and get a password manager and stop reusing your passwords. We do have some subscription services as well, and that is allowing us to reinvest and build it into a larger, more sustainable thing.

We’ve put a lot of effort in this year, in particular, into completely rewriting the data tier to be much more sustainable. We really didn’t have a good backup and disaster recovery story until now, and we’re just about to flick over to something that will allow us to restore to points in time, or geo-replicate, or do all the sorts of things that you really need such an important part of the internet to be able to do. But you can’t do it without money either.

Manoj Tandon: Yeah, well, that’s fantastic. Glad to hear that you guys are going down the sustainable route and that you’re going to be around for many, many years to come because it is a great service.

For people who are listening—I don’t think anyone that’s listening to this show doesn’t know about it—but if they do go on there, the amount of data that’s available is a wealth.

And I guess let’s start with passwords here. You brought up password managers. So the first question that comes to mind for me is: is there any value at all to—well, let me restate this—is there any practical value, not mathematical value, to forcing a length of a password and forcing a password change at an X period of time, given the amount of email-password combinations that… I mean, everyone’s done it. I’ve been guilty of it. Everyone has done it. So is there any value to doing that, or would we not just be better off saying, “You know, my password is cat1, cat123, cat1234”? At least it’s different, so if it gets pwned, it’s only getting pwned in one place.

Troy Hunt: Yeah, well, you know, I think the right question is: what is the right level of impost to impose on people around password strength and criteria?

Now, if you have no rules whatsoever, you will get “cat1” and you’ll get “abc123.” You will get all that sort of stuff, because we know that empirically from the data. This is what I was saying earlier on: the data is this fascinating glimpse into not just the way a system works, but the way people work.

Some of the very early writing I did was around, “Hey, look at this, here’s like the Stratfor data breach and the Gawker data breach, and isn’t it interesting when the same person is in both, a huge proportion of the time they have the same password?” You know, what are the chances?

So, I think people, just by human nature, will defer to the path of least resistance when they’re creating accounts on a website. I mean, they just want to get in there and buy their t-shirt or have that extramarital affair, whatever it is that they’re on the website to do—that’s their priority, and they’re trying to lower that barrier to entry.

So you can’t have an entire free-for-all. But then on the other end of the spectrum, as a website operator, you’ve got a business; you need people to come and sign up and you want to make that as easy as possible, because you need to pay developers and servers and marketing. So I think we’ve got to recognize that there are these sort of misaligned objectives sometimes.

A good example: sometimes people say, “Well, what you should do is never allow someone to choose their own password; you generate a random string for them, and that way there’ll never be password reuse, there’ll never be credential stuffing attacks.” And I’m like, “Yeah, and then there’ll never be customers, right?” Because people hate that.

So the question needs to be: where in the middle of those two extremes is the right balance? First thing I’d say is I’d argue that this is very dependent on the nature of the service and the demographic of the people using it. If you’re building a service for the great masses who may not be technical at all, and the impact of account takeovers is fairly minimal, your approach might be different to if it is the password rules for your own employees, and you’re also giving them multi-factor tokens and all the rest of it.

But as a general rule of thumb, arbitrary password complexity criteria is out the door because it leads to very predictable patterns. You know, there’s no good having someone create a password of “password” and they just capitalize the “P” and put an “@” symbol instead of the “a” and a zero instead of the “o.” There is no value in that.

And NIST, back in about 2017, came out and said, “Look, let’s get rid of that and start looking instead at things like known bad passwords from previous breach corpuses.” If a password has been in a data breach, that’s a pretty strong sign it’s no good.

So one of the things we built in Have I Been Pwned was a feature called Pwned Passwords, where we’ve got hundreds of millions of passwords from data breaches and the prevalence with which they’ve been seen. You can query that via an API model and then block the person from using the password if it’s bad enough. That service gets hit just over 8 billion times a month at the moment from services trying to stop bad passwords from appearing.

And then your other point here was around mandated password rotation. We’ve seen so many times, “Every 90 days, please rotate your password.” And then we all—and as you said, we’ve all done it—I did this at Pfizer because I had that policy—we all take that number at the end and we add one and we go, “Job done, box moved on, next problem.”

And of course, that’s a very predictable pattern. It is security theater. Part of that guidance from NIST more than half a decade ago was to stop doing that. There are other things that we can do that are much more resilient to the sorts of attacks that we’re worried about. The landscape has changed as well; we’re worried about password compromises because back in the day we used to have a lot of unencrypted transport layers. We don’t have that anymore. We’ve now got user behavioral analytics, we’ve got multi-factor, we’ve got all of these other ways of making accounts more secure that don’t require us to do things that just upset customers and really don’t work very well anyway.

Manoj Tandon: So I guess… do you think that there’s enough awareness in the market that people would pay for some kind of a premium security feature on these websites?

Troy Hunt: Well, if you look even if you just look at password managers—and of course, password managers can be free and they can be low cost—the only constant barrier to a password manager is just having to learn something that’s a little bit different. After that, your life is much easier anyway because password managers are so much easier than typing in even your “cat” password. They’re a wonderful thing, and the adoption rates are single-digit percentages.

So clearly, the challenge is not just awareness. Because I defy you to ask anyone, “Is it a good idea to use the same password everywhere?” Everyone goes, “Oh no, I’ve heard you’re not meant to do that.” “But do you do it?” “Yeah.”

Okay, why? “I’ll get a password manager, but it seems like hard work.”

Now, of course, all of this is until they’re in a data breach that actually impacts them, and then suddenly they’ll do anything in the world to try and make the problem go away and they’ll change their behaviors.

But evidently, because of those single percentage adoption rates, people are not sufficiently motivated to make that change. And I think we’re pretty much at where the status quo is now, until the technology moves along enough and things like passkeys become viable enough for the masses that we start to move away from the password problem.

Manoj Tandon: Yeah, I don’t know that… see, this is just my experience: convenience versus security. Convenience wins every time. Nobody wants to be bothered with it.

But I think the problem at hand is so serious because our digital identities are tied to so many critical and non-critical services. Our email address might be the same one that we use to log into our physician’s office website. And that email address might have been pwned, and likely the password there has been pwned as well.

Our email identity has become almost synonymous with, in many ways, like our driver’s license or our passport. You can replicate another human being through open source. I mean, there’s no rocket science involved with this. If you are a target of being replicated, you can be cloned in digital space and then someone can use your identity for nefarious purposes. And there are, unfortunately, a lot of examples of that.

Troy Hunt: Well, you know, the way I think about it is your email address is the primary key to digital life. That is the one thing that joins you across all the platforms—with the exception being people that use sub-addressing or catchalls on domains and things like that. We are a very small percentage; in fact, I know how small of a percentage we are: about 0.3% of everyone. So, one in 300. It’s really low.

I think Apple—I want to say they published—you know, they have the ability to… now, I’m tongue-tied there… the emails, you know, anonymized.

Manoj Tandon: Yeah, I haven’t had my cup of coffee yet, and I need another cup. But the adoption rate on that feature is fairly low.

Troy Hunt: Well, you know, I was looking at a dataset just yesterday and I was seeing a few more of those—I forget which domain it’s on, but a few more of those obfuscated Apple email addresses. “Oh, that’s okay, that’s kind of cool.”

Fastmail do a similar thing; they have a partnership with 1Password where we can obfuscate the email address. And there is some value to that. It does break that assertion that I made before about it being the primary key to digital life. You then, of course, delegate some degree of your privacy to the service provider that can now map you to all of these other places, so you’re giving up something to do that.

It’s also not stopping you and all of your other personally identifiable data—including, if we think about the AT&T incident recently, your phone number, your date of birth, and your Social Security number. It’s nice that you’ve got an obfuscated email address, but all the other identifiable information…

Manoj Tandon: Absolutely. You can still reconstruct me.

Troy Hunt: Exactly right. So I think a lot of the lesson is all of these controls, whether they be password managers or masked email addresses, whatever they may be, get you a little bit of the way along the digital privacy continuum, but there are always these other things. And I think the question for everyone is just to decide what’s the right balance for them.

Manoj Tandon: So then, what’s the role of government policy in this? Is it not time that something be done?

Troy Hunt: Every time someone asks about government legislation, I sort of joke, “Which government?” Because the reality of it is that we’re here on this global platform that is the internet. We’ve got a service that might be hosted in one location, and then we’ve got people spread out all over the world. You just look at any one of these data breaches we have, and you’ve got a League of Nations in there. It’s just about every single country in the world by the time you get a data breach with millions of email addresses in there.

So, should a government regulate a platform, let’s say such as Facebook, which is such a global thing anyway—are they going to regulate controls around how people need to authenticate? I think at the moment they’re having enough trouble just regulating how platforms like that use our personal data. I would imagine something like how people create passwords and authenticate is further down the road.

And then, of course, we’ll end up in that same old debate of, “Is this stifling innovation if we start to have controls around things like the way technology needs to be built in an otherwise largely unregulated industry?” It’s not like it’s Finance or Aviation, for example.

Manoj Tandon: Well, in some ways it is, though. It’s worse because if the code goes wrong… I could turn you into—I’m not saying that we would, I’m just picking on you because you’re on the show—but if somebody wanted to replicate Troy Hunt and say, “I’m going to create another alternate identity and I’m going to completely confuse it with the legit Troy Hunt and use his identity to siphon off a whole bunch of free services from the Australian government.” Then I’ll create another bloke over in California… and now for you to undo that is going to be a nightmare.

And I don’t think Meta… you mentioned them, you can’t recover an account from them once it’s taken over by a bad guy.

Troy Hunt: I think the opportunity in terms of legislation is more around the verifiers, particularly for things like government or essential services.

I’ll give you an example here. AT&T—by the way, did they officially say that they were breached?

Manoj Tandon: Yeah, they’ve been dancing around that.

Troy Hunt: There are a lot of lawyers writing their messaging at the moment; I have absolutely no doubt about that. In fact, even just before coming on this show, I was sharing information about the number of class actions they’re facing—more than 10 class-action lawsuits at the moment. So they’re going to be very cautious about everything they say.

But the messaging that’s come out from them—I think the two most important things are acknowledging that—I think the term they used was “there are AT&T data attributes in the breach.” They didn’t really say “AT&T data,” and they’re trying to establish whether it’s from them or from a third-party provider. But they do now seem to acknowledge that it is information that was given to AT&T that was exposed.

And then the other thing, which very clearly indicates some degree of compromise here, is they’ve gone and rolled a whole bunch of passcodes for their internet service provider. And that’s something you do after a suspected compromise. So they do seem to acknowledge that.

Where I was going with that is that one of the big problems there is they got Social Security numbers, which are a really key part of identity verification in the US. We had a very large telco in Australia about 18 months ago have a data breach where driver’s license numbers were exposed. We don’t have Social Security numbers, but a lot of the time we’re using driver’s license numbers for verification. We had about 10 million people in that. AT&T had about 70 million, but we’ve only got 25 million people in this country, so it’s probably about the same sort of scale.

And then you end up with queues of people around the local main roads and transport authority because they want to renew their driver’s licenses. The thing that they use to verify their identity is now floating around the internet.

And the discussion I have here is: shouldn’t we have better ways of doing identity verification such that just the release of a number—which you have to give to all these parties anyway to verify yourself—is not sufficient to impersonate you?

Manoj Tandon: I am so glad to hear you say that. I totally agree. What form would that take? Do you have any ideas about it?

Troy Hunt: Well, you know, there’s a lot of discussion around things like having government IDs, like central identifiers. But the problem then is people are very worried about giving that information away to the government. They’re like, “Hang on a second, do I want the government to be able to have the keys to verifying my identity in all of these different services?”

And then you go, “Well, yeah, but they have all of this data already, right?” It’s just a question of whether they create an entire platform around it.

Many people will point to things like Aadhaar in India and say, “Look, this was the government’s way of doing it.”

Manoj Tandon: You know, I actually have that on my list of questions. Let’s talk about the Aadhaar, because that’s a mess.

Okay, first of all, they’ve had multiple leaks of information. They’ve had multiple leaks of top government officials that have been embarrassed by their own data being leaked. Do you know that in the Aadhaar system, there is no way to delete an identity?

Okay, I’ll give you an example. I lost my dad a few years ago and we can’t delete his identity. He has to show up at the office with his fingerprint to delete it.

Now I look at that and I’m like… so now I could have an 82-year-old… I could recreate that identity. That person lived in the United States for a while, so we could absolutely recreate portions of his US identity. And now, instead of him, who is no longer on this Earth, it could be somebody else with a completely legit document set that is traveling all over the planet under his identity.

Troy Hunt: Even I find these discussions fascinating because the mind tends to sort of go, “Well, what can you do with that, and what would the impact on the individual be?” If it was someone impersonating a deceased person, the impact on the victim is obviously non-existent. But does it impact their family, or is it just simply a flaw in the system that could allow people to get away with stuff we wouldn’t want them to?

Manoj Tandon: You could… because he was eligible for Social Security here. So if I want to commit Social Security fraud, let’s resurrect an identity, recreate it.

Troy Hunt: Yeah, but I wonder, in that case, who is the victim? Because it’s not your father; it’s no longer his property.

Manoj Tandon: No, it’s not his. He could care less, obviously.

Troy Hunt: Yeah, so you know, as soon as you said “Aadhaar,” I remembered so much of the discussion around that 2018 period. As it was coming out, the sense that I constantly got was that the government itself really didn’t have a good grasp on how these things work.

And the quote that I was looking for here was from the Attorney General, and the title I just found: “Aadhaar data is protected by 13-feet high, 5-feet thick walls,” says the Attorney General.

Manoj Tandon: Oh, and Twitter goes berserk. Well, you put it behind a wall, good on you, mate. That’ll work. That person has no clue. I did not know that quote, but obviously they have zero clue about cybersecurity.

Troy Hunt: Well, and in fairness, because we keep coming back to governments and interpretation, one of our—we’ve had a lot of ex-prime ministers lately—but one of our ex-prime ministers, as we were talking about the encryption debate around the fact that encryption can be used to protect communications that we don’t want people having—you know, terrorism, this sort of thing—he got asked by a journalist, “Look, you’re talking about controls on encryption or banning encryption. Encryption is just mathematics. How do you expect to ban mathematics?” And he said, “Look, the laws of mathematics are admirable, but the only law that matters here is the law of Australia.”

Manoj Tandon: That doesn’t make any sense.

Troy Hunt: It’s just not how any of this works.

Manoj Tandon: Yeah. I mean, look at terrorism as a great example of misuse of the Aadhaar system. Because at any given time you look at the death rate in the society, if you need a terrorist with a new identity, why not just go to India? Because we know that that identity exists; it was never deleted.

Troy Hunt: Yeah, and you know, that’s part of the risk. But very often this comes back to the moral neutrality of technology. If the debate is around something like encryption or how we protect data, these things can be used for good purposes and are mostly used for good purposes, but the technology is morally neutral. It can be applied in negative ways, and the challenge we have to deal with is: how do we make it work in practice to do all the good things without making it too easy to enable the bad things, but not letting the bad things stop us from doing the good things?

Particularly around the encryption debate: should we stop people being able to have secure and private communication because it could also be used to talk about nasty things?

Manoj Tandon: I mean, that debate happened here a long, long, long time ago, in the early ’90s, if you remember. I forget the name of the gentleman who invented PGP… remember that? Pretty Good Privacy?

Troy Hunt: Well, I think we’re sort of back to like the Clipper chip sort of thing again as well, right? Where it’s like, “Let’s not have a situation where we can have communication go unmonitored; let’s have a way of monitoring.” And then that becomes a total mess. And that’s the example that always comes back up again.

Manoj Tandon: So, well, let me run a thought by you. What about having the ability as an individual to say that for my identity there’s an opt-out? Just like in the US, with your credit rating, you can lock your credit. So now it becomes a real pain in the backside because you can no longer go and just get a new phone, or buy a car, or do any of the things that you would do with credit. It needs an additional level of verification.

Could we do that with the identity, that this individual does not accept electronic identity as a mechanism for authentication of their identity or verification of their person?

Troy Hunt: Well, I guess, first of all, we’d have to have a consistent means of doing identity verification electronically through some government resource which could then honor any sort of opt-out request. Maybe that would make sense, but it’s so far down the line before we get to the point we can do digital identity verification reliably without just like, “Hey, here’s my Social Security number and my address.” Maybe that would make sense if we ever get to that point.

Manoj Tandon: Yeah, I don’t know. I don’t have a good solution for this, and this is a topic that comes up… and it seems like it’s a topic that comes up in your world all the time. There is no easy thing. And you know, some people have said, “Why not push it on the likes of Meta or WhatsApp?” Because in both their instances, if your identity is compromised and then that is used to compromise your account, you can’t actually recover that account.

Troy Hunt: But even then, if it was identity verification via some sort of centralized government resource… which government? And I ask it almost rhetorically because everyone always goes, “Oh, the American one.” It’s like, “Oh, okay, sure, but that’s like 6% of the world.” That’s a tiny, tiny slice, and you’ve got a global platform with two billion-plus people on it.

So do we just end up with more balkanization of the way these services work? Because if it wasn’t already enough of a mess with the likes of GDPR and everything else, do we really want to just keep dividing things down? We’re never going to get a unified global solution.

So I almost wonder if we kind of keep ending up in a model—going back full circle to the password thing—where it is flawed, but given all of the various constraints at the moment, it’s the best thing that we can possibly do right now.

Manoj Tandon: And we accept it. Okay, well, that is one part of the risk equation, right? You can mitigate it, you can transfer it, or you can accept it. Those are the only three things that can be done with risk.

Troy Hunt: I say this slightly tongue-in-cheek, but the number of times I sit here, particularly with good friends in the industry, and we talk about this, it’s like we just don’t have any good answers. Gee, it’s a good time to be in this industry, isn’t it? Because there are so many problems like this.

Manoj Tandon: There are, and you know what? It is actually a good time. I can’t say that there’s a boring day in our world. There’s always something fascinating. And the ingenuity of the bad actors… you’re not talking about run-of-the-mill criminals here. You’re talking about people who are fairly sophisticated a lot of times in their technical capabilities, and trying to understand the flaws in a system to exploit it keeps it interesting.

Troy Hunt: It does keep it interesting.

Manoj Tandon: Okay, so on identities… another big trend that I’d love to get your opinion on is 2FA. What is the effectiveness of it given some of the breaches we’ve seen where the hashes… and you can actually replicate a person browsing with the same two-factor authentication as somebody else and then you bypass 2FA. Probably didn’t say that right, but I think you know what I’m talking about.

Troy Hunt: I think we’ve got to recognize it as one of these controls where, when it’s done well on behalf of both the platform and the individual, it does make a substantial difference. If we just look at the rate of credential stuffing attacks… credential stuffing attacks just feel like every other week. There’s some big news story about, “Hey, such-and-such a company has been hacked,” and they’re like, “No, we haven’t been hacked; it’s just a hacker logging in with thousands and thousands of legitimate email addresses and passwords.”

And it kills that sort of stuff dead. Even SMS-based 2FA kills that sort of stuff dead, because the barrier between some automated en masse testing of millions of accounts and getting straight in with no 2FA, versus having to get the SMS… “Oh, now I’ve got to go and hijack someone’s SIM, or I’ve got to go and social engineer them.” It massively changes that equation, which is fantastic.

We still see risks in other ways, though, and a couple of things come to mind. There was a data breach recently of a service called Spoutible. Have you heard of Spoutible?

Manoj Tandon: I have not.

Troy Hunt: All right, so this is like an alternate social media platform. You know, when Elon went a little bit crazy a while ago and a bunch of people were like, “Yeah, we’re leaving Twitter and we’re going to Mastodon, or BlueSky, or things like this.” There was a platform stood up called Spoutible, which was meant to be the alternative.

And they recently had an incident that someone then took a lot of advantage of and sent all the data to me for Have I Been Pwned. There was an API that would normally return someone’s social information that you should see on the platform—it would be their name, their handle, the number of posts they’ve made—except their API returned pretty much everything in the database: their bcrypt hash of their password, there was a reset token in there you could just go and reset the password with, but they also returned the 2FA secret. So you could take that secret and you could generate your own 2FA codes. So, it completely invalidated all of the 2FA on the platform.

And I guess the point I’m making here is that 2FA alone is not the solution; you’ve got to have it actually implemented properly.

We’ve seen things like, last year, the Genesis Market takedown. Genesis Market was a marketplace where you could buy cookie material and browser fingerprints in order to replicate the authentication tokens of a victim. And all of this is set post-login. You put in your email address, put in your password, put in your 2FA token; you get material back in cookies and often it’s fingerprinted to the browser. But if you’ve got a compromised machine and bad guys can actually grab that, then they can put it on a website and you can go through and purchase it.

But I think it’s almost a good thing that a service like that has to exist, because that’s a lot of extra mucking around to go through, and it only works if someone’s machine is compromised as well. Compared to, “Well, I just got a username and a password off any old data breach and it works everywhere.” So it massively raises the barrier to entry, but it’s also not infallible.

Manoj Tandon: Which brings us to AI. You can’t have a cybersecurity conversation without talking about AI. I guess it’s an obligatory thing. With the advancements in NLP, what do you think that’s going to do for the future in terms of these technical breaches?

We saw MGM get breached recently; as you saw, they called the service desk and were able to gain access. Or using natural language processing to learn the formats of purchase orders, and checks, and procedures, and then replicating all that—spoofing the email… What was it recently? Wasn’t there a bank out of Hong Kong that lost $25 million because of deepfakes on a Zoom call? The gentleman thought they were real and he transferred the bank’s money.

Troy Hunt: Well, I think there are several different ways of looking at this, and I’ll start with the observation from before about the moral neutrality of the technology. It’s up there with encryption that way; obviously, we can do wonderful things with it, but we can also do bad things.

I think what I’m finding fascinating at the moment, because of the extraordinary rate of development of AI, is trying to separate what is actually interesting and relevant from what is absolute rubbish.

The example I was just trying to find here… this was January 31st this year. I was tweeting about this. Europcar had allegedly had a data breach, so someone posted a whole bunch of data to a hacking forum. This is from Europcar, and it just looked a little bit odd.

It turned out that all the data was generated; it wasn’t real. And we probably should have understood when you start to look at some of the data in here, because every city of birth was kind of weird: New Austin Land, New Peter Haven… now there are a lot of places in the world I’ve never heard of before, so maybe it’s a little bit legit. But North Courtney? It just seemed to be like compass directions and then someone’s name.

Anyway, the thing that made it really interesting is Europcar said, “This is ChatGPT AI-generated data.”

Okay, and I just looked at it and went, “What makes this AI?” And to make it even worse, some InfoSec company picked it up, and some executive there—obviously who has a PR company—shipped around this big spiel about how all this is AI and we’ve got to be careful of the AI, and we offer services to help you be careful of the AI.

Anyway, I went and pulled through all the threads on it, and it eventually turned out to be from a Python library which just simply generates words. There’s no artificial intelligence whatsoever in this.

So I’m finding it quite amusing to look at all of this and figure out what is actual AI doing really cool stuff—either for good or for bad—and then what is everyone wanting to have a slice of the AI pie and get their five minutes of fame.

Manoj Tandon: Well, there’s a lot of both, actually. This was fascinating—the cybersecurity company that was shopping it around said that, apparently, they’re a company that specializes in simulating the attacks of cyber criminal groups, and they likened the incident to a Scooby-Doo plot.

Troy Hunt: It’s a slow news day, isn’t it? Someone’s after headlines.

Manoj Tandon: Well, they got it. I didn’t pick up on that story, but now I know about it.

I tell you, I think we haven’t even lit the candle with AI yet as to what’s going to happen. I think, in many ways, it’s a good thing because things don’t change and people don’t change unless an overwhelming force is imposed upon them in some way, shape, or form. And AI is definitely an overwhelming force in many regards, and it’s making strides into so many sectors of our lives at such a rapid pace.

Just look at an unrelated area: medicine. Its ability to read pathology reports… it can look at X-rays and MRIs and determine with a high degree of certainty if someone has a type of disease. It’s pretty remarkable how quickly the adoptions are happening, and those are all really good things. You don’t have to wait five weeks for a result, or several days for a result. But how it’s going to get used then for nefarious purposes… I think the deepfake example out of Hong Kong is only the beginning.

Troy Hunt: Okay, well, it’s a fun time. And I think, as much as I like to specialize in security stuff, I’m a nerd at heart and I love seeing all of this stuff. I love seeing all of these technologies and all of these use cases. I love having the new shiny things, and some of it’s going to go wrong. This is the way it’s always been, right?

Manoj Tandon: So, what are your recommendations, Troy, to the average person listening to this show? What should they be doing? What is some hygiene that you would absolutely say, “Guys, if you’re going to do nothing, at least do this”?

Troy Hunt: The discussion I’ve been having with the average person is to liken it to an incident we had IRL—in real life—recently, where we left our car outside and I accidentally forgot to lock the door. Now, I don’t normally leave it outside; it’s normally in a garage. I always lock the door… but I forgot to lock the doors and, sure enough, someone came by that night and broke into—meaning opened the door. The police said it’s “breaking into” because they weren’t authorized. Anyway, they opened the unlocked door, went in there, did no damage, and stole a pocket knife from the glove box. That was the full extent of it.

But the observation there: we later on had some video footage of other people doing similar things. We could see people driving along the street—someone would be driving the car, the passenger would lean out, and they’d try the door handle. “No good.” Go to the next one, try the door handle. “No good.” Literally, that is how opportunistic it is.

And it is very much the same thing with cybersecurity, where the vast majority of people who experience any sort of digital attack against them, it’s opportunistic, taking advantage of low-hanging fruit. It is reused credentials, it is phishing emails, it is the sort of very opportunistic behavior that we see IRL. The same thing’s happening online.

If you have a password manager and your password is unique, you are out of the 90-plus percent category of people who are reusing them everywhere. If you have multi-factor authentication turned on, you’re also out of that whole group. If you’re not entering your details when you get a text message about a package that’s gone missing, you’re out of that group. And it is really the low-hanging fruit that’s consistently susceptible to this. It’s so easy not to be the low-hanging fruit. Don’t be that.

Manoj Tandon: What about for companies?

Troy Hunt: It’s harder. I’m very fond of the saying that, as a company or even as a software developer, you have to get it right every single time, and the hacker only has to get it right once. It’s almost like a bit of a power imbalance.

I think what’s very hard for companies is that there are so many moving digital parts these days. It wasn’t that long ago where there might be a publicly facing corporate website and that would be it. Everything else would be internal and behind the firewall and, to some degree, out of reach.

Now, there are so many different services that companies run on, so many different platforms. That might be everything from their own custom apps spread across different cloud services, through to the number of different SaaS solutions that we all use. You know, the number of people that have accounts on everything from the invoicing system through to the help desk system. All these things are online, publicly facing. And the really hard thing for the company is just keeping track of all of these things.

It’s fascinating also to see how much burden companies then have to put on the service providers. We were having a discussion just this morning—my wife and I—because a very well-known technology company wants to use the Have I Been Pwned service. It starts at $3.95 a month, and they gave us a 250-question questionnaire about everything from SOC 2 compliance, to your last audits, to the processes for disposing of a mobile device after it has reached end of life.

So companies try and put a lot of this burden back on the service providers to then justify all their security controls. And you just end up with this massive spiderweb of different relationships and possible points of ingress. I’m honestly sympathetic to companies; it’s a very hard problem to manage.

Manoj Tandon: It is, and third-party risk is probably one of the largest growing segments of risk.

And hey, that may be the AT&T vector as well. When they’re sort of saying, “We can’t see a compromise,” it may be someone they’ve used, but they’re still going to be on the hook for it. They’re the ones getting targeted by the lawsuits right now, not the as-yet-unnamed third party, if that is what happened.

Troy Hunt: It happened in the Okta breach as well, right? That was a third party.

Manoj Tandon: Right. Yeah, and it’s over and over and over again.

It is a trusted party, but I think, again, the challenge is: who is on the hook when your trusted party has an incident?

Well, and it gets really complicated with… you mentioned earlier on people having illicit affairs. I think Ashley Madison, when it got compromised, there were people who lost their lives, quite honestly. And that’s terrible. So now, who’s responsible?

Troy Hunt: Yeah, that’s a very messy one. I mean, that’s always going to be one of the most sensational examples because of the actual impact on human life. It’s one thing to have your credit card defrauded; it’s another thing for someone to take their life.

And of course, that’s extraordinarily messy because it’s all tied up in that whole moral view of the purpose people were there for and what would then cause them to take an action like that. But it is a good reminder that sometimes data breaches can have really serious real-world impact.

Manoj Tandon: Absolutely. I’m sure there are cases of extortion where data that was stolen got out, and then that was used to force them to do things that they didn’t want to do.

Troy Hunt: But we do see this very often now. I mean, that happened a lot with Ashley Madison, where individuals got blackmailed. Because the data was spread around so broadly, anyone who wanted to get into the blackmail business had a great big list of people who felt really, really guilty.

Even in very recent years—I mean, Ashley Madison was 2015—as recently as last year, I’ve had people sending me blackmail attempts from that. And we’re seeing this pattern over and over again.

A couple of years ago, it was Vastaamo, the Finnish psychotherapy site. Someone tried to ransom them, didn’t get anywhere, so they went through and they ransomed the individuals: “Send us money, or your psych records are going to be released.” And eventually, they were all released anyway.

It’s just a horrendous business model. We see the same thing happening with ransomware crews now. Ransomware used to be just encrypt all the files and then you pay to get the key. And then it became “encrypt all the files, but we’ve got a backup, so you’ve got to pay to decrypt and pay so that we delete—honestly delete—our copy.”

And now it’s like, “Okay, well, we’re going to go after the individuals in here as well and tell them that they need to…” It’s just horrendous. And I think it’s an industry that prevails because of the ubiquity of the amount of data that’s out there and the ease with which someone anywhere in the world, in a largely anonymous fashion, can go after innocent victims.

Manoj Tandon: Absolutely. And then a lot of the bad actors… some of them are really beyond the approach of law, because they’re residing in nations that you just can’t go and get them.

Troy Hunt: Well, around the same time that we had that telco incident I mentioned before, our largest private health insurer, Medibank, got ransomed. And the ransomware crew there started dumping very personal data about individuals once they didn’t get the ransom payment. They started by dumping a list of people that had abortions, and then they went on to people that were getting psychotherapy, or drug and alcohol treatment.

But to your point here, I think it was only last month the Australian government did name the person they believe was responsible for it. And, of course, it’s someone in Russia. If he ever comes to Australia, he’s going to be in a lot of trouble. But the problem is that the guy’s probably going to be holed up there pretty much forever. You’d have to imagine it would be very difficult for him to do very much at all of interest there, particularly in the criminal underworld, given how well known he is now. So maybe it’s one of these things where even if we can’t get the person back into a jurisdiction where they can be charged and jailed, at the very least you can make their life as hard as possible.

Manoj Tandon: Yeah, and if they are a proxy for a state operation, then it becomes troublesome. Again, there’s limited… we had an FBI agent on a couple of episodes ago, and he wrote a book, The Four Truths of Cybersecurity. And one of those truths that he expounded was that it’s rare that these bad actors go to jail. We hear about the big ones, but a large part of the time, they don’t. That’s why it continues to flourish.

But it’s crazy, isn’t it? Troy, I know we’re at the hour here. I wanted to give you a chance to plug whatever it is that you’d like to plug and let our audience know about in your world.

Troy Hunt: Yeah, password managers—go and get password managers. Look, people know where to find me: troyhunt.com, Have I Been Pwned… you know, that’s pretty much the entirety of what I do these days.

Manoj Tandon: So, are you doing any presentations anywhere? Are you appearing?

Troy Hunt: Yeah, I always am. The next big one I have coming up, I’m doing a keynote at NDC Oslo in June. And the one I’m really excited about: I’m going to be doing a joint talk with my 11-year-old daughter in Oslo about 3D printing, which has nothing to do with cybersecurity, but she’s really gotten into it. She’s going to do her first talk in front of hundreds and hundreds of technology professionals and actually teach them stuff that they don’t know about 3D printing. So we’re on the countdown—we’ve got two and a bit months for that—and we’re working really hard to turn that into an awesome talk.

Manoj Tandon: That’s fantastic. Yeah, I think she’s pretty stoked. That sounds like a great time, and I’m glad you’re able to find the time to do things like that, because that sounds like genuine fun.

Troy Hunt: Well, I say yes to everything, and then I figure it out later on and I regret saying yes… but I don’t regret saying yes to that.

Manoj Tandon: You work it out. Well, Troy, we’ll put a link to your blog as well. Thank you for joining us all the way from halfway around the world, and don’t be a stranger here. If you ever want to let our listeners know something, you’re always welcome back.

Troy Hunt: Cool, thanks.