Robert Siciliano, an identity-theft expert at McAfee, explains how StubHub accounts were hacked. Attackers used passwords stolen from other breaches to break in, then deployed malware to capture login credentials. He recommends rotating passwords, using a password manager, and keeping antivirus software updated.
Chapters
Hackers hit a popular website for buying and selling concert tickets. Prosecutors say the StubHub accounts of more than 1,000 customers were breached. Thieves based in the UK, Canada, and the US used the accounts to purchase tickets to various events. StubHub says the login and password information was stolen during breaches at other websites or by using spyware on the customers' computers. The company detected many unauthorized transactions last year and gave refunds. Now we're going to bring in Robert Siciliano, identif— Identity theft expert and McAfee consultant, and thanks for joining us. And you know, these stories, whenever they come up, they get us all concerned because really we are at risk, aren't we?
Oh, we certainly are. You know, the consumers that are using the same passwords for all their different accounts and their email as the username, and then those accounts get breached— major corporations, retailers, they have data breaches, it trickles down. And all of your other accounts get compromised as well.
I mean, that's something we all do, I think. I think we all do that with our passwords because it's hard to remember them all. Now, while thieves didn't break through StubHub security, rather they got an account holder's login and password information from data breaches at other websites and retailers, or from keyloggers or other malware on the customer's computers. Explain how this works, how they can break in one place and then get access to these other accounts.
So for example, we're aware of the Target breach. There's 110 or so million accounts that are compromised. Many of them might have username and password information, or other breaches might have the same type of data. And again, if you're using the same account information, bad guy just goes to all the major retailers and just plugs in that information, and if it works, he's in. So expect that other retailers are actually having the same exact problems as we speak.
Well, StubHub, as we know, is very popular. That's a service that people use to buy and sell tickets to almost every major event, whether it's a concert or a sporting event. Are you surprised, though, that only 1,000 people were impacted as far as we know?
You know, that is really a low number due to the fact that there have been almost a billion records compromised over the past decade. More than likely, there are more breaches or more compromises that they may not even be aware of, that they'll just— they'll discover over time. And I would expect it's happening elsewhere as well.
What do you think the hackers, you know, when they get this information, the username passwords, that's as simple as that, right? That's what they're using and then they just go and try, just try it, just try it at other retailers and see what works. That's what they do with this.
And that is exactly it. So keep in mind that if you're not changing up your password, say every 6 months, if you're using the exact same username and password for all your different accounts, It is just a matter of time until your other accounts are going to be broken into as a result of other data breaches, or if you're clicking on links in emails that download viruses onto your machine, you're going to get a keylogger. If you're responding to phishing emails and giving your usernames and passwords up to bad guys, these are all ways in which you can be compromised.
So bottom line, change up the passwords, username, every 6 months. Write it down if you have to. I know there are programs out there that you can get to manage all these passwords, right? It doesn't have to be difficult.
Exactly. And update your antivirus, anti-spyware, anti-phishing, a firewall, get critical security patches in your operating system. Just be smart and intelligent regarding your information security practices.
All right. Robert Siciliano, identity theft expert and McAfee consultant, thanks so much for joining us.
