- [Instructor] In this segment,
we're going to explore how to find out
if any of our user accounts have been compromised
and how to get information on pwned websites.
Now the word pwn is slang
and it's a combination of password and owned.
Has your password been owned?
Has it been compromised?
Is it potentially in the hands of a criminal?
Well, to find out, we're gonna go to the website.
Have I been pwned now?
The have I been pwned is gonna allow us
to search across multiple data breaches
for a credential exposure.
So I'm at the site, haveibeenpwned.com.
It says, would you like to check if you have an account
that's been compromised in a data breach?
Curiosity has definitely got the best of me.
So I'm gonna put in an old email address of mine,
sari oops, @sarigreene.com,
and let's check to see if this account has been pwned.
Oh no, it's been found to be pwned on nine breach sites.
Now fortunately, no pastes had been found,
meaning no dumps of my password
or of my credentials has been found.
But I'd like to know what sites were compromised.
So I'm scrolling down and it tells me
the breaches that I were pwned in,
defining a breach as an incident
where data has been unintentionally exposed to the public.
Looks like an Elasticsearch Instance of Sales Leads on AWS,
Evite, Exactis, going down to MyHeritage,
NestProspex, ShareThis.
ToonDoo, and Verifications, and Zynga.
Well, I'm still using Evite, so let's read more about that.
In April, 2019 the social planning website
for managing online invitations,
Evite identified a data breach on their system.
Upon investigation, they found unauthorized access
to a database archive dating back to 2013.
The exposed data included a total of 101 million
unique email addresses most belonging
to recipients of invitations.
The members of the service also had names, phone numbers,
physical addresses, date of birth, genders, and passwords
stored in plain text exposed.
So what was compromised, date of birth, email address,
gender, name, password, phone numbers, and physical address.
So what's my response?
Well, my response is really threefold.
One, was I notified by the site that they had a compromise?
Two, have I been sure
to change my password post-compromised.
Now, hopefully the site required that I change my password
but if they didn't, I wanna make sure that I have.
And most importantly,
am I using those same credentials anywhere else?
Meaning am I using sari@sarigreene.com
with the same password on any other site?
Now, I shouldn't be, but if I am,
I just handed an extraordinary gift to the criminals,
who will now use that credential combination,
that username and that password on other sites
to see if I have an account and if that password
will work on that account.
So now I'm really curious about what other sites
they have in their database that have been compromised.
So I'm gonna come over to "Who's been pawned",
and that's going to bring me to a very lengthy list
of almost 500 sites that have been compromised.
It will tell me the date that's been compromised,
the compromised account,
and what was the compromised data itself.
Now I can scroll through them
but this information is also accessible programmatically
via an API and also via an RSS feed.
Lastly, let's take a look at pwned passwords,
meaning passwords that are commonly used
so they show up a lot, or maybe even passwords
that are kind unique which means
they should show up very rarely.
Let's look.
Let's start with some really common passwords.
I'm going to use the word "Password".
Has that been pod?
I don't think I spelled it right 'cause I believe
it's been pwned a lot more than 1500 times.
I must have misspelled it.
Let's try it again.
Password, P, A, S, S, W, O, R, D.
Oh, that's more like it.
3,759,315 times "Password" has been seen.
The word "Password", literally as a password.
Let's try another really common one.
One, two, three, four, five, six, seven, eight, nine.
Has that been pwned?
Yikes, 7,870,694 times.
Boy, our users really, really need to be reminded
not to use those simple common passwords
like one, two, three, four, five, six, seven, eight, nine,
or the word "Password."
But even trying perhaps a more unique password,
ah, good news, no pawning found.
Now it doesn't mean it's actually a good password,
it just means it hasn't been indexed on this site
but it also means that it's probably
a relatively unique password, and that's good
because then it indicates it's not being used
over and over again.
You know, in a closer look segment,
I suggested that demonstrating
how easy it is to spoof a phone or a text number
would be like this real aha moment for our user community.
I think you should add this site
to your training arsenal as well.
Help users understand how important a strong password is
and how important a unique password is.
And then definitely take the opportunity
to reinforce the importance of two-factor authentication.
And that my friend, is a closer look at pwned passwords.