Latest / Tech Talks With Kinsoft / Manchester Airports Group - 8.7 Million Travellers, and the API Keys Sitting in Plain Sight

Transcript

Manchester Airports Group - 8.7 Million Travellers, and the API Keys Sitting in Plain Sight · Tech Talks With Kinsoft

• 0:00
  Be honest with me for a second. Have you ever
• 0:02
  been sitting at a terminal waiting for a flight?
• 0:05
  Maybe your data connection is just a little spotty
• 0:08
  and you trade your email address for 30 minutes
• 0:11
  of free airport Wi -Fi. Oh, yeah. I mean, everyone
• 0:14
  does it. Right. You just you click a little box.
• 0:16
  You agree to some terms of service. You definitely
• 0:18
  didn't read. And boom, you get your connection.
• 0:20
  Exactly. It's just a reflex at this point. Yeah.
• 0:23
  And it feels like the most harmless transaction
• 0:25
  in the world. Right. Like a totally fair trade.
• 0:28
  But today we're going to look at how that exact
• 0:30
  everyday scenario just became part of the largest
• 0:33
  known customer data breach at a British airport
• 0:36
  group. It really is. kind of the perfect modern
• 0:40
  trap because we hand over these little pieces
• 0:43
  of ourselves, you know, an email here, a phone
• 0:45
  number there, maybe our zip code at the cash
• 0:47
  register without a second thought. Because the
• 0:50
  individual pieces feel completely worthless.
• 0:52
  Right, exactly. But when you aggregate millions
• 0:55
  of those harmless transactions in one database,
• 0:58
  you create this incredibly tempting target. And
• 1:01
  you often hand that target over to the systems
• 1:05
  with the weakest security. Which is terrifying.
• 1:07
  And our source material today is a really fantastic
• 1:10
  breakdown from Tech Talks with Kinsoft. They
• 1:14
  did this full deep dive into the recent Manchester
• 1:17
  Airports Group data breach. It's a great piece
• 1:19
  of reporting. It really is. And our mission today
• 1:22
  isn't just to report on a hack. We really want
• 1:25
  to deconstruct how a basic, totally preventable
• 1:28
  web development mistake ended up exposing the
• 1:31
  data of 8 .7 million travelers. Yeah, because
• 1:35
  this isn't just about... an airport in the UK.
• 1:37
  No, not at all. This is about how your personal
• 1:39
  data is handled by basically every business you
• 1:42
  interact with online. Okay, let's unpack this.
• 1:44
  We've got 8 .7 million records exposed. What
• 1:47
  actually happened here? So we're looking at the
• 1:49
  Manchester Airports Group, or MAG, and they run
• 1:52
  three major airports in the UK. That's Manchester,
• 1:56
  London Stansted, and East Midlands. So we are
• 1:59
  talking about tens of millions of passengers
• 2:01
  passing through these hubs every single year.
• 2:03
  And to really understand this breach, we kind
• 2:05
  of have to understand the architecture of a modern
• 2:07
  airport. Right. Because it's not just, you know,
• 2:10
  airplanes and baggage claims. Exactly. It's not
• 2:12
  just runways and radar and air traffic control.
• 2:14
  Yeah. An airport today is essentially a massive
• 2:18
  shopping mall and hospitality venue. That just
• 2:21
  happens to have a runway attached to it. That's
• 2:23
  a great way to put it. They're essentially running
• 2:24
  all these multiple disparate businesses under
• 2:27
  one roof. Like they sell car park bookings, access
• 2:31
  to VIP lounges. Fast track passes so you can
• 2:35
  jump the security queue and, of course, the free
• 2:37
  Wi -Fi in exchange for your email. Right. And
• 2:40
  that structural division is really the firewall
• 2:42
  of this entire story. So late this past August,
• 2:46
  MAG disclosed that an unauthorized third party
• 2:49
  had accessed and stolen customer data. But this
• 2:53
  is key. They didn't touch the actual flight stuff,
• 2:55
  right? Exactly. They didn't touch the aviation
• 2:57
  security systems. They didn't touch air traffic
• 2:59
  control. Check -in systems were completely untouched.
• 3:02
  Oh, wow. Yeah, flights ran normally the whole
• 3:04
  time. The attackers purely targeted those ancillary
• 3:07
  commercial systems we just mentioned. You know,
• 3:09
  the parking, the lounges, the Wi -Fi. Which is
• 3:11
  just wild to think about. It's like spending
• 3:14
  millions on laser grid bank vault doors to protect
• 3:18
  the cash, but then leaving the customer ledger
• 3:20
  sitting on a card table in the lobby with the
• 3:22
  front doors propped open. Yeah, that's actually
• 3:24
  a really good analogy. The focus of their security
• 3:28
  was heavily skewed toward operational safety.
• 3:32
  Which, you know, makes sense for an airport.
• 3:34
  Sure. Obviously, you want the planes to be safe.
• 3:36
  Right. But it left the commercial side vulnerable.
• 3:40
  Now, to Mac's credit, once they realized the
• 3:43
  commercial systems had been compromised, their
• 3:45
  initial response was entirely orthodox. By the
• 3:48
  book. Completely by the book. They contained
• 3:50
  the access, restricted the affected systems,
• 3:52
  brought in specialist cyber advisors, and they
• 3:56
  notified the authorities. Under the UK's GDPR
• 3:59
  privacy rules, you have 72 hours to notify the
• 4:02
  information commissioner's office. And they hit
• 4:04
  that deadline. Okay, so they were on it. They
• 4:06
  were. They even temporarily suspended their online
• 4:08
  manage my booking service just as a precaution.
• 4:11
  So on paper, they did exactly what they were
• 4:13
  supposed to do. Initially, MAG came out and framed
• 4:16
  this as mostly a leak of email addresses from
• 4:19
  those Wi -Fi signups. Like they admitted a smaller
• 4:22
  group of people, the ones booking parking or
• 4:24
  fast track passes, lost a bit more like phone
• 4:26
  numbers, UK postcodes and vehicle registration
• 4:30
  plates. Right. But they were very quick to assure
• 4:32
  everyone that no payment data, no credit cards
• 4:35
  and no bank details were compromised. Right.
• 4:38
  And if the story ended right there, it would
• 4:39
  be a textbook, you know, medium severity corporate
• 4:41
  breach, a bad day at the office. but managed
• 4:44
  well and mostly just an inconvenience. Right,
• 4:46
  but it didn't end there. No, it didn't. The situation
• 4:49
  escalated dramatically just a few days later.
• 4:51
  A group calling themselves FulcrumSec reached
• 4:54
  out to journalists at Bleeping Computer to claim
• 4:57
  responsibility for the attack. And this is where
• 4:59
  things get messy. Very messy. And this is where
• 5:01
  we have to carefully separate corporate disclosures
• 5:04
  from unverified criminal claims. FulcrumSec claims...
• 5:08
  They didn't just grab a few emails. They claim
• 5:11
  they stole 86 gigabytes of data. Wait, 86 gigabytes
• 5:15
  of purely text -based data? That is an astronomical
• 5:18
  amount of information. It's massive. Because
• 5:21
  text files are tiny. Like, to get to 86 gigs,
• 5:24
  you are talking about millions upon millions
• 5:27
  of incredibly detailed rows of data. Yeah, it's
• 5:31
  huge. It gets much worse. They also boasted that
• 5:35
  they were holding onto roughly 200 ,000 records
• 5:38
  of future travel. Future travel, like flights
• 5:41
  that haven't happened yet. Exactly. We're talking
• 5:43
  dates, times, and bookings for the rest of 2026
• 5:46
  linked to identifiable people. Oh, my God. Yeah,
• 5:50
  think about the real -world implications of that
• 5:52
  for a second. If criminals hold a database of
• 5:54
  future travel, they know exactly when hundreds
• 5:57
  of thousands of people will not be home. Oh,
• 5:59
  I didn't even think about that. Right. They know
• 6:01
  when executives are out of the country. They
• 6:03
  know when properties are vacant. It transforms
• 6:05
  a digital privacy breach into a literal physical
• 6:07
  security threat. That is terrifying. And the
• 6:10
  craziest part, Fulcrumsec actually claimed they
• 6:13
  might withhold releasing those specific future
• 6:15
  travel records out of a sense of, quote, restraint
• 6:18
  to prevent real world harm. Oh, how generous
• 6:21
  of them. The moral compass of an extortion syndicate
• 6:24
  holding your data hostage. Yeah, it's quite the
• 6:27
  spin. It's such a bizarre psychological flex.
• 6:30
  But here's where it gets really interesting for
• 6:32
  me. It's the how. How did they get all this data?
• 6:35
  Because according to the attackers, they didn't
• 6:37
  use some, you know, sophisticated zero day exploit.
• 6:41
  No, they didn't. They didn't shatter a firewall
• 6:43
  or brute force a password. They claim they got
• 6:46
  in using API credentials for a platform called
• 6:49
  Iterable. Right. So Iterable is a third party
• 6:52
  marketing and customer engagement platform that
• 6:55
  MAG was using. It's a software as a service or
• 6:58
  sauce tool. Yeah. And an API credential, an application
• 7:02
  programming interface key. is essentially a digital
• 7:05
  VIP pass. Okay, a VIP pass. Yeah, it allows two
• 7:08
  separate pieces of software to talk to each other
• 7:10
  and share data automatically without a human
• 7:12
  having to do anything. But the criminals claim
• 7:14
  these digital VIP passes weren't stolen in a
• 7:17
  sophisticated heist. They claim these API keys
• 7:19
  were left sitting in plain sight. In client -side
• 7:22
  JavaScript? Yes. I just want to make sure I'm
• 7:24
  understanding the underlying logic here. Is this
• 7:26
  the digital equivalent of taping your house key
• 7:28
  to the front door next to a neon sign that says
• 7:31
  spare key here? What's fascinating here is the
• 7:34
  fundamental difference between server -side operations
• 7:36
  and client -side code. Because your analogy is
• 7:39
  spot on. Okay, break that down for me. So when
• 7:42
  you build a website, there are things that happen
• 7:45
  on the server. Think of the server as the locked
• 7:47
  room in the back of a restaurant where the chef
• 7:49
  cooks and the faif is kept. Yeah. You, the customer,
• 7:52
  you never see that room. Right. But the client
• 7:54
  -side code, that's the menu. That's the visual
• 7:57
  stuff that is sent directly to your web browser
• 7:59
  so you can view and interact with the page. And
• 8:01
  anyone can look at the menu. Exactly. You can
• 8:04
  right -click on almost any web page right now,
• 8:06
  select View Page Source, and just read the code.
• 8:08
  So if a developer places an API key, which is
• 8:12
  a secret password, meant to authenticate access
• 8:15
  to a massive database of customers into client
• 8:18
  -side JavaScript, They are quite literally serving
• 8:21
  that secret password to every single person who
• 8:24
  visits the website. That is staggering. I mean,
• 8:27
  I'm trying to wrap my head around why a developer
• 8:28
  would ever build it that way in the first place.
• 8:30
  Usually, it's a matter of convenience, speed,
• 8:34
  or just a misunderstanding of how third -party
• 8:37
  tools should be integrated. Like they're just
• 8:38
  rushing to get it done. Yeah, imagine a marketing
• 8:40
  team wants a widget on the website to collect
• 8:43
  emails for a newsletter. A developer writes a
• 8:45
  quick script to send that email directly from
• 8:48
  the user's browser straight to the iterable database.
• 8:50
  Okay. But to do that, the browser needs the key
• 8:54
  to open the door to iterable. So they put the
• 8:56
  key in the script. It works perfectly, functionally
• 8:59
  speaking. The email gets stored. But security
• 9:01
  -wise, it's a fatal design flaw. But how does
• 9:04
  a hacker even find that? Like, are they just
• 9:06
  sitting there right -clicking on... Thousands
• 9:09
  of websites all day hoping to spot a password
• 9:11
  in the code. Oh, not at all. It's completely
• 9:13
  automated. Really? Yeah. Hackers use bots automated
• 9:16
  scripts that scour the Internet 24 hours a day,
• 9:19
  seven days a week. These bots download the client
• 9:22
  side code of millions of websites and scan them
• 9:24
  specifically for strings of text that match the
• 9:27
  format of an API key. So it's instantaneous.
• 9:30
  Basically. Once the bot finds one, it flags it.
• 9:34
  Tests it to see what privileges it has. And then
• 9:36
  the attackers move in to extract whatever data
• 9:39
  that key can access. It requires almost zero
• 9:42
  manual effort on the part of the criminal. Wow.
• 9:44
  So it's prioritizing convenience over security
• 9:47
  and just leaving the door wide open for automated
• 9:50
  looting. Exactly. Now, I know MAG hasn't officially
• 9:53
  confirmed this specific entry vector yet. They
• 9:56
  haven't confirmed the 86 gigabytes or the 200
• 9:59
  ,000 future travel records. But Bleeping Computer
• 10:02
  didn't just take the hacker. word for it did
• 10:04
  they no they didn't they actually got their hands
• 10:06
  on a data sample to verify the claims okay what
• 10:08
  did they find bleeping computer reviewed a 21
• 10:11
  gigabyte data sample of Manchester customer exports,
• 10:14
  and they managed to validate one traveler's record
• 10:17
  against their actual real -world purchase history.
• 10:20
  And it was a match. It was a perfect match. Fast
• 10:22
  -track purchases, booking and arrival times,
• 10:25
  the specific terminal, amounts paid, purchase
• 10:27
  references. Which completely blows Meg's initial,
• 10:30
  it's mostly just email addresses framing out
• 10:32
  of the water. Yeah, it really does. This verified
• 10:34
  data went so far beyond that. I mean, it included
• 10:37
  booking references, product selections, prices,
• 10:40
  discounts. exact parking dates and times, historical
• 10:43
  spend, and marketing engagement data. The picture
• 10:46
  of the customer was deeply, uncomfortably rich.
• 10:50
  It really was. And this raises an important question
• 10:53
  about the nature of the data itself. Security
• 10:55
  commentators pointed out something crucial about
• 10:58
  UK postcodes, which were included in this breach.
• 11:01
  Right, because they're different from U .S. zip
• 11:03
  codes. Very different. In the U .K., a full postcode
• 11:07
  doesn't just point to a general neighborhood
• 11:09
  or a massive geographic zone like a U .S. zip
• 11:12
  code often does. It narrows the location down
• 11:14
  to roughly 15 addresses. Fifteen. That is basically
• 11:17
  your exact house. Basically, yeah. Okay, but
• 11:20
  let me push back on this for a second. Let's
• 11:21
  play devil's advocate here. How does a license
• 11:23
  plate or postcode actually help a hacker? Like,
• 11:26
  unless they are physically at the airport waiting
• 11:28
  by my car, I just don't see them. leverage. MAG
• 11:31
  confirmed no payment or bank data was compromised.
• 11:34
  So what? What is the actual tangible threat here
• 11:36
  if they don't have my credit card? That's a great
• 11:38
  question because we are so conditioned to think
• 11:40
  about fraud. You know, someone draining your
• 11:44
  bank account or maxing out your credit card behind
• 11:46
  your back. Right. But we connect this to the
• 11:49
  bigger picture. This isn't a fraud story. This
• 11:52
  is a phishing story. The threat isn't physical
• 11:55
  theft of your vehicle. It's psychological manipulation
• 11:58
  of you. Manipulation? How? Okay, so think about
• 12:01
  a standard spam email. Dear sir, your account
• 12:04
  is locked. Right, I delete it instantly. Exactly,
• 12:07
  because it's generic and your brain recognizes
• 12:09
  it as a low -effort scam. But now, imagine you're
• 12:13
  on a beach in Spain and you receive an email
• 12:15
  that says, there is an issue with the vehicle
• 12:17
  registered as your exact license plate. Oh, man.
• 12:20
  You're car -cark booking at Terminal 2 on the
• 12:23
  14th of August. requires immediate revalidation
• 12:25
  to avoid impound fees. Please click here to confirm
• 12:28
  your payment details. And it includes your exact
• 12:31
  historical spend, your correct booking reference,
• 12:33
  and the specific terminal. See, if I had done
• 12:36
  an email saying my car was getting towed from
• 12:38
  Terminal 2 while I'm on vacation, all critical
• 12:40
  thinking goes out the window. I'd absolutely
• 12:42
  click that link in a total panic. And that is
• 12:45
  the exact physiological response they rely on.
• 12:49
  It triggers an immediate cortisol response. Yeah,
• 12:51
  you aren't asking, is this a scam? You're just
• 12:53
  asking, oh, no, did my parking payment fail?
• 12:55
  Is my car being towed right now? Precisely. Armed
• 12:58
  with highly contextual data, a scammer creates
• 13:01
  a scenario that completely bypasses your prefrontal
• 13:04
  cortex, the logical, critical thinking part of
• 13:07
  your brain. Oh. You click the link. You go to
• 13:10
  a fake page that looks exactly like the airport's
• 13:12
  payment portal. And that is when you hand over
• 13:14
  the credit card. Highly contextual data makes
• 13:17
  phishing almost impossible to spot, even for
• 13:20
  extremely vigilant people, because it leverages
• 13:22
  trust. It uses true information to validate a
• 13:25
  lie. That feels like a massive wake -up call
• 13:28
  because if Macrae's core IT wasn't re -breached,
• 13:30
  but they still lost 8 .7 million records, how
• 13:33
  do companies even begin to plug these holes?
• 13:36
  The source material breaks this down into some
• 13:38
  really hard lessons for the digital age. And
• 13:41
  it seems like the first major takeaway is that
• 13:43
  a company's marketing stack is its real attack
• 13:45
  surface. Absolutely. We often think of cybersecurity
• 13:48
  as protecting the main servers, the payment gateways,
• 13:51
  the core infrastructure. The big stuff. Right.
• 13:53
  Yeah. But every single booking widget. Every
• 13:56
  email marketing platform, every customer engagement
• 13:59
  tool, these are all doors into a company's customer
• 14:02
  relationships. And they're usually managed by
• 14:04
  marketing, not IT. Exactly. If your marketing
• 14:07
  department is plugging in third -party Thos tools
• 14:09
  without rigorous security audits from the IT
• 14:12
  department, you are vulnerable. This is actually
• 14:15
  known as shadow IT. Shadow IT. Yeah. Marketing
• 14:18
  buys a tool to make their job easier, they integrate
• 14:21
  it quickly, and security never even knows it
• 14:23
  exists until it's breached. So the marketing
• 14:25
  department is accidentally leaving the doors
• 14:27
  unlocked because they just want the customer
• 14:29
  experience to be frictionless. But there has
• 14:32
  to be a technical fix for this specific API key
• 14:35
  issue, right? Like how do you integrate these
• 14:37
  tools without leaving the key under the mat?
• 14:40
  There is a very standard fix. The cheapest security
• 14:43
  control in this entire story would have been
• 14:45
  managing those API keys properly. Instead of
• 14:48
  putting the key in the user's browser, the client
• 14:51
  side, you use a server side proxy. Okay, how
• 14:54
  does a server -side proxy work? In plain English.
• 14:57
  Just explain the mechanics of that for us. Sure.
• 14:59
  Instead of your web browser talking directly
• 15:01
  to the iterable marketing database using the
• 15:03
  secret key, your browser talks to the airport's
• 15:06
  secure server. Okay. The secure server, behind
• 15:08
  closed doors, uses the secret key to talk to
• 15:11
  iterable, gets the result, and passes it back
• 15:14
  to your browser. The key never leaves the locked
• 15:16
  room. Ah, I see. So the customer never sees the
• 15:19
  key. They only ever see the result of the action.
• 15:21
  Exactly. And furthermore, you implement what
• 15:23
  are called scoped keys and rotate. What are those?
• 15:40
  Okay, so even if Hacker manages to steal the
• 15:47
  valet key, they can't drive the car on the highway
• 15:49
  or steal the valuables in the trunk. They can
• 15:52
  only do the very specific limited task the key
• 15:56
  was designed for, like log in an email address.
• 15:58
  Exactly. And then you combine that with rotating
• 16:01
  keys, which means the lock changes automatically
• 16:04
  every few hours or days. Oh, that's smart. Right.
• 16:07
  So even if a bot scrapes your key, by the time
• 16:10
  the hacker tries to actually use it to extract
• 16:12
  a database, the key is already dead. If those
• 16:16
  basic architectural rules had been followed,
• 16:18
  this breach simply wouldn't have happened. It's
• 16:21
  frustrating because the solutions are so readily
• 16:23
  available, but I feel like we should talk about
• 16:25
  data minimization, too, because MAG did actually
• 16:27
  do something right here that saved them from
• 16:30
  a total catastrophe. They did. The ancillary
• 16:33
  system that was breached simply wasn't allowed
• 16:34
  to store credit card data. The decision to not
• 16:37
  store that data alongside the parking and marketing
• 16:40
  profiles was likely made years ago during the
• 16:43
  system's design phase. And thank God for that.
• 16:45
  Truly. That is the core tenet of data minimization.
• 16:50
  You cannot lose what you do not keep. If you
• 16:53
  don't need a piece of data to run a specific
• 16:55
  service, just do not store it. Because if it
• 16:58
  had been storing credit cards alongside postcodes,
• 17:01
  emails, and license plates, the damage would
• 17:04
  be orders of magnitude worse. Oh, it would be
• 17:06
  game over. It would be one of the worst breaches
• 17:09
  of the decade. However, we shouldn't let them
• 17:11
  off the hook entirely here. Fair enough. Because
• 17:13
  under global privacy frameworks like the GDPR
• 17:16
  in the UK or the notifiable data breaches scheme
• 17:19
  in Australia, losing an email combined with a
• 17:22
  postcode and a license plate is still legally
• 17:25
  considered a significant compromise of privacy.
• 17:27
  It still counts. It definitely counts. It requires
• 17:29
  mandatory reporting and carries serious regulatory
• 17:32
  weight. Which naturally leads into the PR fallout
• 17:35
  of this whole event. Because MAG came out fast
• 17:37
  and framed it as mostly just email addresses,
• 17:39
  they really downplayed the severity early on.
• 17:42
  They did. And I understand the fog of horror
• 17:43
  is real in a cyber incident. You don't always
• 17:45
  know what you've lost on day one. But the credibility
• 17:47
  cost of that early framing was brutal. It was.
• 17:51
  When you communicate early in a crisis, you have
• 17:54
  to leave room for the story to grow. Because
• 17:56
  when richer data samples surfaced in the hands
• 17:58
  of criminals a few days later and were verified
• 18:01
  by independent journalists, Mag's initial reassurances
• 18:04
  looked either incompetent or deceptive. Right.
• 18:07
  If you tell your customers it's just emails and
• 18:10
  then hackers drop a file with their home addresses
• 18:12
  and upcoming vacation dates, you lose trust instantly.
• 18:15
  Exactly. Over -reassurance costs you credibility
• 18:18
  exactly when you need it most. So what does this
• 18:21
  all mean? When we look at this whole story, from
• 18:23
  the Wi -Fi login to the extortion demands, the
• 18:26
  underlying theme is that a company's security
• 18:29
  is only as strong as its marketing department's
• 18:32
  newest widget. That's the reality we live in.
• 18:34
  And there is this massive irony here. Companies
• 18:37
  spend millions of dollars guarding the front
• 18:39
  door, you know, the payment processors, the core
• 18:42
  infrastructure, the flight operations. But they
• 18:44
  leave the side window, the marketing data, the
• 18:47
  engagement metrics wide open because they view
• 18:50
  that data as low risk. And as we've learned today,
• 18:53
  hackers don't need your credit card to ruin your
• 18:55
  week. They just need enough context to trick
• 18:57
  you into giving it to them yourself. The illusion
• 18:59
  of harmless data is just that it's an illusion.
• 19:02
  Context is a weapon. Let's do a quick recap.
• 19:05
  We started with a simple airport Wi -Fi login
• 19:08
  and followed that thread to an exposed API key
• 19:11
  sitting in plain sight in a web page's source
• 19:13
  code, just waiting for an automated bot to scrape
• 19:15
  it. That single, easily preventable architectural
• 19:19
  error resulted in 8 .7 million compromised records,
• 19:23
  giving cybercriminals a treasure trove of highly
• 19:26
  contextual data parking dates, license plates,
• 19:29
  postcodes. It is an absolute masterclass in why
• 19:32
  every piece of seemingly harmless data matters
• 19:35
  and why the line between client -side convenience
• 19:37
  and server -side security is so critical. It
• 19:39
  really is. And, you know, it's worth reiterating
• 19:42
  the practical advice MAG gave their customers
• 19:44
  through all this. What was that? Legitimate companies
• 19:47
  will never contact you out of the blue asking
• 19:49
  for car details, banking information, or passwords.
• 19:53
  Right. If you get an email about your parking
• 19:55
  validation or a delayed flight or an impound
• 19:58
  fee and it demands immediate payment, stop. Breathe.
• 20:02
  Let the cortisol pass. Exactly. Don't click the
• 20:04
  link in the email. Never click the link. Go independently
• 20:07
  to the official website. Type the URL in yourself.
• 20:11
  And log into your account there, especially when
• 20:13
  the phishing email looks exactly like a real
• 20:15
  receipt and knows exactly what terminal you parked
• 20:18
  in last Tuesday. Independent verification is
• 20:21
  literally your only defense against highly contextual
• 20:24
  phishing. It really is. Verifying the source
• 20:26
  takes maybe 10 extra seconds, but it neutralizes
• 20:29
  the entire threat. Well said. Thank you for joining
• 20:32
  us for this deep dive. We love unpacking these
• 20:35
  hidden mechanics of the digital world with you,
• 20:36
  but we want to leave you with a final lingering
• 20:39
  thought. Think about this one. The next time
• 20:41
  you're checking out online and you see that little
• 20:43
  box asking if you want to receive marketing updates
• 20:46
  or the next time you're sitting at a gate and
• 20:48
  you trade your personal email for 30 minutes
• 20:51
  of free Wi -Fi, ask yourself, how many invisible
• 20:54
  third -party doors are you opening to your personal
• 20:57
  life just to save $5? Think about it. See you
• 21:00
  next time.