1 00:00:01,020 --> 00:00:03,968 there are lessons we can all learn from what happened to 2 00:00:03,968 --> 00:00:06,188 last pass and their customers. 3 00:00:06,608 --> 00:00:08,258 It's a complicated story. 4 00:00:08,468 --> 00:00:13,226 We do our best to boil it down to the essentials and to the lessons that we 5 00:00:13,226 --> 00:00:15,266 can learn from what happened to them. 6 00:00:15,596 --> 00:00:16,766 Hope you enjoy the episode. 7 00:00:38,191 --> 00:00:41,371 W. Curtis Preston: hi, and welcome to Backup Central's Restore All podcast. 8 00:00:41,376 --> 00:00:43,921 I'm your host, w Curtis Preston, aka Mr. 9 00:00:44,221 --> 00:00:44,851 Backup. 10 00:00:45,811 --> 00:00:50,866 And I have with me, uh, a guy who I think is gonna be. 11 00:00:52,091 --> 00:00:56,071 , very excited as he lives vicariously through me over the next few months. 12 00:00:57,751 --> 00:01:02,611 my, my electronic enthusiast Prasanna Malaiyandi how's it going? 13 00:01:03,251 --> 00:01:04,041 Prasanna, 14 00:01:04,651 --> 00:01:08,941 Prasanna Malaiyandi: I'm good, I'm always willing to spend other people's money, so 15 00:01:10,951 --> 00:01:11,941 or getting people to spend 16 00:01:12,061 --> 00:01:12,451 W. Curtis Preston: say that. 17 00:01:12,451 --> 00:01:16,501 This is like your, your exciting part of watching other people 18 00:01:17,221 --> 00:01:19,011 sort of work through their. 19 00:01:20,161 --> 00:01:21,001 spend their money. 20 00:01:21,051 --> 00:01:23,151 Prasanna Malaiyandi: And it's what makes you happy, right? 21 00:01:23,181 --> 00:01:25,581 So it's like you're starting a project. 22 00:01:26,421 --> 00:01:26,541 No. 23 00:01:26,541 --> 00:01:28,791 Well, you're starting a project for enjoyment, right? 24 00:01:28,791 --> 00:01:30,141 I think everything, sorry. 25 00:01:30,141 --> 00:01:34,701 Most things in life that you do to improve your life costs money. 26 00:01:34,911 --> 00:01:39,066 So, There are some things that don't, of course, but there are some things 27 00:01:39,066 --> 00:01:40,476 where you're like, yeah, I work. 28 00:01:40,476 --> 00:01:44,616 I earn, I spend a lot of time working and putting in the time. 29 00:01:44,646 --> 00:01:46,716 There should be certain things which I should spend money on 30 00:01:48,681 --> 00:01:51,931 W. Curtis Preston: So I'm probably going to buy what is referred to as 31 00:01:51,931 --> 00:01:56,251 an ultra short throw, um, laser tv. 32 00:01:56,881 --> 00:02:05,761 And, um, well, they, so in the, in the biz, they're, they call this a laser tv. 33 00:02:06,621 --> 00:02:09,391 I, I don't know why, but it is a projector, right? 34 00:02:09,661 --> 00:02:12,061 It's a screen and a projector and they're like, it's a laser 35 00:02:12,061 --> 00:02:14,191 TV cuz it's lasers, but whatever. 36 00:02:14,671 --> 00:02:17,371 Um, but that's what everybody calls it, right? 37 00:02:17,881 --> 00:02:21,301 Um, but yeah, it's not gonna be cheap. 38 00:02:21,616 --> 00:02:23,986 Right, because I want a ginormous screen. 39 00:02:23,986 --> 00:02:25,996 I'm looking at it 120 inch screen. 40 00:02:26,656 --> 00:02:33,016 Um, and, uh, I am most likely going to be buying, uh, I've already looked. 41 00:02:33,196 --> 00:02:36,526 I'm gonna be buying basically last year's model, what is now last year's 42 00:02:36,526 --> 00:02:40,276 model, because c e s was just a few weeks ago, or actually just last 43 00:02:40,276 --> 00:02:43,676 week, I've already looked at the reviews of the stuff that people. 44 00:02:44,391 --> 00:02:47,881 In, in ces and I'm like, yeah, I'm not paying for that. 45 00:02:48,181 --> 00:02:48,601 Right. 46 00:02:48,661 --> 00:02:53,881 Um, look, looking at stuff that's like double the price of what I'm looking at. 47 00:02:54,691 --> 00:02:59,161 I will say the most frustrating part in terms of like looking at reviews 48 00:02:59,161 --> 00:03:07,591 and stuff, um, has been the soundbar part, um, is the different levels of 49 00:03:07,741 --> 00:03:13,546 it's, it's, Like with, with, with the projector, there is hands down, a winner. 50 00:03:13,756 --> 00:03:14,986 Everybody agrees. 51 00:03:15,376 --> 00:03:16,276 Bang for the buck. 52 00:03:16,276 --> 00:03:19,066 It's this four movie theater. 53 00:03:19,096 --> 00:03:20,266 That's the, the name of it. 54 00:03:20,266 --> 00:03:23,806 It's actually like a, I think it's actually We Max that makes it, but 55 00:03:23,806 --> 00:03:25,486 they've branded it for the US market. 56 00:03:25,486 --> 00:03:26,746 The brand is four movie. 57 00:03:27,361 --> 00:03:32,011 , that's the name of the brand and the name of the thing I'm buying is theater. 58 00:03:32,341 --> 00:03:34,351 The four movie theater. 59 00:03:34,501 --> 00:03:36,871 It's a little hokey, but everyone agrees. 60 00:03:36,871 --> 00:03:39,961 It li like it, it, it literally universally, everyone agrees. 61 00:03:39,961 --> 00:03:41,101 So that's the easy part. 62 00:03:41,431 --> 00:03:43,281 They also generally agree on the screen. 63 00:03:43,891 --> 00:03:50,221 Um, you know, a, um, a, what do they call, an ambient light rejecting screen 64 00:03:50,371 --> 00:03:54,181 that is designed for u s t projectors. 65 00:03:54,361 --> 00:03:59,911 Um, but when we get into the soundbar part, um, first 66 00:03:59,911 --> 00:04:01,531 off, they cost way too much. 67 00:04:01,831 --> 00:04:02,791 Second, 68 00:04:02,926 --> 00:04:04,876 Prasanna Malaiyandi: It's all relative, Curtis. 69 00:04:05,746 --> 00:04:07,666 W. Curtis Preston: it's so, it is so relative, right? 70 00:04:07,666 --> 00:04:10,636 And you watch these different reviews, you're like, okay, I think, I think 71 00:04:10,636 --> 00:04:12,346 I've, I think I've zoomed in on it. 72 00:04:12,526 --> 00:04:15,706 And then you read, and then you watch a couple of other reviews and 73 00:04:15,706 --> 00:04:17,626 they're like, oh, this one's crap. 74 00:04:17,926 --> 00:04:21,286 This one's, yeah, well, it's good, but it sounds a little tweety. 75 00:04:21,286 --> 00:04:23,776 It sounds a little, you know, this and that. 76 00:04:23,781 --> 00:04:24,136 Prasanna Malaiyandi: so 77 00:04:24,256 --> 00:04:27,076 W. Curtis Preston: it's not, it's speakers, it's surround speakers 78 00:04:27,076 --> 00:04:32,866 are not nearly as good as the Samsung nine 90 T Biggie r. 79 00:04:33,246 --> 00:04:34,956 You're like, all right, lemme go check that one out. 80 00:04:34,956 --> 00:04:36,996 And then you, you know, and, um, 81 00:04:37,381 --> 00:04:39,031 Prasanna Malaiyandi: How far down the rabbit hole did you end up 82 00:04:39,156 --> 00:04:39,366 W. Curtis Preston: I. 83 00:04:41,716 --> 00:04:44,026 Well, I, well, I know this. 84 00:04:44,026 --> 00:04:47,206 I don't want to buy the thing that I saw the guy review. 85 00:04:47,236 --> 00:04:48,916 Well, actually, let me rephrase that. 86 00:04:48,916 --> 00:04:52,276 I do want to buy the thing that I saw the guy review from c e 87 00:04:52,396 --> 00:04:54,826 s, which is the what, what's the 88 00:04:54,901 --> 00:04:57,571 Prasanna Malaiyandi: the, the Nachi Nachi Dragon. 89 00:04:57,906 --> 00:04:58,466 W. Curtis Preston: nakai? 90 00:04:58,846 --> 00:05:02,866 The nachi dragon that he basically said it's the greatest 91 00:05:02,871 --> 00:05:03,946 sound system he is ever seen. 92 00:05:04,336 --> 00:05:07,346 Uh, but it's $3,500, which I. 93 00:05:08,521 --> 00:05:12,031 Basically about two x of what I think I'll probably be spending. 94 00:05:12,211 --> 00:05:18,421 Um, uh, I think I've ended up with the Samsung so far mentally where I'm at 95 00:05:18,421 --> 00:05:22,861 as the Samsung H W Q nine 90 B, which 96 00:05:22,876 --> 00:05:24,106 Prasanna Malaiyandi: Is that the one I told you? 97 00:05:24,391 --> 00:05:25,021 W. Curtis Preston: system. 98 00:05:25,891 --> 00:05:27,751 Is it really the one you told me when I started? 99 00:05:28,636 --> 00:05:29,416 Prasanna Malaiyandi: I think it was. 100 00:05:29,446 --> 00:05:30,211 W. Curtis Preston: Yeah, that's interesting. 101 00:05:30,671 --> 00:05:32,561 We've, we've talked about this enough already. 102 00:05:32,981 --> 00:05:36,941 Uh, I want to go to something that is, that is 103 00:05:37,186 --> 00:05:37,986 Prasanna Malaiyandi: this is more fun. 104 00:05:37,991 --> 00:05:38,591 W. Curtis Preston: to me. 105 00:05:40,271 --> 00:05:41,516 Yeah, it is, it is more fun. 106 00:05:41,516 --> 00:05:43,106 It is more fun to talk about. 107 00:05:43,256 --> 00:05:45,566 But we're here today to talk about. 108 00:05:47,701 --> 00:05:48,581 Password manager. 109 00:05:49,001 --> 00:05:53,381 You know, we, we've, we've spoken about password managers, pr, what 110 00:05:53,381 --> 00:05:54,851 do we think of Password managers? 111 00:05:55,076 --> 00:05:56,246 Prasanna Malaiyandi: They are awesome. 112 00:05:57,206 --> 00:05:58,676 Everyone should use a password manager. 113 00:05:59,551 --> 00:06:00,911 W. Curtis Preston: everyone should use a password manager. 114 00:06:01,091 --> 00:06:03,851 You should either use a commercial one, like the one I happen to have. 115 00:06:03,851 --> 00:06:06,611 I happen to have, uh, dash lane, not sponsored. 116 00:06:06,851 --> 00:06:08,921 You have like an open source 117 00:06:09,046 --> 00:06:10,676 Prasanna Malaiyandi: Yeah, I use Key Pass. 118 00:06:10,706 --> 00:06:10,946 Yep. 119 00:06:10,946 --> 00:06:11,486 I use Key 120 00:06:11,651 --> 00:06:11,951 W. Curtis Preston: Yeah. 121 00:06:11,981 --> 00:06:12,191 Key 122 00:06:12,196 --> 00:06:12,791 pass. 123 00:06:13,061 --> 00:06:13,451 Yeah. 124 00:06:13,496 --> 00:06:15,866 Prasanna Malaiyandi: In fact, didn't we do an episode where we talked 125 00:06:16,166 --> 00:06:17,606 W. Curtis Preston: We did, we did an episode where we 126 00:06:17,606 --> 00:06:18,506 talked about these different 127 00:06:18,761 --> 00:06:20,831 Prasanna Malaiyandi: With, yeah, with Chris Haner. 128 00:06:20,921 --> 00:06:22,301 Why you need a password manager? 129 00:06:22,301 --> 00:06:23,321 Episode 1 68. 130 00:06:23,426 --> 00:06:23,846 W. Curtis Preston: Yeah. 131 00:06:23,876 --> 00:06:24,296 Yeah. 132 00:06:24,536 --> 00:06:30,086 So we're huge fans of password managers and last pass, uh, generally 133 00:06:30,091 --> 00:06:31,676 ha, you know, has a good design. 134 00:06:32,486 --> 00:06:37,856 Um, having said that, I think they made some, some really big mistakes. 135 00:06:38,396 --> 00:06:42,716 Given the number of companies that have been hacked, will be hacked, 136 00:06:42,716 --> 00:06:46,106 especially when we, when we start looking at ransomware, I don't 137 00:06:46,106 --> 00:06:50,006 think that a company should be dinged just because they got hacked. 138 00:06:51,296 --> 00:06:51,596 Prasanna Malaiyandi: Yep. 139 00:06:51,956 --> 00:06:52,316 Yep. 140 00:06:52,316 --> 00:06:53,316 W. Curtis Preston: do you, do you agree with that? 141 00:06:53,426 --> 00:06:54,626 Prasanna Malaiyandi: I a hundred percent agree. 142 00:06:54,626 --> 00:06:55,976 It's there. 143 00:06:55,976 --> 00:07:00,346 It's so hard to stay on top of everything, especially given a service you operate. 144 00:07:01,046 --> 00:07:05,486 And so there will be zero day exploits and other things that you can't plan for. 145 00:07:05,486 --> 00:07:05,756 Right. 146 00:07:05,756 --> 00:07:09,026 And they happen and it's just how quickly can you jump on top 147 00:07:09,026 --> 00:07:10,466 when something like that happens? 148 00:07:11,216 --> 00:07:11,486 Right. 149 00:07:11,486 --> 00:07:14,666 So we shouldn't ding 'em just because they may be hacked. 150 00:07:14,786 --> 00:07:15,146 Right. 151 00:07:16,676 --> 00:07:17,036 W. Curtis Preston: Having 152 00:07:17,246 --> 00:07:21,746 Prasanna Malaiyandi: But but I sets a 153 00:07:21,746 --> 00:07:27,296 W. Curtis Preston: can d we can ding companies for why they got hacked, right? 154 00:07:27,416 --> 00:07:30,986 If you got hacked, right, if your identity got stolen because 155 00:07:30,991 --> 00:07:34,106 you painted your social security number on the front of your house, 156 00:07:35,351 --> 00:07:35,651 Prasanna Malaiyandi: Yeah. 157 00:07:35,816 --> 00:07:36,416 W. Curtis Preston: an idiot, 158 00:07:36,851 --> 00:07:39,671 Prasanna Malaiyandi: Or you create an S3 bucket that you left public. 159 00:07:40,826 --> 00:07:44,666 W. Curtis Preston: if you do something like that, Then, you know, we're just, 160 00:07:44,696 --> 00:07:46,376 we're just gonna make fun of you, right? 161 00:07:46,376 --> 00:07:47,546 We're just gonna bring you on. 162 00:07:48,356 --> 00:07:52,826 And this is one of those things, you know, the, the, I, I was looking 163 00:07:52,826 --> 00:07:59,366 at the Wired article about this, and their headline was basically, I 164 00:07:59,371 --> 00:08:01,046 mean, here's some headlines, right? 165 00:08:01,046 --> 00:08:06,626 So, uh, from Mashable Last Pass reveals just how bad that August breach was. 166 00:08:06,866 --> 00:08:08,306 It was bad. 167 00:08:08,786 --> 00:08:16,121 Um, The, the wired article basically said, it's time to dump this password manager. 168 00:08:16,751 --> 00:08:22,001 And that's a strong statement, but I have to say, based on the things 169 00:08:22,001 --> 00:08:26,501 that we're gonna talk about in this episode, uh, again, I, I was already a 170 00:08:26,501 --> 00:08:32,286 customer of another, of another company, but it seriously draws into question. 171 00:08:33,081 --> 00:08:37,581 Some of their thought processes and, and, and lack of processes. 172 00:08:37,631 --> 00:08:40,481 Prasanna Malaiyandi: And just for people who aren't familiar, just think of like 173 00:08:40,481 --> 00:08:43,931 all the passwords for all your financial institutions and everything else, right? 174 00:08:44,321 --> 00:08:47,801 You're trusting the keys to the kingdom about you and everything you 175 00:08:47,806 --> 00:08:50,261 have access to, to a company, right? 176 00:08:50,951 --> 00:08:55,121 Everything's in a single, centralized place if something happens, if that data 177 00:08:55,121 --> 00:09:00,941 is, if that company is breached and the data is stolen, right, there's all your 178 00:09:01,401 --> 00:09:02,741 passwords for everything that's out there. 179 00:09:03,731 --> 00:09:04,811 W. Curtis Preston: I'll just put this right. 180 00:09:04,811 --> 00:09:06,101 I'll just put this right now. 181 00:09:06,341 --> 00:09:11,681 If you're a LastPass customer and your, and the length of your password isn't 182 00:09:11,681 --> 00:09:15,221 good enough, they your, your data's gone. 183 00:09:16,236 --> 00:09:16,571 . Right? 184 00:09:16,661 --> 00:09:21,491 And you need to go and change all meaning that your data has now been, it, it, 185 00:09:21,491 --> 00:09:23,531 it, it should, you should be assumed. 186 00:09:23,831 --> 00:09:25,811 Cuz that's basically what they told their customers. 187 00:09:26,111 --> 00:09:32,621 They basically said, you know, if you've got, um, you know, uh, a password that's 188 00:09:32,711 --> 00:09:38,621 that's not of, of a certain length, then um, it's gonna be, you know, it's 189 00:09:38,621 --> 00:09:40,301 gonna be easily g where, where are 190 00:09:40,336 --> 00:09:41,206 Prasanna Malaiyandi: Or, or, or 191 00:09:41,206 --> 00:09:42,491 W. Curtis Preston: Prasanna, in terms. 192 00:09:44,216 --> 00:09:45,071 of the, 193 00:09:45,341 --> 00:09:47,801 of the, um, yeah. 194 00:09:47,801 --> 00:09:50,861 What's, what's the recommended minimum password length these days? 195 00:09:51,666 --> 00:09:52,636 Prasanna Malaiyandi: I don't know. 196 00:09:53,231 --> 00:09:54,671 I am actually not sure. 197 00:09:54,671 --> 00:09:57,871 I always just figure out like if I'm creating a password, whatever 198 00:09:57,871 --> 00:10:03,431 the max password is on a website, and I just use that, right? 199 00:10:03,581 --> 00:10:06,401 So for me it always varies, right? 200 00:10:06,461 --> 00:10:09,371 I always just err on the side of whatever's the largest. 201 00:10:10,601 --> 00:10:12,021 W. Curtis Preston: Here's the one I was looking for. 202 00:10:14,646 --> 00:10:15,426 There's a chart. 203 00:10:15,606 --> 00:10:16,176 Here it is. 204 00:10:16,176 --> 00:10:17,106 Yeah, this is it. 205 00:10:17,196 --> 00:10:17,646 Okay. 206 00:10:18,636 --> 00:10:23,316 Number of characters, assuming that you're using upper and 207 00:10:23,316 --> 00:10:28,326 lowercase and a number, right? 208 00:10:28,326 --> 00:10:28,606 Prasanna Malaiyandi: Mm-hmm. 209 00:10:29,646 --> 00:10:35,736 W. Curtis Preston: Uh, I mean, I, I can, can we agree that we should not have any 210 00:10:36,376 --> 00:10:43,671 thing measured in months or . So basically the question is, if you have numbers, 211 00:10:43,731 --> 00:10:50,412 upper and lowercase nu letters, how long will it take modern, um, computers to 212 00:10:50,417 --> 00:10:53,031 do a brute force guess of your password? 213 00:10:53,451 --> 00:10:58,971 And today, if you're a 10 character password, it's seven months. 214 00:10:59,511 --> 00:11:03,081 If you're an eight character password, it's one hour. 215 00:11:04,731 --> 00:11:05,121 right? 216 00:11:05,121 --> 00:11:09,561 If you have an eight character password with numbers, upper and lower case, by 217 00:11:09,561 --> 00:11:13,881 the way, if you add symbols to that, it goes from one hour to eight hours. 218 00:11:14,241 --> 00:11:17,451 So an eight character password with all of the stuff that you're 219 00:11:17,456 --> 00:11:20,901 supposed to have in it is guessable in eight hours with modern technology. 220 00:11:21,591 --> 00:11:24,441 So I, I would, I like numbers like. 221 00:11:26,841 --> 00:11:30,711 2000 years, a hundred thousand years, right? 222 00:11:31,161 --> 00:11:36,381 Um, and that those start appearing around 13 characters, right? 223 00:11:36,471 --> 00:11:42,741 Um, according to this, an 18 character password, um, , I like this. 224 00:11:42,951 --> 00:11:47,451 An 18 character password with numbers, upper and lowercase and symbols is 225 00:11:47,451 --> 00:11:50,361 seven quadrillion years to guess. 226 00:11:51,451 --> 00:11:55,291 So, what I've been doing is I've set my password length to 20 in 227 00:11:55,291 --> 00:12:00,211 dash lane and, uh, and obviously I have to rein that back occasionally 228 00:12:00,211 --> 00:12:01,561 when I get to a stupid website. 229 00:12:01,921 --> 00:12:02,411 Prasanna Malaiyandi: Yeah. 230 00:12:03,031 --> 00:12:07,021 W. Curtis Preston: Um, yeah, so basically if you, if, if your password, 231 00:12:07,021 --> 00:12:13,501 I'm gonna say if your password is under 10 characters, then you need to. 232 00:12:14,776 --> 00:12:17,326 Changing all your passwords now, if you're a last port, if you're a 233 00:12:17,326 --> 00:12:20,086 last pass customers, now we should, we need to talk about why, but I 234 00:12:20,086 --> 00:12:21,226 just wanna scare the crap out of 235 00:12:21,226 --> 00:12:21,526 you 236 00:12:22,216 --> 00:12:24,946 Prasanna Malaiyandi: I thought there was, I thought there was also another 237 00:12:24,946 --> 00:12:27,556 thing that they had mentioned of, maybe we'll talk about this later, maybe 238 00:12:27,556 --> 00:12:32,516 not, that they had used a different crypto algorithm in the beginning. 239 00:12:32,516 --> 00:12:35,246 So if you have really old passwords, it would 240 00:12:35,256 --> 00:12:36,046 W. Curtis Preston: Oh, that's right. 241 00:12:36,146 --> 00:12:38,576 Prasanna Malaiyandi: standard than newer passwords. 242 00:12:38,576 --> 00:12:42,986 So even if you have 24 characters or whatever else, if it's a password that 243 00:12:43,046 --> 00:12:47,156 was, I don't know what the timeframe was for that password or when they did 244 00:12:47,156 --> 00:12:49,766 that switch, but if you have an old password, you should probably change it. 245 00:12:49,806 --> 00:12:52,626 W. Curtis Preston: So let's talk about what, where this started at. 246 00:12:53,526 --> 00:12:55,056 Um, and that 247 00:12:55,116 --> 00:12:56,046 Prasanna Malaiyandi: in the day, 248 00:12:56,256 --> 00:12:57,696 W. Curtis Preston: hack, right? 249 00:12:58,446 --> 00:13:01,626 Um, so there, 250 00:13:01,656 --> 00:13:03,036 Prasanna Malaiyandi: But ju, do you wanna actually talk about 251 00:13:03,036 --> 00:13:04,126 it before the August hack? 252 00:13:05,646 --> 00:13:07,236 W. Curtis Preston: what, what do you mean? 253 00:13:07,611 --> 00:13:10,251 Prasanna Malaiyandi: Because are you gonna talk specifically about last 254 00:13:10,251 --> 00:13:11,961 pass breach that happened in August? 255 00:13:12,201 --> 00:13:15,111 Or do you also want to talk about, because before the last pass breach, 256 00:13:15,111 --> 00:13:17,271 right, there was the Twilio breach 257 00:13:17,481 --> 00:13:19,491 W. Curtis Preston: Twi Twilio breach right there. 258 00:13:19,521 --> 00:13:23,601 Well, there was Twilio, but you know, as, as, as far as I can tell, what 259 00:13:23,606 --> 00:13:27,441 it was was it was the same threat actor that did a bunch of similar 260 00:13:27,441 --> 00:13:30,111 attacks that they attacked Twilio. 261 00:13:30,231 --> 00:13:33,081 Which that didn't mean anything to me, cuz to me that was like 262 00:13:33,111 --> 00:13:36,291 some, uh, project management stuff. 263 00:13:36,296 --> 00:13:40,071 And that's when I found out that Twilio owned Athie, guess who uses Athie? 264 00:13:40,251 --> 00:13:40,881 Hello? 265 00:13:41,301 --> 00:13:45,831 But basically what they did, uh, as far as I can see is they, 266 00:13:45,831 --> 00:13:47,541 they used stolen credentials. 267 00:13:47,811 --> 00:13:51,561 They got into the network, they were able to bad bypass MFA in 268 00:13:51,561 --> 00:13:55,311 some way, and they were able to spend some time in the network. 269 00:13:56,301 --> 00:13:58,701 And, uh, last pass. 270 00:14:00,271 --> 00:14:04,191 The only credit I'm going to give to last pass is that they were 271 00:14:04,191 --> 00:14:07,761 upfront about what happened, right? 272 00:14:07,891 --> 00:14:09,361 So they were, but they weren't. 273 00:14:09,781 --> 00:14:13,381 So they said that they, they had, they had able, they'd been 274 00:14:13,386 --> 00:14:15,421 able to steal some source code. 275 00:14:16,251 --> 00:14:16,426 Prasanna Malaiyandi: Yep. 276 00:14:16,791 --> 00:14:19,471 W. Curtis Preston: And at first that's very concerning because the source code 277 00:14:19,471 --> 00:14:25,141 could include source code of, of the, the product itself and somehow figure out 278 00:14:25,876 --> 00:14:27,506 Prasanna Malaiyandi: Like exploits and weakness. 279 00:14:27,811 --> 00:14:28,171 W. Curtis Preston: Right? 280 00:14:28,861 --> 00:14:35,221 But the source code that we now know what, again, this is all at everything 281 00:14:35,221 --> 00:14:40,621 I'm saying in this podcast is it appears, what it looks like they did was they 282 00:14:40,621 --> 00:14:44,821 stole the source code of a script. 283 00:14:45,946 --> 00:14:48,736 that was being used for backup. 284 00:14:49,966 --> 00:14:52,876 Which, uh, what do you think? 285 00:14:52,876 --> 00:14:58,936 I think Prasanna about a company that's a 200 million company 286 00:14:59,536 --> 00:15:02,536 that's doing backups with a script. 287 00:15:02,716 --> 00:15:04,126 And what was in this script? 288 00:15:04,696 --> 00:15:07,156 Mind you, what was in the script? 289 00:15:07,816 --> 00:15:08,686 Credentials. 290 00:15:08,776 --> 00:15:10,786 So hard coded credentials. 291 00:15:11,176 --> 00:15:12,466 So what do you think? 292 00:15:14,101 --> 00:15:18,781 Prasanna Malaiyandi: Yeah, so, so the, so a, they shouldn't have been doing that. 293 00:15:18,781 --> 00:15:19,891 That's ridiculous. 294 00:15:20,191 --> 00:15:22,651 But I will give them credit for one aspect. 295 00:15:22,656 --> 00:15:22,981 Right. 296 00:15:23,311 --> 00:15:26,101 I know a lot of times, and maybe you should throw out 297 00:15:26,106 --> 00:15:27,841 our disclaimer here, right? 298 00:15:27,991 --> 00:15:32,851 But I know a lot of times we talk about, um, actually, why 299 00:15:32,851 --> 00:15:33,601 don't you do the disclaimer. 300 00:15:35,071 --> 00:15:35,551 W. Curtis Preston: All right. 301 00:15:35,611 --> 00:15:38,611 So, uh, Prasanna and I work for different companies. 302 00:15:38,971 --> 00:15:41,731 This is not, uh, an official podcast of either company. 303 00:15:41,731 --> 00:15:43,321 He works for Zoom, I work for Druva. 304 00:15:43,801 --> 00:15:48,661 And we're just a couple of dudes, gibber Javen about our opinions about stuff. 305 00:15:48,666 --> 00:15:53,671 And these do not necessarily reflect the opinions of our respective employers. 306 00:15:54,031 --> 00:15:56,941 And, uh, if you wanna join the conversation, this one or any other 307 00:15:56,941 --> 00:15:58,561 conversation, you feel free to reach out. 308 00:15:59,091 --> 00:16:02,691 W Curtis Preston gmail or WC Preston on Twitter. 309 00:16:03,201 --> 00:16:06,531 And, uh, I, I might get a, I might get a new Twitter name. 310 00:16:06,531 --> 00:16:08,271 I hear they're, they're auctioning them off. 311 00:16:08,271 --> 00:16:08,361 I 312 00:16:08,361 --> 00:16:10,971 might, you know, a couple, couple million dollars and I'll, 313 00:16:11,031 --> 00:16:12,801 I'll buy a Twitter name, but, 314 00:16:12,861 --> 00:16:13,816 Prasanna Malaiyandi: Elon Musk, 315 00:16:15,161 --> 00:16:16,401 W. Curtis Preston: I don't think that one's available. 316 00:16:16,941 --> 00:16:19,361 Um, the, uh, 317 00:16:20,486 --> 00:16:21,476 Prasanna Malaiyandi: So, so, 318 00:16:21,591 --> 00:16:23,631 W. Curtis Preston: sure to rate us and subscribe and all that stuff. 319 00:16:23,631 --> 00:16:23,811 Yeah. 320 00:16:23,811 --> 00:16:24,441 So go ahead. 321 00:16:24,886 --> 00:16:26,476 Prasanna Malaiyandi: So going back, so. 322 00:16:27,256 --> 00:16:31,126 I hundred percent agree with you that they should never, like, no one should 323 00:16:31,126 --> 00:16:33,586 be hard coding credentials into a script. 324 00:16:33,646 --> 00:16:34,696 That is ridiculous. 325 00:16:35,356 --> 00:16:36,136 However, 326 00:16:36,256 --> 00:16:37,846 W. Curtis Preston: one, no one should be 327 00:16:38,326 --> 00:16:41,926 a 200 million company should not be doing shell scripts 328 00:16:42,211 --> 00:16:42,631 Prasanna Malaiyandi: Yes. 329 00:16:42,781 --> 00:16:44,431 Well, let me, let me get to 330 00:16:44,596 --> 00:16:45,076 W. Curtis Preston: Okay. 331 00:16:45,136 --> 00:16:46,366 Sorry, I interrupted you. 332 00:16:46,531 --> 00:16:46,891 Prasanna Malaiyandi: yeah. 333 00:16:47,251 --> 00:16:54,631 So yes, there are cases where you want to use automated tools or, uh, a 334 00:16:54,631 --> 00:16:58,951 service out there or a backup product to actually do it properly because 335 00:16:59,221 --> 00:17:00,631 no one wants to focus on backups. 336 00:17:00,631 --> 00:17:03,301 Everyone's gonna do a poor job if they build it themselves because it 337 00:17:03,301 --> 00:17:04,591 never gets a focus on the business. 338 00:17:04,861 --> 00:17:05,701 A hundred percent agree. 339 00:17:06,291 --> 00:17:09,501 However, I will say that there might be certain cases, right? 340 00:17:09,501 --> 00:17:11,841 I don't know what their infrastructure looks like, right? 341 00:17:11,841 --> 00:17:17,211 There might be cases where there is no standalone tool that can satisfy the 342 00:17:17,211 --> 00:17:19,791 needs of what they have right there. 343 00:17:19,791 --> 00:17:21,411 Maybe it's a very, very small percentage. 344 00:17:21,411 --> 00:17:23,991 Maybe they never looked, but I'm just giving them the benefit of the 345 00:17:23,996 --> 00:17:28,641 doubt and saying maybe it didn't work for their environment, and therefore 346 00:17:28,641 --> 00:17:30,261 someone went and wrote a shell script. 347 00:17:32,031 --> 00:17:32,541 That's all I have 348 00:17:32,611 --> 00:17:33,391 W. Curtis Preston: not buying that. 349 00:17:33,871 --> 00:17:38,741 I'm not buying that be because the, the problem, the, the, the, 350 00:17:38,746 --> 00:17:43,761 the area, like I can see that of like maybe they're using Neo 4k and 351 00:17:43,761 --> 00:17:45,921 nobody has a tool to back up Neo 4k. 352 00:17:45,921 --> 00:17:48,381 And so they've got a shell script to back up NEO 4k. 353 00:17:48,891 --> 00:17:52,491 I'll give them that, but that's not where, where the, where the, 354 00:17:52,551 --> 00:17:56,151 where the problem was apparently in actually when it copied to the cloud. 355 00:17:56,331 --> 00:18:01,581 There's a thousand companies, uh, that if you're running, they're most likely 356 00:18:01,581 --> 00:18:03,531 running Linux or something right. 357 00:18:03,531 --> 00:18:04,191 Somewhere. 358 00:18:04,816 --> 00:18:06,256 Prasanna Malaiyandi: uh, oury.net. 359 00:18:06,736 --> 00:18:08,216 Remember we had 360 00:18:08,316 --> 00:18:10,656 W. Curtis Preston: There, there's a bunch of companies and stuff that could 361 00:18:10,656 --> 00:18:13,326 do this without hard coding your stuff. 362 00:18:13,386 --> 00:18:17,076 So ba So I think, I think it's bad that a 200 million company 363 00:18:17,081 --> 00:18:18,186 was using a shell script. 364 00:18:18,336 --> 00:18:25,086 It's super bad that they were using, um, hard coded credentials 365 00:18:25,086 --> 00:18:28,065 in that script . And then, um, and 366 00:18:28,185 --> 00:18:28,995 Prasanna Malaiyandi: You know what's funny? 367 00:18:29,175 --> 00:18:29,655 You know what's funny? 368 00:18:29,655 --> 00:18:29,925 Wait. 369 00:18:30,105 --> 00:18:34,665 But before you get to that, they're a password manager company That is 370 00:18:34,665 --> 00:18:39,075 hard coding passwords, , you know? 371 00:18:39,885 --> 00:18:41,205 Isn't that a little ironic? 372 00:18:43,620 --> 00:18:47,160 W. Curtis Preston: That unlike most of the things in the song, isn't 373 00:18:47,160 --> 00:18:49,500 it ironic, uh, is actually ironic. 374 00:18:49,950 --> 00:18:51,780 That is very ironic, right? 375 00:18:51,990 --> 00:18:54,820 Um, a password management company that didn't. 376 00:18:55,645 --> 00:18:55,890 . Yeah. 377 00:18:55,980 --> 00:18:57,480 That's not, that's not good. 378 00:18:58,290 --> 00:18:58,560 Yeah. 379 00:18:58,560 --> 00:19:04,180 And by the way, what ended up happening is why you don't hardcode passwords 380 00:19:04,220 --> 00:19:08,660 in, uh, and, and, and they use the word token somewhere, you know, it's slightly 381 00:19:08,660 --> 00:19:10,040 different than a password, but whatever. 382 00:19:10,040 --> 00:19:10,790 It's a password. 383 00:19:11,750 --> 00:19:14,960 What happened was we go back to the August breach. 384 00:19:15,020 --> 00:19:18,320 What it, what it looks like happened is they crawled the network. 385 00:19:18,620 --> 00:19:20,570 They were able to grab some source code. 386 00:19:20,570 --> 00:19:24,140 Remember that source code included the script. 387 00:19:24,410 --> 00:19:28,225 The script happened to have credentials to log into the cloud 388 00:19:28,225 --> 00:19:30,235 service where they copy their backups. 389 00:19:30,655 --> 00:19:30,865 Prasanna Malaiyandi: Oh. 390 00:19:31,675 --> 00:19:32,845 W. Curtis Preston: And so guess what? 391 00:19:34,450 --> 00:19:39,520 They, that's what happened is they lo it's the, the, the hackers logged into the 392 00:19:39,520 --> 00:19:45,610 cloud service that they use for backups and they exfiltrated the data, right? 393 00:19:45,670 --> 00:19:47,020 Prasanna Malaiyandi: what was in these backups, 394 00:19:48,190 --> 00:19:49,600 W. Curtis Preston: Well, nothing important. 395 00:19:49,600 --> 00:19:50,990 Really lucky Prasanna. 396 00:19:51,010 --> 00:19:52,600 Luckily, it was nothing important. 397 00:19:52,600 --> 00:19:56,470 It was just everything it was. 398 00:19:56,710 --> 00:20:00,490 It was the customer database, meaning like who are they? 399 00:20:00,550 --> 00:20:01,510 Where do they live? 400 00:20:01,840 --> 00:20:03,340 You know, how do they pay? 401 00:20:03,850 --> 00:20:06,460 What address they live in, all that kind of stuff. 402 00:20:06,700 --> 00:20:11,710 But it was also the actual vault, the actual, the crown jewels, 403 00:20:11,920 --> 00:20:13,690 the usernames and passwords. 404 00:20:14,080 --> 00:20:18,940 Now they are saying that with some caveats that we already talked about a little bit. 405 00:20:19,090 --> 00:20:24,370 They are saying that they, um, that they're there. 406 00:20:24,400 --> 00:20:26,530 That is, that that part is encrypted. 407 00:20:27,100 --> 00:20:27,550 Right? 408 00:20:27,550 --> 00:20:35,680 So the, the chance is that someone, Would be able to steal your password, your 409 00:20:35,680 --> 00:20:41,470 username and password by decrypting your, because the, the, the encryption algorithm 410 00:20:41,500 --> 00:20:46,960 is, it's a hashing mechanism that uses your password as part of the key. 411 00:20:46,960 --> 00:20:47,260 Right? 412 00:20:47,265 --> 00:20:47,680 Uh, it's, 413 00:20:47,760 --> 00:20:48,250 Prasanna Malaiyandi: Like 414 00:20:48,310 --> 00:20:50,170 W. Curtis Preston: I don't know if it's Yeah. 415 00:20:50,175 --> 00:20:51,490 Like the master password. 416 00:20:51,495 --> 00:20:51,700 Right. 417 00:20:52,060 --> 00:20:59,515 Um, and, um, And so in order to decrypt it, someone would have 418 00:20:59,515 --> 00:21:01,045 to guess your master password. 419 00:21:01,675 --> 00:21:05,725 The, um, and that's why we're going back to the beginning. 420 00:21:05,725 --> 00:21:07,825 The question is, how big is your master password? 421 00:21:07,825 --> 00:21:12,025 And also, apparently in the instructions that they sent to customers. 422 00:21:12,325 --> 00:21:16,105 Again, I'm gonna, I'm gonna give th this is the only nice thing I'm gonna say. 423 00:21:16,345 --> 00:21:20,515 At least they were open with their customers as to. 424 00:21:21,130 --> 00:21:23,170 Uh, how things went, right. 425 00:21:23,170 --> 00:21:27,760 Very different, for example, than the, uh, Rackspace hack, right? 426 00:21:27,760 --> 00:21:28,780 The Rackspace hack. 427 00:21:28,780 --> 00:21:31,300 They, they have said very little, even though they've concluded their 428 00:21:31,300 --> 00:21:35,380 investigation, they've said very little, uh, and they've said some things that 429 00:21:35,380 --> 00:21:40,780 I don't think they can back up, whereas last pass really laid it out there. 430 00:21:41,485 --> 00:21:42,685 they're like, here's what happened. 431 00:21:42,835 --> 00:21:45,235 Here's where they got in, they got in, here's what they have. 432 00:21:45,385 --> 00:21:48,985 And by the way, if you, if you got a, if your, if your master password is the 433 00:21:48,985 --> 00:21:53,185 size or if you've done stuff, you know, a certain timeframe, if you, if you are a 434 00:21:53,185 --> 00:21:57,365 last pass customer and you haven't taken a look at that, uh, you really should 435 00:21:57,645 --> 00:21:59,545 , you really should look at that message. 436 00:21:59,845 --> 00:22:04,135 Prasanna Malaiyandi: clarification question, Curtis, is did they say that 437 00:22:04,135 --> 00:22:08,005 both the username and the password were encrypted in the vault, or was it just. 438 00:22:08,980 --> 00:22:13,270 W. Curtis Preston: So yeah, the username, the, um, uh, what there, 439 00:22:13,390 --> 00:22:18,820 the only thing I remember that was not encrypted in the vault was the URL 440 00:22:19,540 --> 00:22:22,300 that that particular password is for. 441 00:22:22,930 --> 00:22:28,660 Um, so, so which, which, again, this is, this is why I was like, 442 00:22:29,040 --> 00:22:31,660 it is just a number of things where it calls into question. 443 00:22:33,225 --> 00:22:35,905 The, the decisions of the company. 444 00:22:36,175 --> 00:22:37,045 Why, why 445 00:22:37,045 --> 00:22:38,605 leave that one field? 446 00:22:38,695 --> 00:22:39,115 Yeah. 447 00:22:39,715 --> 00:22:42,595 Um, I think we have some theories, right? 448 00:22:42,745 --> 00:22:45,415 We have some, because they wanted it unencrypted. 449 00:22:45,415 --> 00:22:48,295 I think it there they had a reason, right? 450 00:22:48,295 --> 00:22:52,135 We can theorize it doesn't really matter, but I think the reason, the only reason 451 00:22:52,135 --> 00:22:56,425 to leave a field like that unencrypted is you had, you had use of that field, 452 00:22:57,145 --> 00:22:57,355 Prasanna Malaiyandi: Yep. 453 00:22:57,655 --> 00:22:59,725 It would be interesting to look at their privacy policy. 454 00:23:01,240 --> 00:23:02,560 W. Curtis Preston: It would be an interesting to look 455 00:23:02,560 --> 00:23:03,880 at their privacy policy. 456 00:23:04,060 --> 00:23:06,760 I bet a lot of people are looking at their privacy policy. 457 00:23:07,370 --> 00:23:10,880 If I was a last pass customer, I don't know what I'd be thinking right now. 458 00:23:11,540 --> 00:23:14,390 Prasanna Malaiyandi: So here's, I have two questions for you actually. 459 00:23:14,390 --> 00:23:14,960 One comment. 460 00:23:14,965 --> 00:23:15,590 One question. 461 00:23:16,040 --> 00:23:20,795 So the comment is, like you mentioned earlier, I think we should at 462 00:23:20,800 --> 00:23:26,915 least not congratulate last pass, but at least say that they've 463 00:23:26,915 --> 00:23:28,685 done a good job being transparent. 464 00:23:28,895 --> 00:23:29,105 Right? 465 00:23:29,105 --> 00:23:30,875 We've seen so many other breaches 466 00:23:30,875 --> 00:23:33,485 where no information has come out, right? 467 00:23:33,490 --> 00:23:36,455 So I know we're harping on them right now, right? 468 00:23:36,455 --> 00:23:37,835 And giving them a bad time. 469 00:23:38,075 --> 00:23:41,555 But it's not because of what they've done after the breach. 470 00:23:41,585 --> 00:23:43,445 It's what happened before the breach. 471 00:23:43,685 --> 00:23:45,425 I think that's what we're concerned about on this. 472 00:23:46,940 --> 00:23:47,150 W. Curtis Preston: Yeah. 473 00:23:47,150 --> 00:23:49,850 And, and by the way, I, I need to go back to an earlier thought that 474 00:23:49,850 --> 00:23:51,530 I, it came to me and it, it left. 475 00:23:51,530 --> 00:23:53,600 And, you know, you know, that happens sometimes. 476 00:23:54,270 --> 00:24:00,090 The problem with a hard coded, uh, you know, credential like 477 00:24:00,095 --> 00:24:03,090 that is exactly what happened. 478 00:24:03,090 --> 00:24:07,200 That someone who wasn't supposed to see the code will see the 479 00:24:07,205 --> 00:24:09,990 code and will then use that. 480 00:24:11,410 --> 00:24:12,765 do something bad, right? 481 00:24:12,765 --> 00:24:14,895 To access stuff they're not supposed to access. 482 00:24:15,705 --> 00:24:20,445 And, um, that's exactly what happened here. 483 00:24:20,595 --> 00:24:26,655 Which again, I'm gonna go back to another, I don't think it was a decision, but 484 00:24:26,655 --> 00:24:34,305 when you get hacked, like they got hacked and you know that a threat actor was 485 00:24:34,305 --> 00:24:39,525 roaming around in your, in your computing environment for a few days, undetected. 486 00:24:40,620 --> 00:24:44,730 What should be, what should you do next? 487 00:24:44,820 --> 00:24:45,510 What should you do? 488 00:24:45,510 --> 00:24:46,320 Immediately 489 00:24:47,295 --> 00:24:48,465 Prasanna Malaiyandi: Well, a, you should probably take 490 00:24:48,750 --> 00:24:50,850 W. Curtis Preston: beside, we already talked about notification. 491 00:24:51,450 --> 00:24:51,870 Yeah. 492 00:24:51,930 --> 00:24:52,650 Take everything down. 493 00:24:52,655 --> 00:24:53,310 Look around. 494 00:24:53,775 --> 00:24:54,165 Prasanna Malaiyandi: yeah. 495 00:24:54,255 --> 00:24:57,450 Take everything down, look around, rotate all your passwords, 496 00:24:57,493 --> 00:24:57,883 W. Curtis Preston: There you 497 00:24:57,883 --> 00:24:58,363 go. 498 00:24:59,533 --> 00:25:01,843 That's, that's what I was reaching 499 00:25:01,843 --> 00:25:02,353 for. 500 00:25:03,013 --> 00:25:07,203 But, but the problem is when you've just got a hard-coded thing sitting in a shell, 501 00:25:08,128 --> 00:25:10,198 , you're not necessarily gonna think about 502 00:25:10,543 --> 00:25:13,813 Prasanna Malaiyandi: Well, and I, that's the thing is if they had known it was 503 00:25:13,813 --> 00:25:17,863 hard coded, like if they had tools to scan and look for passwords, right. 504 00:25:17,893 --> 00:25:19,423 They would never have let that happen. 505 00:25:19,843 --> 00:25:21,823 It looks like it slipped under the cracks. 506 00:25:21,828 --> 00:25:22,123 Right. 507 00:25:22,123 --> 00:25:24,943 And someone hard coded it just to get it out the door and 508 00:25:24,943 --> 00:25:25,903 no one went back and fixed. 509 00:25:25,903 --> 00:25:28,183 And this goes to a point you were bringing up earlier. 510 00:25:30,058 --> 00:25:31,468 At this point, right? 511 00:25:31,858 --> 00:25:36,148 If you can't focus on your backups and make it better, you're probably better 512 00:25:36,148 --> 00:25:41,848 off finding an automated tool or a product to fill that gap because they care about 513 00:25:41,848 --> 00:25:45,328 these things and they will make sure that you are doing things in the right way. 514 00:25:45,748 --> 00:25:46,138 Right? 515 00:25:46,498 --> 00:25:49,228 And so you're less likely to end up with these issues. 516 00:25:50,248 --> 00:25:50,518 W. Curtis Preston: Yeah. 517 00:25:50,598 --> 00:25:53,878 And, and, and I know that not every company. 518 00:25:56,233 --> 00:25:57,793 I mean, let's go back. 519 00:25:57,793 --> 00:26:02,623 Go back to, go back to 30 years ago, right? 520 00:26:03,193 --> 00:26:05,383 Uh, we are coming up like any day now. 521 00:26:05,533 --> 00:26:09,223 It's gonna be 30 years for me in the IT industry. 522 00:26:10,453 --> 00:26:14,863 And I was using Shell, I was at a 35 billion company and 523 00:26:14,863 --> 00:26:16,333 I was using shell scripts. 524 00:26:16,393 --> 00:26:20,863 I was, I was running dump, of course, back then, the idea of commercial backup tools. 525 00:26:21,718 --> 00:26:22,648 So much a thing. 526 00:26:23,878 --> 00:26:25,678 Arcserve Arc Serve was about the only one. 527 00:26:26,698 --> 00:26:28,498 . It was Arcserve and there was Bud Tool. 528 00:26:28,498 --> 00:26:30,028 I don't know if you've been around long enough to 529 00:26:30,253 --> 00:26:31,393 Prasanna Malaiyandi: I've heard about Bud Tool. 530 00:26:31,543 --> 00:26:33,083 I never used it, but yet 531 00:26:34,078 --> 00:26:35,338 W. Curtis Preston: and Alexandria. 532 00:26:35,818 --> 00:26:40,468 That was which, which, which, you know who owns, you know who owned that. 533 00:26:41,063 --> 00:26:41,413 Prasanna Malaiyandi: Hm. 534 00:26:41,638 --> 00:26:42,988 W. Curtis Preston: They've been on the podcast. 535 00:26:45,208 --> 00:26:49,768 Do you know who's owned that spec? 536 00:26:52,228 --> 00:26:56,308 Spectra Logic owned Alexandria back in the day, they decided 537 00:26:56,308 --> 00:26:57,868 to sort of focus on hardware. 538 00:26:59,068 --> 00:27:02,878 I'm, I'm not saying that these things don't happen, but I will say that. 539 00:27:04,348 --> 00:27:05,878 You know, that was a different time. 540 00:27:06,238 --> 00:27:11,358 And basically, and even then I knew not to hardcode, username and passwords, 541 00:27:11,518 --> 00:27:14,728 but the way the way backups worked back then was everything ran as root. 542 00:27:14,733 --> 00:27:14,968 Right? 543 00:27:14,968 --> 00:27:20,008 You, you created a script as root you Hadron that ran things as root. 544 00:27:20,593 --> 00:27:25,123 and then because it ran its root and because you had R s H enabled 545 00:27:25,873 --> 00:27:26,203 Prasanna Malaiyandi: Yep. 546 00:27:26,233 --> 00:27:27,343 W. Curtis Preston: we didn't, we didn't have 547 00:27:27,343 --> 00:27:28,003 Prasanna Malaiyandi: could do anything and 548 00:27:28,093 --> 00:27:29,593 W. Curtis Preston: had RSSH enabled. 549 00:27:29,953 --> 00:27:32,253 Rssh enabled without a password. 550 00:27:32,443 --> 00:27:35,893 So from, from a central, right. 551 00:27:35,893 --> 00:27:38,413 As long as you were root, you're root here, you're root over there. 552 00:27:38,418 --> 00:27:42,613 That was, you know, back in the day, um, we had a script that would go 553 00:27:42,618 --> 00:27:44,293 around and do our dumps and things like 554 00:27:44,293 --> 00:27:44,593 that. 555 00:27:45,163 --> 00:27:51,523 Um, and, um, We also had an RFS mounted tape drive. 556 00:27:51,583 --> 00:27:52,813 I think we brought, I, I 557 00:27:53,048 --> 00:27:53,728 Prasanna Malaiyandi: well, you talked about us. 558 00:27:53,728 --> 00:27:54,148 Yeah. 559 00:27:54,448 --> 00:27:54,778 Yep, 560 00:27:54,853 --> 00:27:55,213 W. Curtis Preston: yeah. 561 00:27:55,243 --> 00:27:59,173 RFS was remote file service, like predecessor to nfs, and, 562 00:27:59,173 --> 00:28:00,943 but you could mount a tape drive. 563 00:28:01,063 --> 00:28:04,333 It was kind of cool anyway, clearly it wasn't that cool 564 00:28:04,338 --> 00:28:06,703 because it didn't , it didn't last, 565 00:28:06,893 --> 00:28:07,313 but, 566 00:28:08,008 --> 00:28:08,158 Prasanna Malaiyandi: Yeah. 567 00:28:08,323 --> 00:28:11,443 W. Curtis Preston: Yeah, so I, I understand you're a small 568 00:28:11,443 --> 00:28:15,763 company, um, and, and you can't get any budget for backups. 569 00:28:15,893 --> 00:28:16,963 I, I understand. 570 00:28:17,813 --> 00:28:23,383 I, I just, I would like to think that if that's where you work, if, if 571 00:28:23,383 --> 00:28:27,013 you can't get any money for backups, I think that you should take a 572 00:28:27,013 --> 00:28:32,923 stance, and I think that you should say, we need a commercial backup. 573 00:28:33,973 --> 00:28:34,483 Right. 574 00:28:35,023 --> 00:28:39,583 Um, I, I do th I and I do strongly believe in, in a SaaS based tool. 575 00:28:39,763 --> 00:28:44,143 Not because I work for Druva, but because I've been that way for a long time. 576 00:28:44,683 --> 00:28:45,043 Right. 577 00:28:45,043 --> 00:28:45,763 The idea of. 578 00:28:46,768 --> 00:28:50,368 Having somebody who's focused on it and does nothing but that 579 00:28:50,668 --> 00:28:52,258 and you have a complete service. 580 00:28:52,738 --> 00:28:55,708 Um, you know, and the cloud is a beautiful thing for that. 581 00:28:55,708 --> 00:28:59,608 We have so much bandwidth these days that, you know, deduplication has enabled this. 582 00:28:59,608 --> 00:29:04,018 I mean, it's just been so many things that have been, that have made cloud a 583 00:29:04,023 --> 00:29:11,848 cloud SaaS backup service like my, my employer, happens to offer, um, for me. 584 00:29:13,098 --> 00:29:16,828 It, it, it is the best backup option for most companies. 585 00:29:16,948 --> 00:29:18,808 There's caveats, right? 586 00:29:19,078 --> 00:29:22,798 Uh, most of the companies like mine, there's not a lot of them, 587 00:29:23,158 --> 00:29:28,498 but they don't tend to do like the older Unix platforms, right? 588 00:29:28,618 --> 00:29:31,468 Um, they don't tend to do as many database products. 589 00:29:31,468 --> 00:29:34,048 They tend to focus on virtualization and the. 590 00:29:34,718 --> 00:29:34,893 . Right. 591 00:29:36,033 --> 00:29:39,993 Uh, and I'll, I'll say something that I say often is, if you've got 10 592 00:29:39,993 --> 00:29:42,783 petabytes of data and a T1 line, Hmm. 593 00:29:42,933 --> 00:29:43,833 That ain't gonna work. 594 00:29:44,073 --> 00:29:44,433 Right. 595 00:29:45,183 --> 00:29:45,513 , you need some 596 00:29:45,643 --> 00:29:49,243 Prasanna Malaiyandi: but I'm guessing, just given last pass, right, they probably 597 00:29:49,723 --> 00:29:51,793 like how they've scaled out, right? 598 00:29:51,793 --> 00:29:53,453 The number of users on their platform. 599 00:29:53,458 --> 00:29:53,593 Right. 600 00:29:53,598 --> 00:29:56,683 They're probably familiar with a lot of these sort of challenges anyway. 601 00:29:57,493 --> 00:29:57,763 Right. 602 00:29:57,763 --> 00:30:01,453 It's just they sort of stopped at, and so I'm even wondering like, 603 00:30:02,473 --> 00:30:04,123 they focused on production, right? 604 00:30:04,123 --> 00:30:07,243 Making sure everything was up and was good to go there. 605 00:30:07,483 --> 00:30:09,913 They probably have some form of high availability and 606 00:30:09,913 --> 00:30:11,443 disaster recovery, hopefully. 607 00:30:12,193 --> 00:30:12,613 Right? 608 00:30:13,843 --> 00:30:14,503 But who knows? 609 00:30:14,503 --> 00:30:18,103 And then it's just sort of, some people, like you said, forget about that arc or 610 00:30:18,133 --> 00:30:20,473 the backup side of things and recovery. 611 00:30:21,343 --> 00:30:25,363 And then I even wonder if there probably don't even consider anything 612 00:30:25,363 --> 00:30:26,713 around archive either, right? 613 00:30:26,713 --> 00:30:27,643 If I just think about the life. 614 00:30:28,273 --> 00:30:28,763 W. Curtis Preston: Yeah. 615 00:30:29,233 --> 00:30:35,293 I, I, I, um, I just think it's a matter of not prioritizing backup, 616 00:30:35,653 --> 00:30:38,683 which I is a, is a historical problem. 617 00:30:39,073 --> 00:30:39,563 Prasanna Malaiyandi: Yeah, 618 00:30:39,763 --> 00:30:42,163 W. Curtis Preston: and I guess I'm just saying, I'm speaking to the, I'm 619 00:30:42,168 --> 00:30:45,853 speaking to the person that understands the value of backup and recovery, and 620 00:30:45,853 --> 00:30:47,743 that is our target listener, right? 621 00:30:48,013 --> 00:30:50,593 Our target audience is somebody who understands the value 622 00:30:50,593 --> 00:30:52,453 of, of, of backup, right? 623 00:30:53,083 --> 00:30:57,403 So I'm saying if you're at a company that doesn't understand the value of backup, 624 00:30:57,403 --> 00:30:59,683 I think it's time to, to make a stand. 625 00:31:00,428 --> 00:31:00,553 Prasanna Malaiyandi: Yep. 626 00:31:00,778 --> 00:31:03,718 W. Curtis Preston: Get it in writing that you recommend they do something else. 627 00:31:04,003 --> 00:31:07,483 Prasanna Malaiyandi: and I think because typically it's an IT function, right? 628 00:31:07,488 --> 00:31:11,463 Who worries about backup, but this is where I think you go get champions 629 00:31:11,468 --> 00:31:15,343 who can help support your cause, like people in security because it's 630 00:31:15,343 --> 00:31:17,113 relevant for security folks as well. 631 00:31:17,113 --> 00:31:22,483 Or if you look at legal and compliance or other folks in the organization, right, to 632 00:31:22,483 --> 00:31:24,883 help support you and push to get things. 633 00:31:26,388 --> 00:31:26,878 W. Curtis Preston: Yeah. 634 00:31:27,098 --> 00:31:29,368 And use this story. 635 00:31:29,983 --> 00:31:30,523 Right. 636 00:31:30,943 --> 00:31:37,723 Use this story of what happens when you grow your own backup system and then reach 637 00:31:37,723 --> 00:31:40,783 out to, you know, a number of companies. 638 00:31:40,783 --> 00:31:41,473 Reach out to me. 639 00:31:41,473 --> 00:31:43,453 I'll, I'll put you in touch with the right people. 640 00:31:43,993 --> 00:31:44,833 Um, 641 00:31:45,028 --> 00:31:45,628 Prasanna Malaiyandi: It's, 642 00:31:45,763 --> 00:31:46,713 W. Curtis Preston: don't talk opinion. 643 00:31:46,788 --> 00:31:48,643 He'll just, he'll just make a meeting. 644 00:31:50,728 --> 00:31:52,188 Prasanna Malaiyandi: so it's interesting. 645 00:31:52,193 --> 00:31:54,418 I was just thinking about this a lot of times on the engineering 646 00:31:54,418 --> 00:31:57,658 side and product side, we always talk about tech debt, right? 647 00:31:57,658 --> 00:32:00,118 Things I wish I could have done, but I couldn't do because I had 648 00:32:00,118 --> 00:32:01,198 to get the product out the door. 649 00:32:01,203 --> 00:32:04,858 So I took some shortcuts and we'll fix it later and sometimes didn't ever get fixed. 650 00:32:05,248 --> 00:32:05,548 Right? 651 00:32:05,548 --> 00:32:09,058 I think we haven't really talked about like the IT side of tech. 652 00:32:09,898 --> 00:32:12,058 Right, which like this could be, right? 653 00:32:12,058 --> 00:32:15,808 It's like, Hey, I needed to get backup done for that initial release, 654 00:32:15,808 --> 00:32:19,318 for instance, just to get things out the door and it's tech debt. 655 00:32:19,323 --> 00:32:21,928 I never had the chance to go back and fix it, do it right? 656 00:32:21,933 --> 00:32:25,348 Because there's never enough time, there's never enough budget, right? 657 00:32:25,678 --> 00:32:27,358 There's all these other priorities. 658 00:32:27,688 --> 00:32:28,048 So 659 00:32:28,768 --> 00:32:31,138 W. Curtis Preston: One of my favorite phrases, it's never time to do it. 660 00:32:31,143 --> 00:32:31,348 Right. 661 00:32:31,348 --> 00:32:33,658 Always time to do it over, right? 662 00:32:34,018 --> 00:32:34,738 Um, 663 00:32:35,128 --> 00:32:37,228 Prasanna Malaiyandi: until you get to a fire drill like this, 664 00:32:38,998 --> 00:32:39,628 W. Curtis Preston: Yeah. 665 00:32:40,348 --> 00:32:42,688 So, yeah, so, so use this story. 666 00:32:43,633 --> 00:32:48,043 So that's what I, I, so I, I, I tell you what, I, I, I would 667 00:32:48,043 --> 00:32:51,373 have a hard time continuing to justify being a LastPass customer. 668 00:32:51,703 --> 00:32:52,663 You do what you want. 669 00:32:52,843 --> 00:32:56,623 Maybe they have features that you like, and maybe you feel that they've 670 00:32:56,623 --> 00:32:58,153 learned their lesson, whatever. 671 00:32:58,153 --> 00:32:58,603 I don't know. 672 00:32:58,763 --> 00:33:02,693 Last pass, it made me, it made me think about the length and the 673 00:33:02,693 --> 00:33:04,473 complexity of my dash lane password. 674 00:33:05,973 --> 00:33:13,838 Um, so I got, I got, I changed it I was like, I, uh, and my wife and I 675 00:33:13,838 --> 00:33:15,338 share the password manager, right? 676 00:33:15,338 --> 00:33:19,968 So I had to, I had to explain my new super long password. 677 00:33:20,078 --> 00:33:21,998 It's relatively simple to remember, right? 678 00:33:21,998 --> 00:33:28,248 I went with the sort of the battery horse stable method rather than the XYZ nine, 679 00:33:28,278 --> 00:33:29,088 Q five, 680 00:33:29,303 --> 00:33:41,743 Prasanna Malaiyandi: was it basically u U s t p a l r one 20 d r a g o n. 681 00:33:42,713 --> 00:33:44,783 W. Curtis Preston: Yeah, that's exactly what it was. 682 00:33:44,963 --> 00:33:47,303 Um, yes. 683 00:33:47,393 --> 00:33:54,413 Um, that's what be my, my password should be four movie theater, Samsung nine 90 B. 684 00:33:54,923 --> 00:33:58,103 Actually, you know, the, the, the Vizio model numbers. 685 00:33:58,103 --> 00:34:00,743 So, so that was one of the things I was looking at. 686 00:34:00,743 --> 00:34:05,483 The Soundbars, the VIO model numbers are all like UX 95 3 70. 687 00:34:06,328 --> 00:34:06,778 Right. 688 00:34:07,228 --> 00:34:09,878 And the, the people that review 'em, they're just like, what is 689 00:34:10,198 --> 00:34:10,918 What is this? 690 00:34:11,878 --> 00:34:12,478 You know? 691 00:34:13,378 --> 00:34:16,288 Um, that could be, that could be a good password, I'm just saying. 692 00:34:16,978 --> 00:34:19,018 Um, but it's not long enough. 693 00:34:19,258 --> 00:34:23,098 So, yeah, so I, I so, so, so, so that's the other thing. 694 00:34:23,308 --> 00:34:26,248 So I think you should. 695 00:34:26,963 --> 00:34:30,263 I think you should seriously reconsider your last best situation. 696 00:34:30,263 --> 00:34:36,323 I think you should also look at, take this, take this opportunity 697 00:34:36,328 --> 00:34:39,353 to upgrade your backup scripts, your up your backup system. 698 00:34:39,353 --> 00:34:42,863 Look at a commercial backup system uses as a justification so you 699 00:34:42,863 --> 00:34:46,103 to do what you probably want been wanting to do all along. 700 00:34:46,553 --> 00:34:51,893 And then finally, uh, I guess I think it'll be finally, is take 701 00:34:51,893 --> 00:34:53,513 a look at your master password. 702 00:34:54,383 --> 00:35:01,613 Uh, you know, look at that table, um, that says, you know, uh, cuz basically 703 00:35:01,613 --> 00:35:07,643 if your password, if your password manager is, um, you know, is guessable 704 00:35:07,643 --> 00:35:12,833 in something measured in weeks or months or less than that, that's not good man. 705 00:35:13,298 --> 00:35:13,658 Prasanna Malaiyandi: Yeah. 706 00:35:13,883 --> 00:35:14,273 W. Curtis Preston: You know? 707 00:35:15,338 --> 00:35:19,778 Prasanna Malaiyandi: And I think the other thing to mention is two things, right? 708 00:35:19,838 --> 00:35:22,778 We always talk about this enable two factor authentication or 709 00:35:23,098 --> 00:35:25,358 mfa where you can in addition, 710 00:35:25,543 --> 00:35:25,703 W. Curtis Preston: you. 711 00:35:25,718 --> 00:35:26,138 Prasanna Malaiyandi: right? 712 00:35:26,678 --> 00:35:31,298 Um, and then the other thing is even if you are using a password manager, if your 713 00:35:31,303 --> 00:35:34,138 password is like 10 years old, right? 714 00:35:34,298 --> 00:35:37,478 You probably do want to change it at some point, even though you're using a 715 00:35:37,858 --> 00:35:39,158 password manager, it's totally random. 716 00:35:40,118 --> 00:35:40,538 right. 717 00:35:40,628 --> 00:35:44,588 You do probably want to change it every once in a while. 718 00:35:44,588 --> 00:35:45,668 I'm guilty of this. 719 00:35:45,668 --> 00:35:48,788 I've actually started going through and changing passwords, but I 720 00:35:48,788 --> 00:35:51,578 realize, yeah, I haven't cycled some of these in a while, even though 721 00:35:51,578 --> 00:35:53,888 they're all randomly generated, but 722 00:35:54,278 --> 00:35:58,058 W. Curtis Preston: Have I have I told you how many passwords I have? 723 00:35:58,628 --> 00:35:59,468 Prasanna Malaiyandi: yes, you did. 724 00:36:00,938 --> 00:36:02,268 W. Curtis Preston: It's, it's several hundred 725 00:36:03,203 --> 00:36:05,633 Prasanna Malaiyandi: I thought, I thought in the podcast episode we 726 00:36:05,633 --> 00:36:09,813 did with Chris I think you both had a significant number of passwords. 727 00:36:10,653 --> 00:36:11,313 , let's put it like that. 728 00:36:12,618 --> 00:36:15,558 W. Curtis Preston: Yeah, I think the only way I was able to do this, 729 00:36:15,858 --> 00:36:20,598 because it doesn't list, doesn't show me in here like a number. 730 00:36:20,868 --> 00:36:26,358 I had to, I had to actually export it and then, and then count the number of lines 731 00:36:26,358 --> 00:36:28,038 in the file and then delete the file. 732 00:36:30,268 --> 00:36:31,018 Prasanna Malaiyandi: Oh, Curtis. 733 00:36:32,013 --> 00:36:34,053 W. Curtis Preston: Um, it's a lot. 734 00:36:34,053 --> 00:36:36,963 I guess what I'm saying is it would take me a month to 735 00:36:36,963 --> 00:36:39,123 update all my passwords, right? 736 00:36:39,453 --> 00:36:43,293 Oh, but you know, by the way, Dashlane used used to have this really cool change 737 00:36:43,293 --> 00:36:47,193 your password for you feature, and it worked at a lot of the popular websites. 738 00:36:47,198 --> 00:36:48,723 They, they've abandoned that feature. 739 00:36:49,233 --> 00:36:51,573 They said it was too hard to, to keep it updated. 740 00:36:52,113 --> 00:36:53,763 Um, and. 741 00:36:55,023 --> 00:36:55,128 Yeah. 742 00:36:55,998 --> 00:36:58,128 Can you think of anything else we should be talking about 743 00:36:58,128 --> 00:37:00,678 regarding this last pass thing? 744 00:37:00,918 --> 00:37:01,268 Prasanna Malaiyandi: No. 745 00:37:03,078 --> 00:37:07,638 W. Curtis Preston: Uh, I, I, one thing came to mind is, is if your company has 746 00:37:08,058 --> 00:37:13,908 been the subject of some kind of hack of any kind, perhaps you should roam 747 00:37:13,908 --> 00:37:19,858 around and look for scripts with, uh, you first change all your regular passwords. 748 00:37:20,853 --> 00:37:25,603 And then roll around to see if you've got scripts with authentication crap in 'em. 749 00:37:26,238 --> 00:37:29,448 Prasanna Malaiyandi: Or the other thing is change your passwords and then like 750 00:37:29,448 --> 00:37:31,608 if you're using aws, look at CloudWatch. 751 00:37:31,848 --> 00:37:34,128 It'll log when authentication failures happen. 752 00:37:34,698 --> 00:37:37,218 And now you can at least point yourself in the right direction of 753 00:37:37,218 --> 00:37:38,688 being like, Hey, I didn't know that. 754 00:37:39,873 --> 00:37:43,053 W. Curtis Preston: And I'm assuming that the other providers have something 755 00:37:43,053 --> 00:37:43,563 similar. 756 00:37:44,313 --> 00:37:44,673 Right. 757 00:37:45,453 --> 00:37:46,023 Um, it's 758 00:37:46,158 --> 00:37:46,368 Prasanna Malaiyandi: Yeah. 759 00:37:46,428 --> 00:37:50,628 And hopefully you do have some form, form of auditing enabled in your 760 00:37:50,628 --> 00:37:53,318 systems to at least log failures 761 00:37:53,523 --> 00:37:53,823 W. Curtis Preston: and 762 00:37:54,123 --> 00:38:01,473 and by the way, that that's how uh, LastPass discovered was going on is they 763 00:38:01,473 --> 00:38:04,203 had some stuff that was watching, right? 764 00:38:04,233 --> 00:38:06,903 And they're like, we noticed some unusual activity in our account. 765 00:38:07,743 --> 00:38:11,193 And, um, turns out somebody downloaded the backups of our stuff. 766 00:38:11,383 --> 00:38:11,803 Ugh. 767 00:38:13,563 --> 00:38:14,463 It's killing me, man. 768 00:38:14,673 --> 00:38:15,453 Just killing me. 769 00:38:15,603 --> 00:38:22,503 This is just a, just a really, uh, anyway, all right, well, um, on that 770 00:38:22,503 --> 00:38:29,493 note, I hope that you're watching this on 120 inch screen If you, 771 00:38:29,763 --> 00:38:32,133 if you're one of those who, if you only listen, you should check out 772 00:38:32,133 --> 00:38:35,703 the, the, the, the video version we have over@backupcentral.com. 773 00:38:35,703 --> 00:38:39,933 You get to see our, our beautiful faces and, and this and this. 774 00:38:40,923 --> 00:38:42,993 The camera is in the wide shot. 775 00:38:42,993 --> 00:38:44,313 Is my book in the wide shot? 776 00:38:45,723 --> 00:38:46,653 Yeah Yeah it is. 777 00:38:46,683 --> 00:38:46,923 Okay. 778 00:38:46,923 --> 00:38:47,973 My book's in the wide shot. 779 00:38:48,273 --> 00:38:50,823 So you can see a, the, the book is whoop. 780 00:38:51,093 --> 00:38:52,883 There, there there is. 781 00:38:53,013 --> 00:38:57,483 It's closer than it or than it normally is because I'm sitting in 782 00:38:57,483 --> 00:39:01,413 the middle of the room because I'm, I, I thought I was gonna get baseboards 783 00:39:01,413 --> 00:39:03,153 today and turns out I, I didn't. 784 00:39:03,993 --> 00:39:06,993 Um, so all, everything, everything is in the middle of my. 785 00:39:08,823 --> 00:39:12,363 It's, and I, and I've got like, literally, I have nowhere to move. 786 00:39:12,393 --> 00:39:16,593 Like, regardless of which way I move, there's, there's something around me. 787 00:39:16,848 --> 00:39:19,338 Prasanna Malaiyandi: Well, hopefully you'll value back to normal soon, Curtis. 788 00:39:20,763 --> 00:39:21,333 W. Curtis Preston: Hopefully. 789 00:39:21,333 --> 00:39:21,843 Hopefully. 790 00:39:22,053 --> 00:39:24,963 All right, well thanks for, uh, listening folks. 791 00:39:25,173 --> 00:39:29,162 And remember, remember to subscribe so that you can restore it all.