Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
VTech Kids’ Toy Hacking case INVOLVES ASP 2.0
The website was running ASP 2.0, which Microsoft had unsupported for more than four years by that time.
Explicit Confidence 99% · Jack Rhysider EP 2 Details
“the site was running ASP 2.0 which by that time had been unsupported by Microsoft for over four years.”
VTech Kids’ Toy Hacking case INVOLVES HTTPS
The VTech website did not use HTTPS for authentication or its API.
Explicit Confidence 99% · Jack Rhysider EP 2 Details
“the site doesn’t use HTTPS anywhere, not for authentication or the API, nothing.”
VTech Kids’ Toy Hacking case INVOLVES database dump
The hacker downloaded complete copies of multiple VTech databases.
Explicit Confidence 99% · Jack Rhysider EP 2 Details
“The hacker grabbed a copy of everything in the database, downloaded the whole thing, then moved on to another database and grabbed a copy of everything there, too.”
VTech Kids’ Toy Hacking case TARGETS VTech
The hacking case involved unauthorized access to VTech customer data and systems.
Explicit Confidence 99% · Jack Rhysider EP 2 Details
“He had full access to the planetvtech.com website. 100 percent control of it.”
“an unauthorized party accessed VTech customer data”
DigiNotar ASSOCIATED_WITH VASCO
VASCO bought DigiNotar in early 2011 for almost 13 million dollars.
Explicit Confidence 99% · Jack Rhysider EP 3 Details
“In early 2011 VASCO bought DigiNotar for almost 13 million dollars.”
DigiNotar breach ATTRIBUTED_TO Comodo Hacker
The person calling himself the Comodo Hacker claimed responsibility for also hacking DigiNotar, but this is based on a Pastebin claim rather than a confirmed identification.
Attributed Confidence 86% · Jack Rhysider EP 3 Details
“This Comodo hacker now takes credit for also hacking into DigiNotar”
DigiNotar breach ATTRIBUTED_TO Iranian government
The episode presents it as a strong theory that the hack was carried out by the Iranian government itself or by someone helping it, possibly to spy on dissidents.
Uncertain Confidence 82% · Jack Rhysider EP 3 Details
“It’s a strong theory that this hack was done by the Iranian government itself or someone trying to help the Iranian government.”
DigiNotar breach ATTRIBUTED_TO National Security Agency
Bruce Schneier said the incident may have been the work of the NSA or an exploit of the NSA, based mainly on a leaked document showing NSA access to DigiNotar; the episode characterizes this theory as weak.
Uncertain Confidence 78% · Jack Rhysider EP 3 Details
“Bruce Schneier, a prominent security expert says it may be the work of NSA or an exploit of NSA”
“This theory isn’t very strong and has almost no other evidence”
DigiNotar breach COMPROMISES DigiNotar
The incident was a breach in which a hacker entered and thoroughly penetrated DigiNotar's network.
Explicit Confidence 99% · Jack Rhysider EP 3 Details
“In the summer of 2011, DigiNotar made such a mistake and a hacker entered their network.”
DigiNotar breach CONTAINS rogue certificates
The breach resulted in the intruder issuing many rogue certificates, including certificates for Google domains.
Explicit Confidence 99% · Josephine Wolff EP 3 Details
“The intruder is able to issue a bunch of rogue certificates in the names of a whole variety of different domains.”
DigiNotar breach DISCOVERED_BY Google
Google detected a mis-issued DigiNotar certificate being used in active attacks on users in Iran.
Explicit Confidence 99% · Gervase Markham EP 3 Details
“Google notified us that they had detected a mis-issued certificate for starter, google.com which was being used in active attacks on users in Iran.”
DigiNotar breach INVOLVES domain administrator account
Fox-IT found that DigiNotar's Windows domain administrator account had a simple password that was easy to brute force.
Explicit Confidence 98% · Jack Rhysider EP 3 Details
“They found the Windows domain administrator account had a simple password and was easy to brute force.”
DigiNotar breach INVOLVES man-in-the-middle attack
The rogue certificates were used to conduct a man-in-the-middle attack against Gmail users in Iran.
Explicit Confidence 99% · Jack Rhysider EP 3 Details
“The hacker then took these certificates and proceeded to create a man-in-the-middle attack.”
DigiNotar breach INVOLVES DNS poisoning
DNS poisoning was presented as the best-supported theory for how users were redirected to the attacker's server, but the episode says this is not known definitively.
Uncertain Confidence 91% · Jack Rhysider EP 3 Details
“the best theory with the most supporting facts is he did a DNS poisoning attack”
“There’s no definitive proof that’s how the redirect happened.”
DigiNotar breach TARGETS Iran
The attack appeared to target Iranian civilians and redirected people in Iran to fraudulent sites.
Explicit Confidence 97% · Jack Rhysider EP 3 Details
“This attack seemed to be targeting Iranian civilians.”
Firefox uses OneCRL as an emergency revocation system to block certificates without requiring a browser update.
Explicit Confidence 99% · Gervase Markham EP 3 Details
“We have a system called OneCRL which is, if you like, an emergency revocation system.”
public key pinning USES Google Chrome
Google used public key pinning in Chrome to accept only certificates issued from Google's CA and detect the DigiNotar certificate.
Explicit Confidence 98% · Jack Rhysider EP 3 Details
“They forced Chrome to only accept certificates issued from Google’s CA, essentially pinning the certificate to a specific CA.”
TalkTalk ASSOCIATED_WITH Cyber Essentials
Harding said TalkTalk was fully compliant with Cyber Essentials and was in the process of obtaining accreditation.
Explicit Confidence 93% · Harding EP 4 Details
“we are fully compliant with”
TalkTalk ASSOCIATED_WITH 10 Steps to Cyber Security
Harding said TalkTalk had focused on a detailed 10 Steps to Cyber Security plan.
Explicit Confidence 99% · Harding EP 4 Details
“a very detailed and in-depth 10 Steps to Cyber Security plan”
TalkTalk 2014 Webpro data breach COMPROMISES TalkTalk
The breach compromised TalkTalk customer-account data, including 21,000 harvested accounts.
Explicit Confidence 99% · Jack Rhysider EP 4 Details
“In total, 21,000 accounts were harvested out of the TalkTalk database.”
Matthew hacked into TalkTalk and downloaded as much data as he could.
Explicit Confidence 99% · Jack Rhysider EP 4 Details
“Matthew hacked into TalkTalk and downloaded as much data as he could.”
Carphone Warehouse 2015 data breach COMPROMISES Carphone Warehouse
The Carphone Warehouse cyber-attack compromised data held in Carphone Warehouse systems.
Explicit Confidence 97% · Jack Rhysider EP 4 Details
“some of the data held in our systems has been accessed”
TalkTalk October 2015 cyber-attack COMPROMISES TalkTalk
The attack compromised TalkTalk's website and exposed some customer data, although Harding later said the core systems were not attacked.
Explicit Confidence 98% · Harding EP 4 Details
“our website, our shop front, if you like, was attacked but our core systems weren’t”
TalkTalk October 2015 cyber-attack INITIAL_ACCESS_VIA Legacy Tiscali web server and database vulnerability
The attack gained access through an old, unpatched Tiscali web server and database vulnerability.
Explicit Confidence 99% · Jack Rhysider EP 4 Details
“that web server and database had not been patched for three and a half years”
TalkTalk 2014 Webpro data breach INVOLVES Webpro
The breach involved rogue employees of Webpro, a TalkTalk customer-support outsourcing provider.
Explicit Confidence 99% · Jack Rhysider EP 4 Details
“Three rogue Webpro employees gained access to these privileged log-ins.”