Weekly Update 310

By all accounts, this was one of the best weekly updates ever courtesy of a spam caller giving me a buzz at the 38:40 mark and struggling with "pwn" versus "porn". It resulted in an entertaining little on-air call and subsequently caused me to go out and register both haveibeeninpwn.com and haveibeeninporn.com. I figure these will result in much ongoing hilarity the next time I get a call of this nature about one of those domains 🤣 Oh - and there's a whole bunch of data breach stuff this week, enjoy!

References

1. The Mudge v. Twitter scandal has some pretty serious accusations in it (there's a 6 min CNN vid in that tweet that's worth a look)
2. Plex has gone for another round of data breach this week (actually pretty impressed that they now have 30M subscribers!)
3. LastPass has also gone for another round (I know the optics aren't good, but the real world impact of this is almost certainly insignificant)
4. I got a very convincing SMS phish this week (think about the human vulnerabilities this exploits, no wonder phishing remains so lucrative)
5. Sponsored by: Kolide is a fleet visibility solution for Mac, Windows, and Linux that can help you securely scale your business. Learn more here.

Weekly Update 309

Right off the back of a visit to our wedding venue (4 weeks and counting!) and a few hours before heading to the snow (yes, Australia has snow), I managed to slip in a weekly update earlier today. I've gotta say, the section on Shitexpress is my favourite because there's just so much to give with this one; a service that literally ships shit with a public promise of multiple kinds of animal shit whilst data that proves only horse shit was ever shipped, a promise of 100% anonymity whilst the data set clearly shows both shit-senders and shit-receivers and possibly the most eye-opening of all, the messages accompanying the shit. So, uh, yeah, enjoy! 💩

References

1. The acoustic panelling in my office is starting to come together, but it needs more work (I'll always notice those little misaligned lines... and you probably will too now that I've mentioned it!)
2. Kickstarter's password reset email left a lot of people confused (turns out they were just rolling people on Facebook auth to native Kickstarter accounts, but by their own admission the messaging was really confusing)
3. Turns out the source of the templated emails I was getting about removing data from HIBP was Rightly (their intentions are good, but IMHO their execution is poor)
4. Shitexpress - where do I even being with this one?! (just read my Twitter thread on it, it's all kinds of crazy this one)
5. Sponsored by: Kolide can help you nail third-party audits and internal compliance goals with endpoint security for your entire fleet. Learn more here.

Weekly Update 308

It was all a bit last minute today after travel, office works and then a quick rebuild of desk and PC before doing this livestream (didn't even have time to comb my hair!) So yes, I took a shortcut with the description of this video, but it all worked out well in the end IMHO with plenty of content that wasn't entirely data breach related, but yeah, that does seem to be a bit of a recurring theme in these vids. Enjoy 😊

References

1. The acoustic panelling in my office is starting to look awesome (some stuff is not lining up so it will be a little longer yet before completion)
2. The QuestionPro breach has been pretty poorly handled (it's also now well beyond debate that it's real)
3. If you're sending a C&D notice to a data breach forum, you're really got no idea how these things work (and now their data is... everywhere)
4. Here's that UniFi Protect Theta cam (they're pumping out so much cool stuff lately 😎)
5. The stage at NEXTGEN's Cyber Republic event was pretty awesome (the delayed flight home, late night and early start the next day was... less awesome 🙁)
6. I got what will possibly be the funniest set of spammer responses to Password Purgatory this week 🤣 (also learned a few things, I'm determined to get even better at this!)
7. Sponsored by: Kolide believes that maintaining endpoint security shouldn’t mean compromising employee privacy. Check out our manifesto: Honest Security.

Weekly Update 306

I didn't intend for a bunch of this week's vid to be COVID related, but between the breach of an anti-vaxxer website and the (unrelated) social comments directed at our state premier following some pretty simple advice, well, it just kinda turned out that way. But there's more on other breaches too, in particular the alleged Paytm one and the actual Customer.io one.

I'm really looking forward to next week's update, here's a little teaser of what you can expect to hear about then 🤣

References

1. I've updated the Paytm data breach to be flagged as "fabricated" (full thread on the reasons why, it's a tricky one)
2. Anti-vax dating site that let people advertise ‘mRNA FREE’ semen left all its user data exposed (😲😳😲)
3. I'm genuinely sympathetic to all politicians on any side of the political fence who have to deal with the COVID mess (just read the volume of ridiculous crap they're at the receiving end of)
4. We're still seeing the long tail of the Customer.io data breach (protecting against malicious insiders is a hard one)
5. Sponsored by: Kolide is an endpoint security solution for teams that want to meet SOC2 compliance goals without sacrificing privacy. Learn more here.

Weekly Update 305

I broke Yoda's stick! 3D printing woes, and somehow I managed to get through the explanation without reverting to a chorus of My Stick by a Bad Lip Reading (and now you'd got that song stuck in your head). Loads of data breaches this week and whilst "legacy", still managed to demonstrate how bad some practices remain today (hi Shadi.com 👋). Never a dull moment in data breach land, more from there next week 😊

References

1. The Yoda 3D print looks amazing (just don't touch his stick)
2. New flash - social media platform collects lots of data! (seriously, the TicTok hyperbole got a bit too much this week)
3. What if... some free stuff is actually free? (you're not always "the product" and in many cases, that's frankly a pretty disingenuous term)
4. Sponsored by: Kolide is a fleet visibility solution for Mac, Windows, and Linux that can help you securely scale your business. Learn more here.

Weekly Update 304

It's very much a last-minute agenda this week as I catch up on the inevitable post-travel backlog and pretty much just pick stuff from my tweet timeline over the week 😊 But hey, there's some good stuff in there and I still managed to knock out almost an hour worth of content!

References

1. La Poste Mobile got themselves ransom'd and their data dumped (and they're still offline)
2. Mangatoon are very clearly covering up their breach (which is now hard to do given it's in HIBP and received plenty of press)
3. The "Seconds" app is my secret presenting sauce! (any workout app that can run a sequence of timed intervals will do it)
4. I'm totally loving Apple's AirTags to track all my things! (not loving that my AMG is still sitting Melbourne 🤦‍♂️)
5. The Wi-Fi BBQ thermometer is actually really neat (and it does benefit from being connected, too)
6. Sponsored by: Kolide can help you nail third-party audits and internal compliance goals with endpoint security for your entire fleet. Learn more here.

Weekly Update 303

And we're finally done with this trip. 26 days, 14 different accommodations, 5,146km of driving through 4 states and the last 4 weekly vids all done on the road. Travel is great, but right now going home is even better 😊 Next week's vid will be back in my comfy office with good lighting, video, audio and better planning. Until then, here's a (late) weekly update 303:

References

1. If you're going to scrape someone else's content, don't embed the images directly off their site! (referrer header based Rickrolls 😎)
2. The Shanghai police data breach is massive... (if it turns out to be legitimate)
3. SHA-1 is fine and k-anonymity isn't PII (and frankly, if an organisation doesn't understand these simple facts, they've got bigger issues to deal with)
4. The Polish government is the 34th to use HIBP's gov service (and I'm still toying with the idea of doing a "visit all the govs" tour one day)
5. My 12th MVP award came in this week (it's still such an important part of my career 😊)
6. Sponsored by: CrowdSec - The open-source & collaborative security stack: respond to attacks & share signals across the community. Download it for free