>>> Some sophisticated hackers
managed a big hit on two las
Vegas casino giants this past
week at Caesar's palace and
harrahs.
Many had their social security
and driver's license information
stolen.
Caesar's paid a ransom.
They froze slot machines and
atms including at the bellagio
and mgm grand.
Elevators went out of order.
Revolving doors stopped working.
Some people couldn't get into
their rooms.
Their key cards would not work
and so on and so on.
It sounds like a nightmare for
cuers out there.
Let discuss.
A former general counsel with
the national security agency who
currently serves as a senior
adviser for strategic and
international studies.
You first.
How widespread was this attack?
I mean, the doors didn't work,
elevators, personal information
stolen.
This was pretty, this was nasty.
>> They say the house always
wins in Vegas.
Tell that to the I.T.
Department.
Two different hacks with two
different outcomes.
Caesar's is saying in an S.E.C.
Filing, they've been hacked,
their loyalty program which
includes customers' driver's
license number and social
security numbers, although they
say to the best of their
knowledge, that information has
been deleted.
On the other hand you have mgm
where we've seen widespread
outages from the casino floor to
hotel rooms.
It is having a devastating
effect within mgm properties.
I talked to someone.
He said they've been able to
access all of these different
systems which is poor cyber
security handling.
The worst-case scenario as it
appears to be happening with
mgm, if hackers can get in one
system, they can get in all of
them.
>> What's your sense of what
occurred?
Why casinos?
>> Well, to take why casinos
first, the old Willy Sutton
joke.
Why do you rob banks?
That's where the money is.
Casinos are a really good target
for these criminals.
Lots of money there.
A strong incentive to pay
ransom.
They can't afford a single day
of down time and they have an
incredibly rich set of data.
Who are the major gamblers and
financial details about them, et
cetera.
Lots of reasons these are really
good targets.
>> And I have to think some high
rollers are pretty nervous about
all of this.
And speaking of the ransom
issue, there are reports that
Caesar's entertainment was asked
to pay $30 million for a promise
to secure its data and may have
paid $15 million?
What do we know about that?
>> What's fascinating, it
appears that Caesar's did pay
the ransom.
They said in the S.E.C. Filing
they've taken steps to ensure
the data has been deleted,
although they can't guarantee
it.
That's an admission that they
fade ransom.
Mgm did not appear to pay the
ransom and saw the widespread
outages in mgm and not in
Caesar's.
It is ironic, for Caesar's,
paying the ransom is a gamble.
You Faye ransom and you gain
access to your systems.
It's not clear the hackers will
do what they claim they will do
if you Faye ransom.
Two, there could be legal
liability.
It's not illegal to pay a ransom
but it is if it is a sanctioned
group.
Say North Korea.
Once you pay a ransom, you put a
target on your back as a company
who is willing to pay a ransom.
Other hackers take note.
The former FBI agent said it
might cost them tens of millions
to beef up their systems because
other hackers will see this and
make attempts of their own.
>> And folks might be tempted to
not feel sorry for the casinos.
There's a ton of casino workers
in Las Vegas so there are folks
affected by this.
Let's listen to how an mgm
employee describes the attack to
our aif I will.
I can't we should note she
wanted to be anonymous.
Let's listen to this.
>> Throughout the day it got
worse and worse and worse until
we had no access at the end of
the day.
More and more of the people
working there had access to
everything, throughout the day,
oh, phone lines are down.
Scheduling is down.
Okay, now workday is down, now
everything is down.
>> What does that description
tell you?
And how widespread this was.
It is pretty extraordinary, what
they were able to pull off.
>> Sure.
And it's not totally clear
because mgm hasn't publicly said
a lot about this hack.
Whether they turned off the
systems themselves in order to
prevent the criminals from
getting further into their
systems, in order to get them
out, they have to clean them out
and reboot the system.
Maybe they turned their systems
off, which by the way is exactly
what colonial pipelines did a
couple years ago.
They had to turn offer the oil
pipelines even though the
pipelines themselves weren't
directly affected.
So what this is telling me,
we've been going down a path,
because of digital technology,
it is really convenient to have
everything integrated.
So at mgm, you can have your
loyalty reward program, your
door key, your digital door key,
the means of payment, how you
order room service, all on one
app.
Incredibly convenient for the
hotel as well as for the person.
But this creates incredible
complexity.
If you have to turn off one
system, you may be having to
turn off your entire corporate
network, which is what we're
seeing here.
All of this is because we're
based just on passwords to get
into systems.
When criminals are able to
figure out a way to pretend
they're you, call up the help
desk as apparently happened
here, and say, give me a
password.
I lost my password.
And they're able to figure out
and spoof your identity.
Maybe they read some information
about you online and they know
where you were born, your
birthday, they got your social
security number somehow.
It is possible to get your
password and wreak havoc because
they can claim to be you.
And all of that is based on the
vulnerabilities of passwords.
>> How do the casinos prevent
this from happening again?
If you walk into a casino and
try rob a casino, you're going
to have a bad day.
I wonder if their defenses are
where they should be.
>> So this shows the
vulnerability of supply chains.
It has to be connected to your
network to provide payments,
insurance, some other system.
And when someone can get inside
one of these other vendors and
use that to sort of ride into
your corporate system, and you
have a big complicated corporate
system with lots of
vulnerabilities, this will be an
ongoing vulnerability.
Until we move to a situation
which will take years, we'll
probably get there.
Until we get to a situation
where we don't really rely on
passwords that much.
We use iris technology,
fingerprints, whatever the
system is.
As we move away from passwords,
the problem with passwords, if
you lose it, you have to be able
to call and say I lost my
password and I want it back.
That very infirmity is at the
heart of this.
>> That raises the issue of
passwords.
It is the one thing that drives
everybody nuts.
Trying to remember the
passwords.
You think it is better and safer
to go with racial recognition?
Recognition software?
>> The problem with passwords,
it is possible to call the Hepp
desk and say I lost my password.
Once we do that, the water is
over the dam.
The technology is going to
improve.
We're still in a cat and mouse
game.
The bad guys will figure out
with artificial intelligence.
So I'm not saying it is a
panacea.
We won't solve this problem
overnight.
We're administration great
strides as we move from
passwords to pass keys, digital
authentic indicators, USB
sticks.
Slowly we'll get better but it
is uphill.
>> Yeah, thanks.
The bottom liner is it will