Weekly Update 334

Did I really need to get a connected BBQ? No more than I needed to connect most of the other things in the house which is to say "a bit useful but not entirely necessary". But it's a fascinating process when looked at through the lens of how accessible the technology is to your average person given it's embedded in a consumer-orientated product. In short - it's painful - but listen to this week's update to hear precisely why. Plus, there's a heap of new data breach and some really, really good news about the NTLM hashes now being available in Pwned Passwords. Enjoy 😊

References

1. BBQ'ing shouldn't be this hard (not the cooking, I mean getting the damn thing connected to the network!)
2. Instant Checkmate was breached (12M email addresses right there)
3. TruthFinder was also breached (same parent company, another 8M addresses there)
4. The LimeVPN breach also went into HIBP (you really want to be able to trust your VPN provider)
5. Weee was breached too (another case where it was too hard to get in touch with them)
6. Full parity for NTLM hashes in Pwned Passwords is now live! (once again, bit shout out to Stefán Jökull Sigurðarson for his work on this)
7. Sponsored by: Kolide ensures only secure devices can access your cloud apps. It's Device Trust tailor-made for Okta. Book a demo today.

Weekly Update 333

Getting everything out nice and early today so we can get out there in hit the wake park in the balmy "well over 30C" weather (the radio is talking about "severe heatwave weather" as I write this). But hey, we're surrounded by water and a beer delivery is due today so no crisis 😎 There's also a heap more data breach news and I'll be putting that connected BBQ to use for the first time today, stay tuned for epic pics on all of the above over the coming hours!

References

1. HTTPS still doesn't equal trust, it never did, it never will and Aussie Broadband were way off the mark to imply otherwise (they did later recant on that position, but the messaging still isn't completely right)
2. Namesco in the UK sent out messaging to customers which shows they have absolutely no idea about some of the most basic, fundamental tents of how SSL works (hoping we get a follow-up on this, it's inexcusable in this day and age)
3. Planet Ice in the UK was breached (240k people with 82% of them already in HIBP)
4. Pitt Meadows School District in British Columbia was breached (only 0.1% of accounts were already in HIBP)
5. I'm getting seriously sick of the lack of proper disclosure from many organisations (it really isn't this hard - it shouldn't be this hard)
6. I bought a connected BBQ! (stay tuned for deliciousness 🤤)
7. Sponsored by: CrowdSec - Gain crowd-sourced protection against malicious IPs and benefit from the most accurate CTI in the world. Get started for free.

Weekly Update 332

Breaches all over the place today! Well, this past week, and there's some debate as to whether one of them is a breach, a scrape or if the term just doesn't matter anyway. Plus, we've been kitchen shopping, I'm helping friends out with connected doorbells and other random but somehow related things this week. Enjoy 😊

References

1. I'll be "at" GOTO Aarhus in May (there online, but definitely speaking at the show)
2. Following all the awesome input, we decided to forego the teppanyaki plate on the Bora Professional 3.0 (there's a surprising amount of good culinary advice from my audience!)
3. Zurich Japan was breached (big name, but small portion of people already in HIBP)
4. Autotrader had a heap of data breacraped (breached? scraped? does it matter?)
5. Speaking of which, when actually is a scrape a breach? (my more concerted thoughts on the matter all in one place)
6. Norwegian adventure store KomplettFritid was also breached (apparently, they decided to not tell their customers)
7. GoTo, the owner of LastPass, "shared more bad news" (I do have some historical views on this organisation...)
8. Hey, it's my views on GoTo! (nearly 13 years old now, but this remains poor behaviour IMHO)
9. Sponsored by: CrowdSec - Gain crowd-sourced protection against malicious IPs and benefit from the most accurate CTI in the world. Get started for free.

Weekly Update 331

Well and truly back into the swing of things in the new year, I think what I've found most satisfying this week is to sit down and pump out a decent blog post on something technical. It's an itch I just haven't had enough time to scratch properly in recent times and I really hope Pwned or Bot makes up for that. I love that it's generating discussion (both for and against) and that it's causing people to stop and think about how we establish the legitimacy of identities in an increasingly bot-centric world. I hope you enjoy this week's update and all the conversation surrounding it.

References

1. Pollies, porn and pyrotechnics (and now I know why Canberra is know for porn)
2. The Twitter API situation is a complete flustercuck (I'd be less upset if they made the native app way better)
3. What is 1Password had a data breach? (read about how they protect your keychain such that even after a data breach, the master password alone would be useless)
4. Since recording this morning, I've poured hours into what presently has a working titled of "Down the Cloudflare / Stripe / OWASP Rabbit Hole: A Tale of 5 Rabbits Deep 🐰 🐰 🐰 🐰 🐰" (I just kept going until I got stuck and pumped out the linked tweet)
5. Pwned or Bot is drumming up plenty of good feedback and in true Twitter form, plenty of controversy (no, you shouldn't be penalised for not being breached, go back and read the whole thing again)
6. Sponsored by: CrowdSec - Gain crowd-sourced protection against malicious IPs and benefit from the most accurate CTI in the world. Get started for free.

Weekly Update 330

Big week! So big, in fact, that I rushed into this week's update less prepared and made it a very casual one, which is just fine 😊 It's mostly password books and kitchen equipment this week, both topics which had far more engagement than I expected but made them all the more interesting. Next week I'll get back into the pattern of switching between last thing Friday and first thing Friday so it'll be my morning again on the 20th, see you then!

References

1. After all this week's action, I was a little bit less organised today (link through to a Facebook post, I put a lot more pics and vids there than on other platforms)
2. I'm ok with password books (you can buy them down at our local post office)
3. I'm so ok with password books, that I wrote an entire blog post on it a few years ago (well, on that and other aspects of why chasing the perfect security solution isn't the right approach)
4. It's looking increasingly dire for 3rd party Twitter clients using their API (surely it would be communicated in advance if they were being killed?)
5. My kitchen rebuild tweet thread had some awesome responses to it (the suggestions there will definitely help shape the final product)
6. Sponsored by: CrowdSec - The open-source & collaborative security stack: respond to attacks & share signals across the community. Download it for free

Weekly Update 329

Strap yourself in, this is a big one! Big video, big breach (scrape?), and a big audience today. The Twitter incident consumed a heap of my time before, during and after this live stream, but then I go and get a sudden itch to do stuff like the number plate capturing and, well, there goes even more hours I don't have. But hey, I love what I do and I have no regrets, I hope you enjoy watching this week's vid 😊

Oh - one more thing: today I set up an official Mastodon account for HIBP. If you've got a footprint in the fediverse, please go and give the account a follow. There are a bunch of others out there that definitely aren't run by me, it's only this one, it only follows me personally and it has a verified website of haveibeenpwned.com so should be easy to find even if you don't follow the link above.

References

1. The old legacy rate limit for the HIBP API is now gone (loads of warning on this, but the stats show a lot of extra requests being rate limited since the change hit)
2. The Deezer breach has been really poorly communicated on their behalf (seems like they forgot to notify, well, everyone!)
3. Looks like the scraped Twitter data all came by throwing previously breached email addresses at a vulnerable API (you can't even blame Elon for that one... but you can probably blame him for the zero comms on the incident)
4. I had way too much fun letting ChatGPT mess with a spammer (he wasn't quite as amused as me 🤣)
5. I've been playing around with capturing number plates via my Ubiquiti gear (after more trialling today, my conclusion is that I need to get my hands on some of their new AI gear and stop trying to build this myself)
6. Sponsored by: 1Password, a secure password manager, is building the passwordless experience you deserve. See how passkeys work

Weekly Update 328

We made it! That's 2022 done and dusted, and what a year it was, both professionally and personally. It feels great to get to the end of the year with all the proverbial ducks lined up, some massive achievements now behind us (not least of which was the wedding), and a clean slate coming into 2023 to do amazing things. I'm super excited about next year and can't wait to share a whole bunch of new stuff over the coming 52 Fridays. For now though, here's the last of it from a pretty crazy year, enjoy 😊

References

1. We spent Xmas day poolside in Singapore (yes, some places in the world are actually hot when Santa comes!)
2. Could ChatGPT be used to toy with spammers? (let's find out, I'll keep the thread updated with any responses 🙂)
3. I've been shuffling around a bunch of my Home Assistant entities from switches to lights (anecdotally, these changes appear to have really improved things thus far)
4. Sponsored by: 1Password, a secure password manager, is building the passwordless experience you deserve. See how passkeys work

Weekly Update 327

It's my last weekly update on the road for a while! As enjoyable as travel is, I'm looking forward to getting back to a normal routine and really starting to smash out some of the goals I have for the coming year. For now though, I've published this a couple of days after recording, and a day after an awesome hot, beachside Christmas. Hope yours has been amazing too, see you from home next week 😊

References

1. LastPass has added an update re their recent security incident (if keychains have been downloaded - even fully encrypted ones - that's bad news)
2. Personally, I quite like the public view count on all tweets (if you dislike it just purely because it was introduced under Elon's reign, that's a different problem)
3. Sponsored by: 1Password, a secure password manager, is building the passwordless experience you deserve. See how passkeys work

Weekly Update 326

Despite having both my tripod and mic in the wrong suitcase in the wrong place, Scott and I still pulled together a weekly vid from the Norwegian mountains. Much of this week is a combination of our travels here, responses to my tweets around cookie warnings and reactions to Elon's various decisions (and undecisions) on Twitter. Plus, there's the CoinTracker and Gemini breaches which appear to have stemmed from the SendGrid breach, the connection to that incident having been made by CoinTracker just after we had a friendly exchange about the description in HIBP 🙂

I'll leave you with some epic pics we snapped a few hours after this video, what a sight to behold, especially whilst sitting in the hot tub with good friends and cold beer 😊

🤯 pic.twitter.com/Q5hYc0tGHd

— Troy Hunt (@troyhunt) December 17, 2022

References

1. 99% of people vehemently hate cookie warnings, and 1% just want to argue about whose fault it is 🤷‍♂️ (that tiny minority is really missing the point)
2. Reading Elon's tweets is... entertaining (but the propensity for some to be outraged at his every move is also... entertaining)
3. The penny dropped whilst doing this livestream that CoinTracker has now published a post specifically naming SendGrid as the "third party" that exposed their data (wonder why they - and Gemini - didn't initially name them?)
4. Sponsored by: Kolide believes that maintaining endpoint security shouldn’t mean compromising employee privacy. Check out our manifesto: Honest Security.

Weekly Update 325

For the first time in I don't know how long, I couldn't do this live. Turns out both cell and wifi in Lapland are, with the benefit of hindsight, exactly what you'd expect from a remote location in the Arctic circle. The rest of the place was pretty amazing though, and a good deal of this week's content has gone to that. Plus, there's the whole "Australia becoming the world's most cyber-secure country" goal which deserves discussion. Oh - and the tweet with that pic I discuss - I'll just leave that one here 😊

Sometimes, life feels like a fairytale. This is now my favourite photo ever ❤️ pic.twitter.com/lspKwVVSly

— Troy Hunt (@troyhunt) December 9, 2022

References

1. Will Australia become the world's most cyber-secure country by 2030? (Is it feasible? Measurable? Does it even matter?)
2. Abandonia was breached again (7 years on, and still salted MD5 password hashes 🤦‍♂️)
3. I mentioned my Hack Your Career talk as it relates to dealing with snarky comments online (deep linked to the point where I cover this exact topic)
4. Sponsored by: Varonis. Reduce your SaaS blast radius with data-centric security for AWS, G Drive, Box, Salesforce, Slack and more.

Weekly Update 324

We're in Copenhagen! Scott and family joined us in Oslo for round 2 of wedding celebrations this week before jumping on the ferry to Copenhagen and seeing the sights here. There's lots of cyber things in this week's vid relating to HIBP's birthday, Medibank and financial penalties for breaches, but I'm just going to leave you with one of the most amazing moments of my life captured in pics:

🇳🇴 ❤️ 👰‍♀️ 🤵 pic.twitter.com/pPY49DArIF

— Troy Hunt (@troyhunt) December 2, 2022

References

1. Scott joined Charlotte and I for our second wedding celebration in Oslo (a very special occasion with some amazing pics... just wait until you see what's coming)
2. I stopped by NDC in Oslo this week to do a joint user group for them and NNUG (first time back in Oslo for almost 3 years!)
3. It's HIBP's 9th birthday today (well that escalated... quickly?)
4. The ransomware crew that hit Medibank has announced "case closed" (it's certainly far from that for Medibank, but hopefully that's the end of dumped data)
5. The Ministry of Foreign Affairs of Russia is throwing shade at Australia for attributing the Medibank hack back to Russian criminals (this was always going to get messy)
6. The Aus government has laid down some serious maximum penalties for future data breaches ("maximum" being the operative word, this isn't about killing companies)
7. Sponsored by: Kolide is an endpoint security solution for teams that want to meet SOC2 compliance goals without sacrificing privacy. Learn more here.

Weekly Update 323

Finally, after nearly 3 long years, I'm back in Norway! We're here at last, leaving our sunny paradise for a winter wonderland. It's almost surreal given how much has happened in that time, not just the pandemic but returning to Oslo with Charlotte as my Norwegian wife is super cool 😎 Other things this week are not so different, namely people complaining on Twitter (albeit also complaining about Twitter). As I find myself continually caveating, YMMV but it does feel like events are being overly dramatised by some at present. Time will tell, but I think we'll all still be using the platform to complain about things just as effectively in a year from now as we are today 🙂

References

1. Catch me this week in Oslo doing a free meetup for NDC and NNUG (Tuesday from 17:00 onwards)
2. Have you heard there's some controversy surrounding Twitter at present? (geez this thread opened a can of worms, it's a massively divisive topic right now)
3. Acxiom didn't get breached, but that doesn't stop people shipping around "The Acxiom Breach" (I hate breach misattribution with a passion)
4. You can now get Pwned for 30% less! (because it's a holiday in America, we've made my book cheaper 😊)
5. Sponsored by: 1Password, a secure password manager, is building the passwordless experience you deserve. See how passkeys work

Weekly Update 322

It's very strange to have gone 1,051 days without spending more than a few hours apart, but here we are... very temporarily:

Only 15,501km away 😢 And only 4 days until I head back to Oslo 😊 pic.twitter.com/PDn1Syplig

— Troy Hunt (@troyhunt) November 20, 2022

Which means that right now, I'm throwing myself into a gazillion other things to keep me busy including how schools advise parents to manage devices, wrapping gup that HTML signature, asking probing questions about paying ransoms and, unbelievably, fighting off the most ridiculous claim of HIBP having been P'd. That last one especially, FFS, just listen...

References

1. Does your child's school provide any guidance around the use of native parental controls on their devices? (not a poll, but a near unanimous "no" response anyway)
2. My HTML email signature is finally done - it was not a fun process 😭 (for my next trick - making it actually work in Exchange for iOS)
3. Should there be a government ban on paying a ransom to stop breached data from being publicly leaked? (this one is a poll... with a very clear result)
4. Have I Been Pwned didn't get pwned (I can't believe how this got written in the first place, nor how anyone ever even took it seriously 🤦‍♂️)
5. Sponsored by: Varonis. Reduce your SaaS blast radius with data-centric security for AWS, G Drive, Box, Salesforce, Slack and more.

Weekly Update 321

What a week to pick to be in Canberra. Planned well before things got cyber-crazy in Australia, I spent a few days catching up with folks in our capital and talking to the Australia Federal Police for scam awareness week. That it coincided with the dumping of Medibank customer health records made it an especially interesting time to talk with police, politicians and industry leaders. A bit of a bizarre, whirlwind week if I'm honest, but full of very positive encounters even though it coincided with such a demanding time for many of us in this industry down here.

References

1. Mastodon has been... entertaining 🤣 (just a collection of fun tweets that perfectly illustrate how much many of us have struggled to wrap our heads around it)
2. HTML email signatures are a complete nightmare ("mjml" bubbled to the top a few times as a way of tackling this)
3. HIBP API keys can be bought at different rate limits and paid a year in advance! (by some unexplainable miracle, 100% of feedback has been positive!)
4. I've honestly become a bit lost for words over the Medibank ransom saga, it's just absolutely horrendous (that's a link to my thread commentating on the data dumps)
5. Sponsored by: Varonis. Reduce your SaaS blast radius with data-centric security for AWS, G Drive, Box, Salesforce, Slack and more.

Weekly Update 320

I feel like life is finally complete: I have beaches, sunshine and fast internet! (Yes, and of course an amazing wife, but that goes without saying 😊) For the folks asking via various channels, the speed is not exactly symmetrical at 1000/400 and I'm honestly not sure why that's the case here in Australia. I also had to shell out quite a bit extra to go from 50 up to a "business" plan of 400 up, but with the volumes of data I ship around it'll make a pretty big difference to the way I work over time. Also this week, much more on the work we're doing with HIBP from pricing the annual plans to a proper support system via Zendesk. I'm really hoping that by next week's update we'll have shipped the new rate limits too, stay tuned for that but for now, here's number 320:

References

1. Finally - I have fast internet! (just a "little" 25x speed boost, thank you very much 😊)
2. Everyone seems to be doing 17% discounts for annual over monthly billing (that's Slack's pricing page and as someone pointed out in the live stream, it's effectively 2 free months)
3. We now have a proper support system up and running for the HIBP API keys (we're really happy with Zendesk, hoping this makes both subscribers' and our lives easier)
4. Sponsored by: Kolide is a fleet visibility solution for Mac, Windows, and Linux that can help you securely scale your business. Learn more here.

Weekly Update 319

Geez we've been getting hammered down here: Optus, MyDeal, Vinomofo, Medibank and now Australian Clinical Labs. It's crazy how much press interest there's been down here and whilst I think some of it is a bit hyperbolic, bringing the issue to the forefront and ensuring it's being discussed is certainly a good thing. Anyway, let's see what happens between now and next week's video, at this rate there'll be at least one more major Aussie breach to talk about!

References

1. Big Ass Fan IoT integration has been a big pain in the ass (it really shouldn't be this hard)
2. Australian Clinical Labs is the latest Aussie company to make the data breach headlines (includes pathology test results 😲)
3. The E-Pal breach went into HIBP (100k email addresses, more than half in HIBP already)
4. The Doomworld breach also went into HIBP (they "got pwned by a script kiddie", according to their disclosure)
5. I've been putting a heap of work into the Stripe integration for the HIBP API key (deleting code is so satisfying!)
6. Sponsored by: Varonis. Reduce your SaaS blast radius with data-centric security for AWS, G Drive, Box, Salesforce, Slack and more.

Weekly Update 318

Aussie breachapalooza! That what it feels like this week between Optus (ok, it was weeks ago but it's still in the news), Vinomofo, My Deal and the mother of all of them (at least as far as media interest goes), Medibank. That last one totally smashed my week out with unprecedented press enquiries, so is it any wonder I totally missed the Microsoft one? I read through that last one live in this week's video and as you'll hear, a breach of any kind is never a good look but what stands out for me about this one isn't the breach itself, rather the marketing effort SOCRadar has made around it. As I say in the video, it just feels... icky. See if you agree.

References

1. The Optus breach really got the nation down here paying attention to data breaches (that alone got a huge amount of attention, and then Medibank happened...)
2. I myself got an email from My Deal saying I'm in the breach (ok, so password reset and then they tell me I have no account!)
3. Vinomofo also had themselves a data breach (they were just using production data for testing "as is industry practice" 🤦‍♂️)
4. The Medibank breach has made massive news down here (it's particularly nasty when we're talking about health data being held to ransom)
5. The BlueBleed marketing campaign (sorry - "breach") is more about how it was reported rather than what it actually is (note in the thread that Kevin mentions the search tool has now been removed)
6. Sponsored by: EPAS by Detack. No EPAS protected password has ever been cracked and won't be found in any leaks. Give it a try, millions of users use it.

Weekly Update 317

I decided to do something a bit different this week and mostly just answer questions from my talk at GOTO Copenhagen last week. I wasn't actually in Denmark this time, but a heap of really good questions came through and as I started reading them, I thought "this would actually make for a really good weekly update". So here we are, and those questions then spurned on a whole heap more from the live audience too so this week's video became one large Q&A. I hope you enjoy this one, let me know if I should do more of these in the future.

References

1. I now have a teenager... on social media! (it's been fun setting stuff up with Ari and locking it down, lots of fundamentals there everyone should know)
2. Here's all the questions from GOTO (also includes the ratings, which please me 😊)
3. Sponsored by: Varonis. Reduce your SaaS blast radius with data-centric security for AWS, G Drive, Box, Salesforce, Slack and more.

Weekly Update 316

Geez it's nice to be home 😊 It's nice to live in a home that makes you feel that way when returning from a place as beautiful as Bali 😊 This week's video is dominated by the whole discussion around this tweet:

I love that part of the Microsoft Security Score for Identity in Azure improves your score if you *don't* enforce password rotation, what a sign of the times! Who out there still works somewhere that forces rotation (because "reasons")? pic.twitter.com/a2yQQvNRpa

— Troy Hunt (@troyhunt) October 6, 2022

I love this for the way it throws traditional logic out the window, logic we all knew sucked and I suspect the massive engagement the tweet drove is due to precisely that: Microsoft giving us all a good reason to whinge about a sucky practice that still prevails so broadly. So... I hope you enjoy listening to just how bad enforced password rotation sucks 😊

References

1. We've known that mandatory password rotation has passed its used by date for years now (that blog post was actually the genesis for Pwned Passwords)
2. The Bhinneka breach went into HIBP (Indonesian e-commerce service with 83% of pwnees being repeat visitors to HIBP)
3. The Wakanim breach also went in, a pretty fresh one from 6 weeks ago (actually thought this was quite under-reported for an incident impacting 6.7M people)
4. Sponsored by: Kolide can help you nail third-party audits and internal compliance goals with endpoint security for your entire fleet. Learn more here.

Weekly Update 315

How's this weeks video for a view?! It's a stunning location here in Bali and it's just been the absolute most perfect spot for a honeymoon, especially after weeks of guests and celebrations. But whoever hacked and ransom'd Optus didn't care about me taking time out and I've done more media in the last week than I have in a long time. I don't mind, it's a fascinating story the way this has unfolded and that's where most of the time in this week's video has gone, I hope you enjoy my analysis of what has become a pretty crazy story back home in Australia.

References

1. Bali is a stunning place with postcard worthy shots around every corner (link through to the tweet thread with all the magic 😍)
2. I've never seen a data breach make as much local news as Optus has, not even close! (link through to Jeremy Kirk's thread explaining how it went down)
3. When people are wondering if they need to change their name and date of birth in the wake of a data breach, you know there's bigger problems to be solved (seriously, depending on numbers as some sort of secret source sufficient to form a significant part of an identity theft attack is madness and needs to die in a fire)
4. Sponsored by: Varonis. Reduce your SaaS blast radius with data-centric security for AWS, G Drive, Box, Salesforce, Slack and more.

Weekly Update 314

Wow, what a week! Of course there's lots of cyber / tech stuff in this week's update, but it was really only the embedded tweet below on my mind so I'm going to leave you with this then come to you from somewhere much more exotic than usual (and I reckon that's a pretty high bar for me!) next week 😎

Absolutely over the moon to formally make @Charlotte_Hunt_ a part of our family ❤️ 💍 pic.twitter.com/XfahXElboC

— Troy Hunt (@troyhunt) September 21, 2022

References

1. Optus disclosed a breach, but really didn't share much solid information about it... unlikely what Jeremy Kirk has since tweeted (these tweets came out after I recorded the vid so I didn't reference them, but it's the best analysis of the legitimacy of the data that I've seen to date)
2. Lots of gigabytes of TAP Air Portugal customers is now floating around (and it's searchable within HIBP)
3. Sponsored by: SecAlerts vulnerability awareness: Receive CVE & zero-day alerts, news & version updates all matched to your software. Discount code within!

Weekly Update 313

I came so close to skipping this week's video. I'm surrounded by family, friends and my amazing wife to be in only a couple of days. But... this video has been my constant companion through very difficult times, and I'm happy to still being doing it at the best of times 😊 So, with that, I'm signing out and heading off to do something much more important. See you next week.

Taking a bit of time off Twitter while @charlottelyng and I do more important things 💍 👰‍♀️ pic.twitter.com/9JJrPM9kWX

— Troy Hunt (@troyhunt) September 13, 2022

References

1. The Brand New Tube video site was breached and is now in HIBP (350k account details of what seems to be a very, uh, "unique" demographic were exposed)
2. The TikTok breach that... wasn't (why is this still getting media attention?!)
3. Sponsored by: Varonis. Reduce your SaaS blast radius with data-centric security for AWS, G Drive, Box, Salesforce, Slack and more.

Weekly Update 312

I'm so excited to see the book finally out and awesome feedback coming in, but I'm disappointed with this week's video. I frankly wasn't in the right frame of mind to do it justice (it's been a very hard road up until this point, for various reasons), then my connection dropped out halfway through and I had to roll to 5G, and now I'm hearing (both from other people and with my own ears), a constant background noise being picked up by the mic. Argh! But, that's the reality of scheduled live streams and for better or worse, you end up getting the "warts and all" version. It is what it is, and next week's will be better 😊

References

1. book.troyhunt.com
2. Sponsored by: Kolide believes that maintaining endpoint security shouldn’t mean compromising employee privacy. Check out our manifesto: Honest Security.

Weekly Update 311

Well, after a crazy amount of work, a lot of edits, reflection, and feedback cycles, "Pwned" is almost here:

This better be a sizzling read @troyhunt or I'll be crashing the wedding in ways never done before.

Also, I thought they'd cancelled Neighbours? 😉❤️ pic.twitter.com/jrYIKtL0Uh

— Mike Thompson (@AppSecBloke) August 30, 2022

The preview cycle is in full swing with lots of feedback coming in and revisions being made before we push it live to the masses. This is really exciting and I can't wait to get the book out there in front of everyone, stay tuned 😊

References

1. There's clearly more going on behind the scenes with Krebs' "Final Thoughts on Ubiquiti" post (but hey, I love what they both do so hopefully that's that and everyone can get back to doing what they do best)
2. The Russian streaming service START made it into HIBP (should I have done anything differently because it's Russian, or mostly full of Russian subscribers?)
3. The Stripchat data is also now in HIBP (a very adult website so flagged as "sensitive" and not publicly searchable)
4. I love a good crazy corporate response on Twitter, so here's a couple of them for you 😊 (quite funny that Ocado now decides to delete their crazy tweet!)
5. Sponsored by: Kolide is an endpoint security solution for teams that want to meet SOC2 compliance goals without sacrificing privacy. Learn more here.

Weekly Update 310

By all accounts, this was one of the best weekly updates ever courtesy of a spam caller giving me a buzz at the 38:40 mark and struggling with "pwn" versus "porn". It resulted in an entertaining little on-air call and subsequently caused me to go out and register both haveibeeninpwn.com and haveibeeninporn.com. I figure these will result in much ongoing hilarity the next time I get a call of this nature about one of those domains 🤣 Oh - and there's a whole bunch of data breach stuff this week, enjoy!

References

1. The Mudge v. Twitter scandal has some pretty serious accusations in it (there's a 6 min CNN vid in that tweet that's worth a look)
2. Plex has gone for another round of data breach this week (actually pretty impressed that they now have 30M subscribers!)
3. LastPass has also gone for another round (I know the optics aren't good, but the real world impact of this is almost certainly insignificant)
4. I got a very convincing SMS phish this week (think about the human vulnerabilities this exploits, no wonder phishing remains so lucrative)
5. Sponsored by: Kolide is a fleet visibility solution for Mac, Windows, and Linux that can help you securely scale your business. Learn more here.

Weekly Update 309

Right off the back of a visit to our wedding venue (4 weeks and counting!) and a few hours before heading to the snow (yes, Australia has snow), I managed to slip in a weekly update earlier today. I've gotta say, the section on Shitexpress is my favourite because there's just so much to give with this one; a service that literally ships shit with a public promise of multiple kinds of animal shit whilst data that proves only horse shit was ever shipped, a promise of 100% anonymity whilst the data set clearly shows both shit-senders and shit-receivers and possibly the most eye-opening of all, the messages accompanying the shit. So, uh, yeah, enjoy! 💩

References

1. The acoustic panelling in my office is starting to come together, but it needs more work (I'll always notice those little misaligned lines... and you probably will too now that I've mentioned it!)
2. Kickstarter's password reset email left a lot of people confused (turns out they were just rolling people on Facebook auth to native Kickstarter accounts, but by their own admission the messaging was really confusing)
3. Turns out the source of the templated emails I was getting about removing data from HIBP was Rightly (their intentions are good, but IMHO their execution is poor)
4. Shitexpress - where do I even being with this one?! (just read my Twitter thread on it, it's all kinds of crazy this one)
5. Sponsored by: Kolide can help you nail third-party audits and internal compliance goals with endpoint security for your entire fleet. Learn more here.

Weekly Update 308

It was all a bit last minute today after travel, office works and then a quick rebuild of desk and PC before doing this livestream (didn't even have time to comb my hair!) So yes, I took a shortcut with the description of this video, but it all worked out well in the end IMHO with plenty of content that wasn't entirely data breach related, but yeah, that does seem to be a bit of a recurring theme in these vids. Enjoy 😊

References

1. The acoustic panelling in my office is starting to look awesome (some stuff is not lining up so it will be a little longer yet before completion)
2. The QuestionPro breach has been pretty poorly handled (it's also now well beyond debate that it's real)
3. If you're sending a C&D notice to a data breach forum, you're really got no idea how these things work (and now their data is... everywhere)
4. Here's that UniFi Protect Theta cam (they're pumping out so much cool stuff lately 😎)
5. The stage at NEXTGEN's Cyber Republic event was pretty awesome (the delayed flight home, late night and early start the next day was... less awesome 🙁)
6. I got what will possibly be the funniest set of spammer responses to Password Purgatory this week 🤣 (also learned a few things, I'm determined to get even better at this!)
7. Sponsored by: Kolide believes that maintaining endpoint security shouldn’t mean compromising employee privacy. Check out our manifesto: Honest Security.

Weekly Update 306

I didn't intend for a bunch of this week's vid to be COVID related, but between the breach of an anti-vaxxer website and the (unrelated) social comments directed at our state premier following some pretty simple advice, well, it just kinda turned out that way. But there's more on other breaches too, in particular the alleged Paytm one and the actual Customer.io one.

I'm really looking forward to next week's update, here's a little teaser of what you can expect to hear about then 🤣

References

1. I've updated the Paytm data breach to be flagged as "fabricated" (full thread on the reasons why, it's a tricky one)
2. Anti-vax dating site that let people advertise ‘mRNA FREE’ semen left all its user data exposed (😲😳😲)
3. I'm genuinely sympathetic to all politicians on any side of the political fence who have to deal with the COVID mess (just read the volume of ridiculous crap they're at the receiving end of)
4. We're still seeing the long tail of the Customer.io data breach (protecting against malicious insiders is a hard one)
5. Sponsored by: Kolide is an endpoint security solution for teams that want to meet SOC2 compliance goals without sacrificing privacy. Learn more here.

Weekly Update 305

I broke Yoda's stick! 3D printing woes, and somehow I managed to get through the explanation without reverting to a chorus of My Stick by a Bad Lip Reading (and now you'd got that song stuck in your head). Loads of data breaches this week and whilst "legacy", still managed to demonstrate how bad some practices remain today (hi Shadi.com 👋). Never a dull moment in data breach land, more from there next week 😊

References

1. The Yoda 3D print looks amazing (just don't touch his stick)
2. New flash - social media platform collects lots of data! (seriously, the TicTok hyperbole got a bit too much this week)
3. What if... some free stuff is actually free? (you're not always "the product" and in many cases, that's frankly a pretty disingenuous term)
4. Sponsored by: Kolide is a fleet visibility solution for Mac, Windows, and Linux that can help you securely scale your business. Learn more here.

Weekly Update 304

It's very much a last-minute agenda this week as I catch up on the inevitable post-travel backlog and pretty much just pick stuff from my tweet timeline over the week 😊 But hey, there's some good stuff in there and I still managed to knock out almost an hour worth of content!

References

1. La Poste Mobile got themselves ransom'd and their data dumped (and they're still offline)
2. Mangatoon are very clearly covering up their breach (which is now hard to do given it's in HIBP and received plenty of press)
3. The "Seconds" app is my secret presenting sauce! (any workout app that can run a sequence of timed intervals will do it)
4. I'm totally loving Apple's AirTags to track all my things! (not loving that my AMG is still sitting Melbourne 🤦‍♂️)
5. The Wi-Fi BBQ thermometer is actually really neat (and it does benefit from being connected, too)
6. Sponsored by: Kolide can help you nail third-party audits and internal compliance goals with endpoint security for your entire fleet. Learn more here.

Weekly Update 303

And we're finally done with this trip. 26 days, 14 different accommodations, 5,146km of driving through 4 states and the last 4 weekly vids all done on the road. Travel is great, but right now going home is even better 😊 Next week's vid will be back in my comfy office with good lighting, video, audio and better planning. Until then, here's a (late) weekly update 303:

References

1. If you're going to scrape someone else's content, don't embed the images directly off their site! (referrer header based Rickrolls 😎)
2. The Shanghai police data breach is massive... (if it turns out to be legitimate)
3. SHA-1 is fine and k-anonymity isn't PII (and frankly, if an organisation doesn't understand these simple facts, they've got bigger issues to deal with)
4. The Polish government is the 34th to use HIBP's gov service (and I'm still toying with the idea of doing a "visit all the govs" tour one day)
5. My 12th MVP award came in this week (it's still such an important part of my career 😊)
6. Sponsored by: CrowdSec - The open-source & collaborative security stack: respond to attacks & share signals across the community. Download it for free

Weekly Update 302

In a complete departure from the norm, this week's video is the much-requested "cultural differences" one with Charlotte. No tech (other than my occasional plug for the virtues of JavaScript), but lots of experiences from both of us living and working in different parts of the world. Most of it is what Charlotte has learned being thrown into the deep end of Aussieness (without the option of even getting out of the country until very recently), which I thought made for some pretty funny viewing 🤣

We almost got through the entire content I had planned... then my phone went into battery saving mode and killed the mic so apologies for that last little bit of missing content. But hey, it was worth it when the battery was low due to capturing these epic shots earlier in the day:

Stunning 🤩 pic.twitter.com/s1TRJ3bcb1

— Troy Hunt (@troyhunt) July 1, 2022

I think this made for fun viewing with heaps of audience engagement, I hope you enjoy watching it 😊

References

1. Sponsored by: Detack. Detect & prevent weak, leaked, shared passwords with EPAS, a patented, privacy compliant solution used in 40 countries. Try it free!

Weekly Update 301

First up, I'm really sorry about the audio quality on this one. It's the exact same setup I used last week (and carefully tested first) but it's obviously just super sensitive to the wind. If you look at the trees in the background you can see they're barely moving, but inevitably that was enough to really mess with the audio quality. I do actually have a windsock for the mic, but it's in a drawer at home so for the remainder of this trip it'll be indoor recording only. Speaking of which, because there was a lot of enthusiasm for Charlotte and I to do one together on the cultural differences we've both experienced living in different parts of the world, that'll be next week's video. Less techie, but hopefully something you'll all enjoy 😊

References

1. NDC Melbourne was very much like a reunion being the first NDC event we've been back to since London in Jan 2020 (and being able to share it with the kids made it extra special 😊)
2. The travel thread continues, with much more to come yet before hitting home (a lot of gorgeous Aussie countryside scenes in there, and the best is yet to come)
3. Sixt had a data breach (but don't worry, lots of European companies are being hacked!)
4. Sponsored by: Varonis for Salesforce. Protect Salesforce data from overexposure and cyberthreats. Try it free!

Weekly Update 300

Well, we're about 2,000km down on this trip and are finally in Melbourne, which was kinda the point of the drive in the first place (things just escalated after that). The whole journey is going into a long tweet thread you can find below (or mute - that's partly why it's in a single thread):

It’s time for the next great road trip 🏎 pic.twitter.com/9B9k9cXQvH

— Troy Hunt (@troyhunt) June 14, 2022

Next week is NDC Melbourne so please get along to the event if you're in town, it's kinda amazing to think I'll finally be back at an NDC after all this time 😊

References

1. We're on another epic road trip (that's the tweet thread, I'll keep adding to it as we go)
2. Been listening to the Hardcore History podcast which is epic... (...but very heavy listening I need to break into smaller sessions)
3. It's NDC Melbourne nest week! (my first time back at an NDC since London in early 2020, and the inaugural event for Melbourne)
4. The DivX SubTitles breach was 783k records worth of plain text passwords (it's a 12-year-old incident, but still...)
5. Sponsored by: Meet compliance objectives in a remote-first world without resorting to rigid device management. Try Kolide for 14-days free!

Weekly Update 299

How on earth does an enterprise rack-mounted NAS not come with rails to actually install it in the rack?! So yeah, that's what's in the box, something that should have been in the original box and not in a separate purchase. Just to add to the Synology packaging insanity, I went to install a couple of spare NVMe drives in it today and... there were no screws in the NVMe slots 🤦‍ I'll be doing the next four weekly updates from various locations around the country as we hit the road again, stay tuned for epic tweet threads of amazing locations 😎

References

1. The MyElectronics.nl Raspberry Pi racks are really sweet (the rack is looking pretty slick now!)
2. Apple Watch fall detection is pretty amazing when you actually see it work as intended (I've had lots of easily dismissible false-positives on mine, but my father just demonstrated precisely how it's meant to work)
3. A lot of personal finance is just basic maths and simple market observations (why is anyone even remotely surprised that interest rates are going up?!)
4. The Indonesian government is now the 33rd gov on board HIBP (also the first one from Asia)
5. Sponsored by: Varonis for Salesforce. Detect suspicious behavior and strengthen your Salesforce security posture. Try it free!

Weekly Update 298

I somehow ended up blasting through an hour and a quarter in this week's video with loads of discussion on the CTARS / NDIS data breach then a real time "let's see what the fuss is about" with news that one of our state's digital driver's licenses (DDL) may be easily forgeable. I think the whole discussion is actually really interesting when looked at through the lens of how on balance, a digitised license compares to a physical one. As you'll see, I think the reporting on this is overblown however... the weak encryption keys do seem like an oversight and the response of Service NSW to criticism has been lacklustre at best. Let's see how it goes in other states, I'll be first in line when they roll out in Queensland so I can finally start leaving my wallet at home!

References

1. I'm doing a meetup in Tassie on July 7 (in a brewery!!!)
2. I got pwned in the MGM Resorts data breach (I didn't even know until I checked my old Hotmail address)
3. The CTARS / NDIS data breach is really nasty (just really super sensitive medical data)
4. The controversary around the ability to forge New South Wales digital driver's feels overblown (let's stop asking whether it's a perfect security construct and instead ask how it differs to the old physical plastic licenses)
5. Sponsored by: Kolide enables cross-platform fleet visibility for your Linux, Mac, and Windows devices. Start your free 14-day trial today!

Weekly Update 297

So I basically spent my whole day yesterday playing with Ubiquiti gear and live-tweeting the experience 😊 This was an unapologetically geeky pleasure and it pretty much dominates this week's video but hey, it's a fun topic. Still, there's a bunch of data breach stuff up front and as I write this, 25M more records courtesy of the MGM breach are making their way up into HIBP. Get ready for a bunch of notification emails going out on that one. Here's this week's video:

References

1. Finally worked out how to handle the MGM breach (it's loading now as a new breach to ensure HIBP subscribers are appropriately notified)
2. The Ubiquiti G4 PTZ is a mighty looking camera! (it'll take a professional to get it mounted though, stay tuned for more)
3. The G4 Doorbell Pro is a little more accessible and has a remarkably better picture quality than the old "standard" one (I know it's sold it, Ubiquiti knows it's sold out, fingers crossed for more supply soon)
4. The in-wall wifi 6 units look almost identical to the previous gen... (but they're not - they much more nicely made)
5. Sponsored by: Varonis for Salesforce. Protect Salesforce data from overexposure and cyberthreats. Try it free!

Weekly Update 296

Data breaches, 3D printing and passwords - just the usual variety of things this week. More specifically, that really cool Pwned Passwords downloader that I know a bunch of people have been waiting on, and now we've finally released. It hits the existing k-anonymity API over 1 million times and that API is already going on 2 billion requests a month so I'm kinda curious to see what happens if everyone starts running the downloader at the same time... 🤔

References

1. This is a much better guide to what causes a 3D printer hot end to leak out the top of the heat block (the image there makes easy to understand)
2. Since I broke the heater cartridge anyway, a Revo 6 should do the job (see how the nozzle and heat break are all one part)
3. The Pwned Passwords downloader is here! (this is a great little tool put together by Stefán)
4. Sponsored by: Kolide provides endpoint security for teams that value privacy, transparency, and employee productivity. Try Kolide for free today!

Weekly Update 295

A short one this week as the previous 7 days disappeared with AusCERT and other commitments. Geez it was nice to not only be back at an event, but out there socialising and attending all the related things that tend to go along with it. I'll leave you with this tweet which was a bit of a highlight for me, having Ari alongside me at the event and watching his enthusiasm being part of the industry I love 😊

At #AusCERT with Ari for “take your son to work” day 🙂

I’m up next on stream 2 at 14:45 talking about Pwned Passwords, the FBI, the NCA and giving the whole thing over to the community, come say hi! https://t.co/PqSgb1AjMS pic.twitter.com/Z88xIrrHYW

— Troy Hunt (@troyhunt) May 12, 2022

References

1. The new Elgato mic boom arm is really slick (I accidentally ordered the "LP" low-profile model, which turned out to be a much better fit for the space)
2. I mentioned the Pwned Passwords downloader in the video so I'm sharing the link again here (I hope to blog about it this coming week, it just needs some minor tweaks first)
3. Sponsored by: Varonis for Salesforce. Detect suspicious behavior and strengthen your Salesforce security posture. Try it free!

Weekly Update 294

It's back to business as usual with more data breaches, more poor handling of them and more IoT pain. I think on all those fronts there's a part of me that just likes the challenge and the opportunity to fix a broken thing. Or maybe I'm just a sucker for punishment, I don't know, but either way it's kept me entertained and given me plenty of new material for this week's video 😊

References

1. The book is almost ready to launch! (I've totally rewritten the intro, tweaked a bunch of the stories and added more - hopefully only a month off go-live)
2. My fallback position for the IoT not working is literally climbing over the wall (I'm going to solve - and blog - this issue around too much broadcast traffic)
3. Speaking of broadcast traffic, rolling from MQTT to the native Home Assistant Shelly integrations has been... not very good (I don't want to blame HA for this, it's a network-level issue)
4. The wifi proximity sensor I installed in my mailbox is heading for "the drawer of broken dreams" (I spoke the Lars after recording and he agreed - it sucks!)
5. I'll be speaking at AusCERT on the Gold Coast next week (I've decided to call my talk "Pwning Compromised Passwords with the FBI and NCA")
6. How PayHere in Sri Lanka has handled their data breach is pretty much a textbook example of what not to do (although kudos to the CEO for eventually apologising and acknowledging they "messed up")
7. Sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging users on Slack. Try Kolide for 14 days free.

Weekly Update 293

Didn't get a lot done this week, unless you count scuba diving, snorkelling, spear fishing and laying around on tropical sand cays 😎 This week is predominantly about the time we just spent up on the Great Barrier Reef which has very little relevance to infosec, IoT, 3D printing and the other usual topics. But as I refer to in the guitar lessons blog post referenced below, I share what I do pretty transparently and organically and this week, that's what I want to talk about. So, either enjoy it or skip it until next week when I'll back to business as usual 😊

References

1. I followed Lars' guidance and installed the physical mailbox sensor (so far, I'm unhappy with it, more next week)
2. I've gotten a lot of mileage out of my guitar lessons blog post (watch the Ricky Gervais bit, it's funny... and true)
3. Pictures speak a thousand words... especially when they're amazing pictures of the Great Barrier Reef (that's the tweet thread of an amazing holiday)
4. Sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging users on Slack. Try Kolide for 14 days free.

Weekly Update 292

Well that was an unusual ending. Both my mouse and keyboard decided to drop off right at the end of this week's video and without any control whatsoever, there was no way to end the live stream! Wired devices from kids borrowed, I eventually got back control and later discovered that all things Bluetooth had suddenly decided to die without any warning whatsoever. I certainly wasn't updating drivers mid-live stream or anything like that so... 🤷‍♂️

Anyway, other than that it's business as usual this week, enjoy!

References

1. The shots I'm getting with the new drone are amazing! (it's crazy how much tech is jammed into this little thing)
2. I'm disappointed that Mailchimp has stopped offering a discount for users with 2FA enabled (I'd really love to think there was an ROI for them offering the discount)
3. You'd think an Attorney General's office would have better things to do than forwarding on a complaint from someone who thinks HIBP has been breached (seriously, it'd take about 3 mins for anyone paying attention to understand what's going on)
4. Disclosing data breaches is still way too hard (people found it painful to watch a 1 hour 15 minute video of me trying to disclose to Avvo - good - that's the point - it's painful!)
5. Sponsored by: Varonis for Salesforce. Protect Salesforce data from overexposure and cyberthreats. Try it free!