How They Got Hacked Episode Two: Accounting For Passwords
Channel: Lawrence Systems
Date: 2019-03-17

Amazon Affiliate Store
➡️ https://www.amazon.com/shop/lawrencesystemspcpickup

Gear we used on Kit (affiliate Links)
➡️ https://kit.co/lawrencesystems
Try ITProTV free of charge and get 30% off!
➡️ https://go.itpro.tv/lts

Use OfferCode LTSERVICES to get 5% off your order at
➡️ https://lawrence.video/techsupplydirect

Tesla Referral Program Offer
🚘 https://www.tesla.com/referral/thomas65092

Lawrence Systems Shirts and Swag
👕 https://teespring.com/stores/lawrence-technology-services

Digital Ocean Offer Code
➡️ https://m.do.co/c/85de8d181725

HostiFi UniFi Cloud Hosting Service
➡️ https://hostifi.net/?via=lawrencesystems

Protect you privacy with a VPN from Private Internet Access
➡️ https://www.privateinternetaccess.com/pages/buy-vpn/LRNSYS

Google Fi Service Referral Code
📱https://g.co/fi/r/TA02XR

More Of Our Affiliates that help us out and can get you discounts!
➡️ https://www.lawrencesystems.com/partners-and-affiliates/

Twitter
🐦 https://twitter.com/TomLawrenceTech

Patreon
🔗 https://www.patreon.com/lawrencesystems

Our Forums
🔗 https://forums.lawrencesystems.com/

GitHub
🔗 https://github.com/lawrencesystems/

Discord
🔗 https://discord.gg/ZwTz3Mh

Our Web Site
🔗 https://www.lawrencesystems.com/



PIA Internet Access Affiliates Link
https://www.privateinternetaccess.com/pages/buy-vpn/LRNSYS
Some thoughts and speculation on the Citrix Breach
https://www.brianmadden.com/opinion/Citrix-security-incident-2019


Starwood Hotel Testimony
https://www.hsgac.senate.gov/imo/media/doc/Soresnson%20Testimony.pdf

The Highlights:
Page 2 Section B:
On September 8, 2018, Accenture, which managed the Starwood Guest Reservation
Database, contacted Marriott’s IT team with information about a Guardium alert generated on
September 7. Guardium is an IBM security product used on the Starwood system to help secure
databases. The Guardium alert was triggered by a query from an administrator’s account to return the count of rows from a table in the database. Such a query would not return the content of these rows, only the total number of rows in the table. As part of our investigation into the alert, we learned that the individual whose credentials were used had not actually made the query. 

Page 3 Section C: 
“In early October 2018, the investigators found on some systems evidence of malware, including MimiKatz, a tool that searches a device’s memory for usernames and passwords.”