How the Massive Equifax Data Breach Happened

[@MephLeo]

Someone choose the "remind me later" option one too many times.

[@jetjazz05]

If they were using Windows it would have randomly reinstalled the entire operating system one night when they shut down though. Guess it's time to switch! lol

[@LunaTulpa]

Shoulda mentioned that people in the company sold their stock before disclosing that this happened

[@harrymanocha4533]

Vance JQ it's still a very important part of the scandal that shows just how aware they were of the flaws

[@iamsobanned]

It's social science.

[@everythingpony]

AK Milli yes, because they knew that mentioning this would drop their stocks

[@krashd]

It's insider trading, if you have concrete knowledge that a stock is about to drastically change in value you are not allowed to trade in it.

[@everythingpony]

Rob Fraser so if a company new product is failing, isent that then technically not allowed to sell? Because I can see ?

[@brendarua01]

I've worked as an analyst and project manager, and feel pretty confident in betting there was no budget and not enough staff resources. Someone did a risk/benefit analysis and the public lost. Equifax should face punitive damages that establish a fund for making consumers who get hacked whole.

[@ABitOfTheUniverse]

Always wondered about the plant, fungus, animal common ancestors. Please find more information on these types of organisms. And keep us posted.

[@dynamicworlds1]

The problem is that the common ancestors are mostly-to-entirely microbes, and those generally leave very poor fossil records, if any.

[@ABitOfTheUniverse]

"mostly-to-entirely microbes" not at all the ones I'm talking about. There were hundreds of millions of years between when there were just microbes and the Cambrian explosion. Those hundreds of millions of years, during the Ediacaran Period 542 - 635 million years ago (ma), the Cryogenian Period 635 - ~850 ma and the Tonian Period, ~850 - ~1000 ma, are rife with macroscopic, multicellular organisms that are the common ancestors of our 3 kingdoms of life up here on land. I understand the fossils are difficult to find and keep together because of all the geologic activity since then, along with their soft bodies, but they were far from microscopic. Dickinsonian fossils managed to get up to 1.4 meters in diameter for instance. Heck, even stromatalites 3.7 billion years ago may have been up to a meter or more in diameter, though they are composed of many smaller organisms, they are evidence of some of the earliest mulicellular colonies. Thats 3 billion years our history, from stromatalites to dickinsonians that we have a loose grasp of. The world can benefit from a common knowledge of our ancestors, looking back, and going forward, and Scishow is as an ideal medium to disperse that knowledge as it comes to light.

[@KeithTreason]

Oops, guess they just get a slap on the wrist since they are a multi million dollar company. Doesn't matter what happens to the little people.

[@petervilla5221]

I'd hardly call several lawsuits and FBi investigations a "slap on the wrist."

[@KeithTreason]

Peter Villa That doesn't help the millions of people that are now affected on a process that we didn't even ask this company to handle.

[@Thumbsupurbum]

It is just a slap on the wrist because no one will go to prison for this. The rich never do.

[@jetjazz05]

+Keith Treason Yeah lol, even if the "little people" is 90% of American adults. It's the 90% with the least amount of money anyways, the 1 percenters are fine.

[@meowtherainbowx4163]

I don't even hate the rich, but they have it way too easy when it comes to justice. Lay off the excessive taxes, but for the love of God, punish them when they break the law!

[@Master_Therion]

I think someone at SciShow misread a memo: "Upload the *Equinox* video on Sept. 22 (the Autumn Equinox.)" Uploads *Equifax* video instead.

[@Master_Therion]

Just kidding, I love you SciShow! ^_^

[@anomalous34]

I appreciate your humor. 93/93

[@thesage1096]

UR SO BAD

[@Master_Therion]

Alexis Johannisburg Thanks 93s ^_^

[@Master_Therion]

ScienceAIR I like your "ScienceAIR joke time." Please keep it up :)

[@andyhoffman8384]

So all those years of trying to maintain a good credit score meant nothing? Thanks Equifax. Thanks a lot.

[@Jay-lz2wc]

Hehe. Sucks to be an adult :P but no seriously I feel bad for the people affected by this

[@dynamicworlds1]

The whole credit system is bs to begin with. For example, being responsible enough with your money that you don't need to borrow means you have no credit and are seen as super risky. Like wtf?

[@petervilla5221]

If you haven't proven that you can responsibly deal with more money than you are capable of making on your own (the reason you get loans) then you are super risky.

[@MephLeo]

The whole thing of needing more money than you are capable of earning is the bogus thing. It looks like a long term wealthy transference from people who produce to people who speculate within the financial market.

[@dynamicworlds1]

Peter Villa people have to deal with recurring payments even without borrowing money. Rent, utilities, phone/internet contracts, etc all require budgeting skills not significantly different than making payments on borrowed money. A long period of being responsible enough to avoid borrowing is more of an indication of someone taking borrowing money seriously than someone constantly using credit for everyday things, but your credit score will not show that.

[@KaelinatorPVP]

I think, like SciShow Space and SciShow Psych, there should be a SciShow based around technology! I'd love to learn about Computer Science though SciShow!

[@l0lLorenzol0l]

Fun fact: the Equfax IT person in charge had a diploma in music, not IT or computer security.

[@TheDrew4321]

Lorenzo Pagani that's very common in the industry. People often forget how new the Internet is. Computer science is a very new major.

[@AliSAhmad]

An fyi. Most computer experts don't have a degree in anything close to computers

[@MephLeo]

Yep. Engineers, mathematicians and physicists were the original IT experts.

[@MephLeo]

Well, I say mathematicians and physicists, but a physicist is really a mathematician that has some creativity.

[@chinchenping]

She already resigned... or got fired, i don't remember, but she's out.

[@Roxor128]

We need to start punishing companies who don't install security patches. Let's add a law where you get 48 hours to install any patch that comes out, and if you don't and you suffer a data breach because you didn't have that patch installed, you get fined 10% of your company's value.

[@sepioify]

I just love love your videos..simple, yet professional.. entertaining and educational.

[@thealmostfreerunner]

What a surprise, they didn't SANITIZE THEIR INPUTS!

[@Thumbsupurbum]

You know, stuff taught in network coding 101. I'm not even a programmer and I know you never, ever, EVER trust user input.

[@sage5296]

There's an xkcd for this

[@sage5296]

thealmostfreerunner xkcd.com/327/

[@Sam_on_YouTube]

I'm surprised you used the legal term "negligence." You were right to use it, but I'm still surprised you did.

[@ScienceByMike]

You guys keep me fresh. Thanks for the great videos

[@chrissoto7187]

$20 they left grandpa in charge of cyber security 🤣

[@somethingsomething404]

It was someone with a degree, in music . not IT or computer security or even a previous Apple Store employee

[@harmonic5107]

Kalvin N that is true, but that is common in technology companies. Tech moves so fast that certifications like ccna carry more weight than a college degree. The person in charge of IT at Equifax knew about the vulnerability and they had a plan to implement the fix. But it requires the servers to go offline to implement. This would result in lost transactions. There was no good fix. It was either fix it and have the servers go down losing transactions and the four 9 rating or not fix it and lose integrity. Bad place for them to be, I feel sorry for them knowing that they are likely blacklisted from ever being in a technology position again.

[@harmonic5107]

busi magen 2:05-2:17 This wasn't just an os update, this was a complete rewrite of the hierarchy of how the script runs on every single app on every single server. More than one person is to blame, the programmers for their oversight on the code injection, the IT lead for not pushing the update hard enough, the people below the IT lead for not pushing it harder. It's the same as SQL injections on traffic cams, we need to think forwards.

[@jetjazz05]

+Kieran M It was a woman, not a man.

[@harmonic5107]

Jesse Crandle sorry, I started with neutral pronouns and switched accidentally later. I'll fix it.

[@blazebluebass]

What do you mean "nobody knows"? They simply don't give a damn. Privacy is one big joke.

[@SupaSe7enSwift]

Apache Struts vulnerability that they left open for 3 months after it was announced. Serious negligence is right, lol

[@dinamyter2860]

Dickinsonia, if it last for more than 4 hours, call your doctor!

[@spindash64]

dinamyter Probably the closest any of these jokes will ever get to bring funny

[@jnco1994]

To the top my friendly comment! TO THE TOP!

[@dvklaveren]

That's not what Sonia said.

[@krisisnkaos]

IT controls were insufficient. Even if they used a third party like Apache, they should have validated/verified the software in-house. And their audit team must suck for not catching this.

[@sage5296]

krisisnkaos or the audit team was ignored by profit driven management who can't see the long term benefit

[@krisisnkaos]

Zander Rossman True. Gotta hate that. Fortunately for us consumers, bringing an organization's network and data into compliance with the SOX Act is unavoidable these days and comes with heavy penalties. Adequate control structure is crucial. Lax risk assessments, brushing past controls, poor judgment calls, etc. likely resulted in what happened here. It wouldn't fly with just about any oversight committee, especially when the risk is this high.

[@niceyoutubecommenter6840]

HANK IS BACK YEAH

[@818GCA]

"Dickinsonia grew from head end instead of the bottom end" LOL!!!

[@tyleraldh7070]

Oh god they better not dig through my "stay out fbi" folder

[@shamrocks521]

tyler134789 rookie move buddy, I always label my folder as "Internet Explorer and Bing shortcuts"

[@fishbuddy547]

What about your, "definitely does not have secrets in it," folder?

[@spindash64]

Joe Johnson That, or you could hide it in a folder full of things that are also things you'd want to hide, just not as much as those, to sort of smokescreen ...I think you maybe get what I mean

[@shleed]

hmm... maybe I should re-name my 'World Annihilation' bookmark folder.

[@willferrous8677]

^^^ that's genius!

[@SupaSe7enSwift]

SCISHOW IS THE BEST SHOW

[@smithsmitherson9449]

Wow. Both topics blew my mind. Also, One goes clockwise and the other goes counter. That is all I know and all I "kinda" care to know about hurricanees and cyclones. 50/50 I put those words in the correct order.

[@Zathara]

If you look up the lady who’s in charge of their security she has no prior experience in security. She went to school for music. Google up her linknd page

[@sage5296]

I'm sure corporate nature and groupthink had a role here too, the system where the engineers and experts who see the problem are shut up by the profit driven managers who don't see the immediate benefit.

[@MrAdabm]

I would love to see you guys do a video on Greek Fire! A very interesting piece of history that most people seem to overlook

[@furzekake1]

poor sonia.

[@MephLeo]

Oh, you.

[@bistaabishek3632]

I do have coursework on how does the data leaked in Equifax. thank you great video.

[@SlyPearTree]

There should be a SciShow Computer about both computer related news like this data breach and advances in computer science.

[@aellalee4767]

Bits of the Dickinsonia fossils sound like parts of a description of a Lovecraftian monster from a story about an Antarctic expedition. Creatures the scientists couldn't decide if they were animal/plant/lichen having odd tracks and a triangular head shape from Cambrian times.

[@wcdeich4]

"Not as simple as downloading an update for your phone. It required updating every app individually...." - Java development tends to be that way

[@okrajoe]

I'm going to go out on a limb and say the cause was total incompetence. Hey, I was right.

[@albertschmidt7430]

Great vid

[@chinchenping]

Pretty sure they are going to make a movie out of it.

[@George-404]

chinchenping Sure, another black hat...

[@neilisbored2177]

And then a chinese bootleg company will make an NES game out of it and confuse jontron.

[@mekafinchi]

Someone had a sense of humor when naming that creature

[@jefferyarnold2494]

Some of the cisco equipment's username and passwords were still the default admin admin. It has also been confirmed that they were in the systems for more than a month.

[@Co-km6cl]

IT'S THE CAMBRIAN EXPLOSION

[@AlvinLee007]

It was a time when the world's oceans held soft-bodied organisms so different from anything known today that how to classify them has been a major paleontological *nightmare* !

[@pikmints]

Did anyone ever comment as to why only 1 of the video's subjects gets mentioned in the title? Sounds like it's saving title length in exchange for making the information harder to come back to if you want to reference it later.

[@candiduscorvus]

Hurricanes always rotate counterclockwise, because only tropical cyclones in the northern hemisphere are ever called hurricanes. All others are called typhoons or cyclones.

[@tsuchan]

'Typhoon' comes from the Japanese word, 台風 (taifū). Japan is in the Northern hemisphere.

[@candiduscorvus]

That's correct. Good for you.

[@DanijelJames]

I’m from South Australia! 🇦🇺✊🏻

[@TheMarshmellowLife]

Hurricane's (and all winds) spin is decided by whether the air is high or low pressure and whether the and in the northern or southern hemisphere

[@SaraAnneMiller]

I read Dickinsonia as Dickinsomnia.... thank you subconscious; I know I'm not getting enough sleep. 😂

[@ag4ve]

Correction - the researcher doesn't assign the CVE number - after the company accepts the issue, NIST / MITRE (IIRC) assigns the CVE / CVV and posts notification (that - I /think/ the vendor may update with details after the vuln is fixed)

[@LuisMiguel-ms7ro]

the great old ones

[@rolandgharfine534]

Actually, most of the time and for most operating systems, it IS (almost) as simple as downloading a software update for your phone.

[@adamm2716]

probably cuz the chief of the internet security dept at equifax didn't have a degree in Internet security. unbelievable right?

[@SurmaSampo]

There is no such thing as an Internet security degree.

[@adamm2716]

feel free to crawl back to your hole www.usf.edu/cybersecurity/

[@SurmaSampo]

That is a CyberSecurity Degree not "Internet Security".

[@adamm2716]

LOL it seems you haven't properly read my comment, I can't be bother with someone who can't read. I'm sure your will believe what ever you want whether fact or fiction no need to waste my time.

[@sage5296]

Seems like the writer of this comment didn't have an intelligence degree. Oh that's not a thing? I'll just live on in ignorance then...

[@NeilRieck]

Updating Apache Struts is not as difficult as stated here. For example, CRA (the Canadian federal tax collection agency) became aware of the problem in the middle of tax-collection season then took down their web servers over a weekend to update public-facing machines. IMHO the problem lies with the amount of out-sourcing; in-house people familiar with in-house applications would be able to use the vulnerability announcement to trigger an immediate plan of remediation. When work is outsourced, this job would fall on the higher-ups who might not know anything about the nuts-and-bolts of any particular software application.

[@StinklesAFI]

They most likely just didn't bother because of cost from downtime or labor. Almost every breach lately is because a company sacrificed security to cut costs.

[@gurnardherded3539]

KZbin: *Tells me there are only 2 comments but actually has hundreds* Me: "No... No you dont do that..."

[@rickybonezz9794]

I hear project mayhem chanting, " his name is Robert Paulson!" already

[@incognito8448]

This happened in July they waited until September three members from cyber security to executives sold their stocks off three days before releasing the information about the breach.A whole lot of people need to be in prison and equifa should be liquidated to the ground and all procedes delivered to the victims all of them.

[@ethanalexander7957]

Sonia had it inside of her for 550 million years? She's a trooper!

[@JoshuaHillerup]

A better question is why the upper management at Equifax isn't currently facing serious jailtime.

[@jesse799]

Aww jeez I thought the world was ending today it got me working up some real anxiety over here you know...

[@anselmschueler]

2:50 What about Vista?

[@plonk420]

they forgot to mention that Equifax also had a server with a username and password of "admin/admin"

[@wieldys9755]

Watching in 2021 be like "hey look its hank green my favorite tiktoker"

[@CarlosBenjamin]

I have zero confidence that Equifax will apply the new patch correctly since they’ve also directed customers to a phishing site rather than their own site since the breech.

[@happyfacefries]

This video is so true. "Credit scores determine how hard it is to get a loan." YES. "Equifax went oops!" YESSSSSSSSSSSSSSSS

[@michaelnichelson3423]

Did Hank just say Lycan? Like as in a werewolf????!!! LOL!!!!

[@deadaccount2968]

He said lichen. As in moss.

[@gwoody20]

I was wondering if scishow would post something about equifax

[@GojiGuru]

A quick heads-up: The photo you show of the Ediacaran period is a model from the Smithsonian museum, but unfortunately it is slightly inaccurate; it erroneously depicts jellyfish because of a misinterpretation of a fossil that turned out to not be jellyfish. Will anyone outside of Ediacaran paleoanthropologists notice? Likely not. But accuracy in even the smallest details says a lot.

[@atomicbaskets]

Just adds credence to my non belief in the credit score system, boiling down people to just a number is not a healthy concept. We are so much more than can currently be represented in a digital system

[@KyngD469]

atomicbaskets there are 7 billion of us. what is your solution????

[@Thumbsupurbum]

There are other credit rating systems. I don't know much about China's social credit system, but maybe it's worth looking at for inspiration on a reformed western version. The little I do know about social credit wouldn't fly in the US ever, but maybe some modified version could.

[@MephLeo]

Having a financial system based on credit to which the mere hint of a lack of thrust can bring a complete meltdown is the actual thing that brings me into thinking we might be doing something wrong with our economic model...

[@atomicbaskets]

Ni Tian Fund space exploration and move towards a post scarcity economy

[@seanp1315]

atomicbaskets it's like you answered a question no one asked. How is it that a lender will determine creditworthiness on a massive scale if not with a scoring model based on previous history? Please, tell us... You understand the need to fund space programs does not negate people's need to borrow money to buy vehicles and homes right?

[@mr.w4ttz586]

Basically the exploit made Apache say to WordPress "Hold my beer."

[@cassandraw8390]

I like to get an explanation of stuff like the Equifax thing. I got very little information before this and it sounded very generically terrifying.

[@emmah1408]

Thats Why you should always update at soon as possibel.

[@jerrylwinston]

Hank tells me about Dickinsonia right after i just saw Life!!!

[@Will-oj3un]

Fight Club: Now, should we initiate a recall? Take the number of vehicles in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of-court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one.

[@eivilcow33]

you forgot to mention that one of the databases has the admin credentials "Admin" "Admin" for username and password

[@dragonfist]

this is what happen when you are hiring security manager with major in Music, just because equality

[@skagerstrom]

Wait til' you'll see it's relatives Dickinelisabeth, Dickinamy, Dickinmaria - and the elusive Dickincraig!

[@stalelemonproduction]

Equifax actually used to be a company that was closed due to consumer lawsuits

[@roxannechrister6626]

Dickinsonia Fossils: Also this week ... Turkish state high school curriculum removes the theory of evolution from its biology curriculum. No, I'm not joking, they actually did. Said it was too complicated for high schoolers. I teach high school science and I call BS.

[@versus-7087]

Hank seems pissed

[@gutterball10]

I believe the Coriolis effect is responsible for the direction a hurricane will spin

[@kwennemar]

Like all big corporations, they chose not to hire enough of those expensive and unnecessary Security IT staff because they wanted bigger bonuses.

[@DaniDreamer95]

How does relative time effect long term space travel?

[@Tinyflower1]

I will never understand the american fixation with credit cards. Here in europe its not common to have one, you either pay cash or with debit cards, your own money. You also don't need a credit card for online shopping here, and you can't even pay with a credit card at some places because they simply won't accept it. You also don't need one for loans (also not common for people to take loans) or for making phone contracts etc

[@patrickmccurry1563]

We have to pay medical bills. It's almost impossible to get big loans for those.

[@kd1s]

Consider Equifax CSO was a music major. And did they not have a UAT to test the updates on before deployment. I say apply the Apache Struts patch on there see what breaks and fix those. Pretty simple.

[@LividImp]

"Consider Equifax CSO was a music major." Probably someone's tennis buddy or something. The amount of nepotism at the high end of business is sickening.

[@kd1s]

Yeah I now. I know all the wrong people I guess. Here I am an I.T./I.S. professional. That's how I know about UAT, good infosec policy, etc.

[@LividImp]

Yup. I have decades of various techie work under my belt, and in all that time I had one supervisor that was competent in his field. And upper management? You couldn't get so much as a "Hello World" out of them. One of the reasons I'm a stay at home dad now is how disillusioned I've become towards the industry. Not saying there aren't any competent management out there, but they're rarer than they should be.

[@kd1s]

Yup - exactly why I've started investing in real estate, crypto currency etc. I want to be retired by age 55. By that point I'll have done approximately 27 years in tech support, I.S., I.T. and the level of stupidity has finally begun getting to me. I'll stay at home and build stuff - I like doing that.

[@MephLeo]

No no no! What are ya'll implying? That the private sector isn't as competent to manage itself as liberalism says it is? What sort of a communistic rebellious ungrateful reasonable people that can see through ideology are you guys?

[@thstroyur]

3:21 So we haven't discovered evidence of the Old Ones... yet

[@thomasr6732]

Haha, sucks to be an adult

[@ABitOfTheUniverse]

It's not so bad, we're just big kids, really.

[@traplover6357]

Sucks to be a kid if your parent's wealth just disappeared.

[@MephLeo]

It does to some extent, you have to provide your own food and shelter and pay for your own amusement instead of relying on other people to do so. But on the other side, an adult has way, waaaay more options as to how he may attend to those needs, even if adults mostly stick to just fancier versions of the same options kids have. So, yeah, it mostly sucks.

[@VGCHANEL]

As a teen it scares me knowing that I'm gonna have so many responsibilities and if I do something wrong I can lose all my money

[@VGCHANEL]

But like, losing money to the point of losing everything I have

[@Chrome166]

Really bureaucratic companies often can only blanket update their software dependencies once or twice a year. Not saying that's excusable, but that's probably why. Definitely should have a fast-track for security vulnerabilities, to say the least.

[@sent4dc]

My hope is that by the time this Equihax breach is sorted out ... there'll be no Equifax. (It can join Enron in my view.)

[@davidhyer3404]

Could it be because the person at equifax has a music degree and possibly has no idea what the hell they are doing?

[@austinwarden9148]

Isn't that closer to an SQL Injection? Or am I thinking about it wrong?

[@pieeyed-piper2186]

Thats gunna be one hell of a witch hunt

[@TroubleBKC]

BUT HOW did they know they were juvenile or adults? It seems that would be very difficult while not even knowing if you are dealing with a plant or animal.

[@ZachBrannigan]

They have a music major for their security chief, so that would explain alot of their negligence and poor guidance.

[@sage5296]

That position is one where you get experience from employment not from schooling

[@wowulam7411]

@@sage5296 There's actually a Subject about Network Security in IT courses. Depending on what you are majoring in.

[@rayzorray4151]

i couldnt understand why all of a sudden im offeted credit cards un loans . . yeah to Equafax ive suddenly got a faultless credit history yiiiippeee.

[@Silentspeaker3]

I'll hazard a guess that it involves Hadley cells and the rotation of the earth...

[@thomaschase1719]

I doubt they'll go into bankruptcy or if they could golden parachutes could challenge monarch butterfly type events

[@spacebike420]

why can't these be split into two videos?

[@marcthomas8458]

Mr Robot was that you?

[@MarinusMakesStuff]

It's so sad that Brilliant cost so much to become a member.

[@IbisFernandez]

How does this affect people with crappy credit anyway?

[@Kizmirazz]

Froze my credit case closed

[@Kizmirazz]

MOI TV first go to the Equifax website and find the link to check to see if you were affected. I was. Then run a credit report from all three credit departments to make sure everything is good. Then on each of their websites they have a link to where you can freeze your credit. Freezing your credit, offers the best way to lock down your credit,when frozen you can still build credit but you can't take out any loans, apply for credit cards, mortgages etc.so if someone has your info it's virtually useless because they can't establish anything with it. you are given a 16 digit pin at the time you freeze your credit that only you know and that's the only way to unlock it. There is a fee of $10 to lock and unlock Equifax is free but $10 is pennies compared to being robbed out of thousands of dollars

I don't think Sonia ever approved on the honor of having the creature named (also) after her..

[@LimakPan]

It really tips me off when a patreon-driven show dips into advertisments anyway.

[@KitMagnification]

What about the Blueborne malware?