Weekly Update 315

How's this weeks video for a view?! It's a stunning location here in Bali and it's just been the absolute most perfect spot for a honeymoon, especially after weeks of guests and celebrations. But whoever hacked and ransom'd Optus didn't care about me taking time out and I've done more media in the last week than I have in a long time. I don't mind, it's a fascinating story the way this has unfolded and that's where most of the time in this week's video has gone, I hope you enjoy my analysis of what has become a pretty crazy story back home in Australia.

References

1. Bali is a stunning place with postcard worthy shots around every corner (link through to the tweet thread with all the magic 😍)
2. I've never seen a data breach make as much local news as Optus has, not even close! (link through to Jeremy Kirk's thread explaining how it went down)
3. When people are wondering if they need to change their name and date of birth in the wake of a data breach, you know there's bigger problems to be solved (seriously, depending on numbers as some sort of secret source sufficient to form a significant part of an identity theft attack is madness and needs to die in a fire)
4. Sponsored by: Varonis. Reduce your SaaS blast radius with data-centric security for AWS, G Drive, Box, Salesforce, Slack and more.

Weekly Update 314

Wow, what a week! Of course there's lots of cyber / tech stuff in this week's update, but it was really only the embedded tweet below on my mind so I'm going to leave you with this then come to you from somewhere much more exotic than usual (and I reckon that's a pretty high bar for me!) next week 😎

Absolutely over the moon to formally make @Charlotte_Hunt_ a part of our family ❤️ 💍 pic.twitter.com/XfahXElboC

— Troy Hunt (@troyhunt) September 21, 2022

References

1. Optus disclosed a breach, but really didn't share much solid information about it... unlikely what Jeremy Kirk has since tweeted (these tweets came out after I recorded the vid so I didn't reference them, but it's the best analysis of the legitimacy of the data that I've seen to date)
2. Lots of gigabytes of TAP Air Portugal customers is now floating around (and it's searchable within HIBP)
3. Sponsored by: SecAlerts vulnerability awareness: Receive CVE & zero-day alerts, news & version updates all matched to your software. Discount code within!

Weekly Update 313

I came so close to skipping this week's video. I'm surrounded by family, friends and my amazing wife to be in only a couple of days. But... this video has been my constant companion through very difficult times, and I'm happy to still being doing it at the best of times 😊 So, with that, I'm signing out and heading off to do something much more important. See you next week.

Taking a bit of time off Twitter while @charlottelyng and I do more important things 💍 👰‍♀️ pic.twitter.com/9JJrPM9kWX

— Troy Hunt (@troyhunt) September 13, 2022

References

1. The Brand New Tube video site was breached and is now in HIBP (350k account details of what seems to be a very, uh, "unique" demographic were exposed)
2. The TikTok breach that... wasn't (why is this still getting media attention?!)
3. Sponsored by: Varonis. Reduce your SaaS blast radius with data-centric security for AWS, G Drive, Box, Salesforce, Slack and more.

Weekly Update 312

I'm so excited to see the book finally out and awesome feedback coming in, but I'm disappointed with this week's video. I frankly wasn't in the right frame of mind to do it justice (it's been a very hard road up until this point, for various reasons), then my connection dropped out halfway through and I had to roll to 5G, and now I'm hearing (both from other people and with my own ears), a constant background noise being picked up by the mic. Argh! But, that's the reality of scheduled live streams and for better or worse, you end up getting the "warts and all" version. It is what it is, and next week's will be better 😊

References

1. book.troyhunt.com
2. Sponsored by: Kolide believes that maintaining endpoint security shouldn’t mean compromising employee privacy. Check out our manifesto: Honest Security.

Weekly Update 311

Well, after a crazy amount of work, a lot of edits, reflection, and feedback cycles, "Pwned" is almost here:

This better be a sizzling read @troyhunt or I'll be crashing the wedding in ways never done before.

Also, I thought they'd cancelled Neighbours? 😉❤️ pic.twitter.com/jrYIKtL0Uh

— Mike Thompson (@AppSecBloke) August 30, 2022

The preview cycle is in full swing with lots of feedback coming in and revisions being made before we push it live to the masses. This is really exciting and I can't wait to get the book out there in front of everyone, stay tuned 😊

References

1. There's clearly more going on behind the scenes with Krebs' "Final Thoughts on Ubiquiti" post (but hey, I love what they both do so hopefully that's that and everyone can get back to doing what they do best)
2. The Russian streaming service START made it into HIBP (should I have done anything differently because it's Russian, or mostly full of Russian subscribers?)
3. The Stripchat data is also now in HIBP (a very adult website so flagged as "sensitive" and not publicly searchable)
4. I love a good crazy corporate response on Twitter, so here's a couple of them for you 😊 (quite funny that Ocado now decides to delete their crazy tweet!)
5. Sponsored by: Kolide is an endpoint security solution for teams that want to meet SOC2 compliance goals without sacrificing privacy. Learn more here.

Weekly Update 310

By all accounts, this was one of the best weekly updates ever courtesy of a spam caller giving me a buzz at the 38:40 mark and struggling with "pwn" versus "porn". It resulted in an entertaining little on-air call and subsequently caused me to go out and register both haveibeeninpwn.com and haveibeeninporn.com. I figure these will result in much ongoing hilarity the next time I get a call of this nature about one of those domains 🤣 Oh - and there's a whole bunch of data breach stuff this week, enjoy!

References

1. The Mudge v. Twitter scandal has some pretty serious accusations in it (there's a 6 min CNN vid in that tweet that's worth a look)
2. Plex has gone for another round of data breach this week (actually pretty impressed that they now have 30M subscribers!)
3. LastPass has also gone for another round (I know the optics aren't good, but the real world impact of this is almost certainly insignificant)
4. I got a very convincing SMS phish this week (think about the human vulnerabilities this exploits, no wonder phishing remains so lucrative)
5. Sponsored by: Kolide is a fleet visibility solution for Mac, Windows, and Linux that can help you securely scale your business. Learn more here.

Weekly Update 309

Right off the back of a visit to our wedding venue (4 weeks and counting!) and a few hours before heading to the snow (yes, Australia has snow), I managed to slip in a weekly update earlier today. I've gotta say, the section on Shitexpress is my favourite because there's just so much to give with this one; a service that literally ships shit with a public promise of multiple kinds of animal shit whilst data that proves only horse shit was ever shipped, a promise of 100% anonymity whilst the data set clearly shows both shit-senders and shit-receivers and possibly the most eye-opening of all, the messages accompanying the shit. So, uh, yeah, enjoy! 💩

References

1. The acoustic panelling in my office is starting to come together, but it needs more work (I'll always notice those little misaligned lines... and you probably will too now that I've mentioned it!)
2. Kickstarter's password reset email left a lot of people confused (turns out they were just rolling people on Facebook auth to native Kickstarter accounts, but by their own admission the messaging was really confusing)
3. Turns out the source of the templated emails I was getting about removing data from HIBP was Rightly (their intentions are good, but IMHO their execution is poor)
4. Shitexpress - where do I even being with this one?! (just read my Twitter thread on it, it's all kinds of crazy this one)
5. Sponsored by: Kolide can help you nail third-party audits and internal compliance goals with endpoint security for your entire fleet. Learn more here.

Weekly Update 308

It was all a bit last minute today after travel, office works and then a quick rebuild of desk and PC before doing this livestream (didn't even have time to comb my hair!) So yes, I took a shortcut with the description of this video, but it all worked out well in the end IMHO with plenty of content that wasn't entirely data breach related, but yeah, that does seem to be a bit of a recurring theme in these vids. Enjoy 😊

References

1. The acoustic panelling in my office is starting to look awesome (some stuff is not lining up so it will be a little longer yet before completion)
2. The QuestionPro breach has been pretty poorly handled (it's also now well beyond debate that it's real)
3. If you're sending a C&D notice to a data breach forum, you're really got no idea how these things work (and now their data is... everywhere)
4. Here's that UniFi Protect Theta cam (they're pumping out so much cool stuff lately 😎)
5. The stage at NEXTGEN's Cyber Republic event was pretty awesome (the delayed flight home, late night and early start the next day was... less awesome 🙁)
6. I got what will possibly be the funniest set of spammer responses to Password Purgatory this week 🤣 (also learned a few things, I'm determined to get even better at this!)
7. Sponsored by: Kolide believes that maintaining endpoint security shouldn’t mean compromising employee privacy. Check out our manifesto: Honest Security.

Weekly Update 306

I didn't intend for a bunch of this week's vid to be COVID related, but between the breach of an anti-vaxxer website and the (unrelated) social comments directed at our state premier following some pretty simple advice, well, it just kinda turned out that way. But there's more on other breaches too, in particular the alleged Paytm one and the actual Customer.io one.

I'm really looking forward to next week's update, here's a little teaser of what you can expect to hear about then 🤣

References

1. I've updated the Paytm data breach to be flagged as "fabricated" (full thread on the reasons why, it's a tricky one)
2. Anti-vax dating site that let people advertise ‘mRNA FREE’ semen left all its user data exposed (😲😳😲)
3. I'm genuinely sympathetic to all politicians on any side of the political fence who have to deal with the COVID mess (just read the volume of ridiculous crap they're at the receiving end of)
4. We're still seeing the long tail of the Customer.io data breach (protecting against malicious insiders is a hard one)
5. Sponsored by: Kolide is an endpoint security solution for teams that want to meet SOC2 compliance goals without sacrificing privacy. Learn more here.

Weekly Update 305

I broke Yoda's stick! 3D printing woes, and somehow I managed to get through the explanation without reverting to a chorus of My Stick by a Bad Lip Reading (and now you'd got that song stuck in your head). Loads of data breaches this week and whilst "legacy", still managed to demonstrate how bad some practices remain today (hi Shadi.com 👋). Never a dull moment in data breach land, more from there next week 😊

References

1. The Yoda 3D print looks amazing (just don't touch his stick)
2. New flash - social media platform collects lots of data! (seriously, the TicTok hyperbole got a bit too much this week)
3. What if... some free stuff is actually free? (you're not always "the product" and in many cases, that's frankly a pretty disingenuous term)
4. Sponsored by: Kolide is a fleet visibility solution for Mac, Windows, and Linux that can help you securely scale your business. Learn more here.

Weekly Update 304

It's very much a last-minute agenda this week as I catch up on the inevitable post-travel backlog and pretty much just pick stuff from my tweet timeline over the week 😊 But hey, there's some good stuff in there and I still managed to knock out almost an hour worth of content!

References

1. La Poste Mobile got themselves ransom'd and their data dumped (and they're still offline)
2. Mangatoon are very clearly covering up their breach (which is now hard to do given it's in HIBP and received plenty of press)
3. The "Seconds" app is my secret presenting sauce! (any workout app that can run a sequence of timed intervals will do it)
4. I'm totally loving Apple's AirTags to track all my things! (not loving that my AMG is still sitting Melbourne 🤦‍♂️)
5. The Wi-Fi BBQ thermometer is actually really neat (and it does benefit from being connected, too)
6. Sponsored by: Kolide can help you nail third-party audits and internal compliance goals with endpoint security for your entire fleet. Learn more here.