MELISSA BLOCK, HOST:

We're going to spend the next several minutes talking about the security of our personal data online. Even the devices we wear and use around the house can be at risk, and we'll hear more about that coming up, but first, a massive hack by a Russian crime ring. According to the security firm that discovered the breach, Russian hackers who call themselves Cybervore have swiped 1.2 billion usernames and passwords. They were apparently stolen from hundreds of thousands of websites. If those numbers add up, it would be the largest hack ever. NPR's Aarti Shahani is at a computer security conference in Las Vegas called Black Hat where this hack is a big topic of conversation, and she joins me now. And Aarti, we should say this story of the hack was broken by the New York Times. Beyond that massive number of stolen credentials, what else did they report?

AARTI SHAHANI, BYLINE: Well, we know the security firm - it's called Hold Security - says that a small group in a small city in south-central Russia pulled off this huge theft - again, 1.2 billion usernames, passwords and other information. But it didn't happen in one fell swoop. The firm says that hackers did it over time and that they got their data from many websites around the world - everything from Fortune 500's to small mom's and pop's.

BLOCK: So they've amassed all this data, and what are they doing with it?

SHAHANI: We don't know what they're doing with it yet. Quite frankly, here at Black Hat the response isn't so much shock and awe as it is kind of dud. The crowd here expects this kind of hacking to happen to some extent.

BLOCK: Even on this scale?

SHAHANI: Yes. Yes, and I'd actually broadly categorize the reactions into a few groups. There are the defeatists who say listen, cyber criminals are winning. The battle is lost. Then there are people who are experts in the underground who are waiting to see if the personal information that got stolen is added to databases that are being amassed right now in the underground to build profiles on individual people - so not just credit card numbers. And finally, there are cynics here who've pointed out that Hold Security is pretty light on details like how old the stolen data is, but the firm was quick to offer a service to help victims for the bargain price of $120.

BLOCK: OK, NPR's Aarti Shahani at the cyber security conference Black Hat in Las Vegas. Aarti, thanks.

SHAHANI: Thank you.

BLOCK: And another thing Aarti's learning about at that conference - vulnerabilities and devices connected to the Internet, like fitness tractors and smart thermostats. Here's her report.

SHAHANI: People who hack for good have come to Mandalay Bay to share their research. I'm in a quiet hotel room with one so-called White Hat.

GRANT HERNANDEZ: I'm Grant Hernandez. And I'm undergraduate security researcher at the University of Central Florida.

SHAHANI: 21-year-old Hernandez hacked one of the smartest smart devices on the market, Nest. The home thermostat uses sensors to tell when you're home and adjust temperature accordingly. And Hernandez says it's pretty easy to turn into a spy. Nest left the device unprotected. So by plugging in a USB, he entered developer mode.

HERNANDEZ: Entering into that mode allows you to upload your own code, your custom code which then allows you to attack the existing code, implant your own and reboot normally but maybe have something else running in the background.

SHAHANI: If Hernandez wanted to, he could run to the Lowe's store, buy and hack every Nest to shoot user data to him and return the devices. The next buyers wouldn't have a clue.

HERNANDEZ: We have access to the device on the highest level.

SHAHANI: Nest, which is owned by Google, says the company's highest priority is on preventing remote wireless hacks. Hernandez's hack may grad data from the hardware, but it does not go into the Nest servers. Another genre of smart device that is wide open to wireless hacking is the Wearable - the watch or running shoe with sensors inside connected to the Internet. And as I roam through this tech conference, I notice hardly anyone is wearing one. Take Orla Cox.

ORLA COX: No I'm not wearing a fitness device. I haven't actually used it since - since we did the study.

SHAHANI: Cox is director of security response at Symantec. They just published a breathtaking audit of the top wearables like that Fitbit and NikeFuel. These devices run on Bluetooth, which emits location data 24/7. Cox's team built a machine 75 bucks to sniff the GPS coordinates of individual users in public places. She says unlike smartphones, the designers behind these big brand names didn't even make an off switch.

COX: There is a unique ID that's coming from these devices which allow you to more easily then track them than you would, say, through a phone.

SHAHANI: Symantec also looked at smartphone apps. Some get very personal, not just logging heart rate, but even things you might not expect like the frequency or loudness of sexual activity. Hackers could steal that data and sell it down the line to a marketer. And Cox says many of the top apps make that theft really easy because they don't bother to protect usernames and passwords with encryption.

COX: These are basic security practices that are not new and that should have been implemented, you know, from, you know, straightaway when these apps were being developed.

SHAHANI: Cisco just released a report estimating that by 2020, there will be 50 billion connected devices. That is a whole lot of surface area for hackers to attack and for corporations to hopefully protect. Aarti Shahani, NPR News, Las Vegas.

Copyright © 2014 NPR. All rights reserved. Visit our website terms of use and permissions pages at www.npr.org for further information.

NPR transcripts are created on a rush deadline by a contractor for NPR, and accuracy and availability may vary. This text may not be in its final form and may be updated or revised in the future. Please be aware that the authoritative record of NPR’s programming is the audio.

Comments

 

Please keep your community civil. All comments must follow the NPR.org Community rules and terms of use, and will be moderated prior to posting. NPR reserves the right to use the comments we receive, in whole or in part, and to use the commenter's name and location, in any medium. See also the Terms of Use, Privacy Policy and Community FAQ.