Weekly Update 292

Well that was an unusual ending. Both my mouse and keyboard decided to drop off right at the end of this week's video and without any control whatsoever, there was no way to end the live stream! Wired devices from kids borrowed, I eventually got back control and later discovered that all things Bluetooth had suddenly decided to die without any warning whatsoever. I certainly wasn't updating drivers mid-live stream or anything like that so... 🤷‍♂️

Anyway, other than that it's business as usual this week, enjoy!

References

1. The shots I'm getting with the new drone are amazing! (it's crazy how much tech is jammed into this little thing)
2. I'm disappointed that Mailchimp has stopped offering a discount for users with 2FA enabled (I'd really love to think there was an ROI for them offering the discount)
3. You'd think an Attorney General's office would have better things to do than forwarding on a complaint from someone who thinks HIBP has been breached (seriously, it'd take about 3 mins for anyone paying attention to understand what's going on)
4. Disclosing data breaches is still way too hard (people found it painful to watch a 1 hour 15 minute video of me trying to disclose to Avvo - good - that's the point - it's painful!)
5. Sponsored by: Varonis for Salesforce. Protect Salesforce data from overexposure and cyberthreats. Try it free!

Weekly Update 293

Didn't get a lot done this week, unless you count scuba diving, snorkelling, spear fishing and laying around on tropical sand cays 😎 This week is predominantly about the time we just spent up on the Great Barrier Reef which has very little relevance to infosec, IoT, 3D printing and the other usual topics. But as I refer to in the guitar lessons blog post referenced below, I share what I do pretty transparently and organically and this week, that's what I want to talk about. So, either enjoy it or skip it until next week when I'll back to business as usual 😊

References

1. I followed Lars' guidance and installed the physical mailbox sensor (so far, I'm unhappy with it, more next week)
2. I've gotten a lot of mileage out of my guitar lessons blog post (watch the Ricky Gervais bit, it's funny... and true)
3. Pictures speak a thousand words... especially when they're amazing pictures of the Great Barrier Reef (that's the tweet thread of an amazing holiday)
4. Sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging users on Slack. Try Kolide for 14 days free.

Weekly Update 294

It's back to business as usual with more data breaches, more poor handling of them and more IoT pain. I think on all those fronts there's a part of me that just likes the challenge and the opportunity to fix a broken thing. Or maybe I'm just a sucker for punishment, I don't know, but either way it's kept me entertained and given me plenty of new material for this week's video 😊

References

1. The book is almost ready to launch! (I've totally rewritten the intro, tweaked a bunch of the stories and added more - hopefully only a month off go-live)
2. My fallback position for the IoT not working is literally climbing over the wall (I'm going to solve - and blog - this issue around too much broadcast traffic)
3. Speaking of broadcast traffic, rolling from MQTT to the native Home Assistant Shelly integrations has been... not very good (I don't want to blame HA for this, it's a network-level issue)
4. The wifi proximity sensor I installed in my mailbox is heading for "the drawer of broken dreams" (I spoke the Lars after recording and he agreed - it sucks!)
5. I'll be speaking at AusCERT on the Gold Coast next week (I've decided to call my talk "Pwning Compromised Passwords with the FBI and NCA")
6. How PayHere in Sri Lanka has handled their data breach is pretty much a textbook example of what not to do (although kudos to the CEO for eventually apologising and acknowledging they "messed up")
7. Sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging users on Slack. Try Kolide for 14 days free.

Weekly Update 295

A short one this week as the previous 7 days disappeared with AusCERT and other commitments. Geez it was nice to not only be back at an event, but out there socialising and attending all the related things that tend to go along with it. I'll leave you with this tweet which was a bit of a highlight for me, having Ari alongside me at the event and watching his enthusiasm being part of the industry I love 😊

At #AusCERT with Ari for “take your son to work” day 🙂

I’m up next on stream 2 at 14:45 talking about Pwned Passwords, the FBI, the NCA and giving the whole thing over to the community, come say hi! https://t.co/PqSgb1AjMS pic.twitter.com/Z88xIrrHYW

— Troy Hunt (@troyhunt) May 12, 2022

References

1. The new Elgato mic boom arm is really slick (I accidentally ordered the "LP" low-profile model, which turned out to be a much better fit for the space)
2. I mentioned the Pwned Passwords downloader in the video so I'm sharing the link again here (I hope to blog about it this coming week, it just needs some minor tweaks first)
3. Sponsored by: Varonis for Salesforce. Detect suspicious behavior and strengthen your Salesforce security posture. Try it free!

Weekly Update 296

Data breaches, 3D printing and passwords - just the usual variety of things this week. More specifically, that really cool Pwned Passwords downloader that I know a bunch of people have been waiting on, and now we've finally released. It hits the existing k-anonymity API over 1 million times and that API is already going on 2 billion requests a month so I'm kinda curious to see what happens if everyone starts running the downloader at the same time... 🤔

References

1. This is a much better guide to what causes a 3D printer hot end to leak out the top of the heat block (the image there makes easy to understand)
2. Since I broke the heater cartridge anyway, a Revo 6 should do the job (see how the nozzle and heat break are all one part)
3. The Pwned Passwords downloader is here! (this is a great little tool put together by Stefán)
4. Sponsored by: Kolide provides endpoint security for teams that value privacy, transparency, and employee productivity. Try Kolide for free today!

Weekly Update 297

So I basically spent my whole day yesterday playing with Ubiquiti gear and live-tweeting the experience 😊 This was an unapologetically geeky pleasure and it pretty much dominates this week's video but hey, it's a fun topic. Still, there's a bunch of data breach stuff up front and as I write this, 25M more records courtesy of the MGM breach are making their way up into HIBP. Get ready for a bunch of notification emails going out on that one. Here's this week's video:

References

1. Finally worked out how to handle the MGM breach (it's loading now as a new breach to ensure HIBP subscribers are appropriately notified)
2. The Ubiquiti G4 PTZ is a mighty looking camera! (it'll take a professional to get it mounted though, stay tuned for more)
3. The G4 Doorbell Pro is a little more accessible and has a remarkably better picture quality than the old "standard" one (I know it's sold it, Ubiquiti knows it's sold out, fingers crossed for more supply soon)
4. The in-wall wifi 6 units look almost identical to the previous gen... (but they're not - they much more nicely made)
5. Sponsored by: Varonis for Salesforce. Protect Salesforce data from overexposure and cyberthreats. Try it free!

Weekly Update 298

I somehow ended up blasting through an hour and a quarter in this week's video with loads of discussion on the CTARS / NDIS data breach then a real time "let's see what the fuss is about" with news that one of our state's digital driver's licenses (DDL) may be easily forgeable. I think the whole discussion is actually really interesting when looked at through the lens of how on balance, a digitised license compares to a physical one. As you'll see, I think the reporting on this is overblown however... the weak encryption keys do seem like an oversight and the response of Service NSW to criticism has been lacklustre at best. Let's see how it goes in other states, I'll be first in line when they roll out in Queensland so I can finally start leaving my wallet at home!

References

1. I'm doing a meetup in Tassie on July 7 (in a brewery!!!)
2. I got pwned in the MGM Resorts data breach (I didn't even know until I checked my old Hotmail address)
3. The CTARS / NDIS data breach is really nasty (just really super sensitive medical data)
4. The controversary around the ability to forge New South Wales digital driver's feels overblown (let's stop asking whether it's a perfect security construct and instead ask how it differs to the old physical plastic licenses)
5. Sponsored by: Kolide enables cross-platform fleet visibility for your Linux, Mac, and Windows devices. Start your free 14-day trial today!

Weekly Update 299

How on earth does an enterprise rack-mounted NAS not come with rails to actually install it in the rack?! So yeah, that's what's in the box, something that should have been in the original box and not in a separate purchase. Just to add to the Synology packaging insanity, I went to install a couple of spare NVMe drives in it today and... there were no screws in the NVMe slots 🤦‍ I'll be doing the next four weekly updates from various locations around the country as we hit the road again, stay tuned for epic tweet threads of amazing locations 😎

References

1. The MyElectronics.nl Raspberry Pi racks are really sweet (the rack is looking pretty slick now!)
2. Apple Watch fall detection is pretty amazing when you actually see it work as intended (I've had lots of easily dismissible false-positives on mine, but my father just demonstrated precisely how it's meant to work)
3. A lot of personal finance is just basic maths and simple market observations (why is anyone even remotely surprised that interest rates are going up?!)
4. The Indonesian government is now the 33rd gov on board HIBP (also the first one from Asia)
5. Sponsored by: Varonis for Salesforce. Detect suspicious behavior and strengthen your Salesforce security posture. Try it free!

Weekly Update 300

Well, we're about 2,000km down on this trip and are finally in Melbourne, which was kinda the point of the drive in the first place (things just escalated after that). The whole journey is going into a long tweet thread you can find below (or mute - that's partly why it's in a single thread):

It’s time for the next great road trip 🏎 pic.twitter.com/9B9k9cXQvH

— Troy Hunt (@troyhunt) June 14, 2022

Next week is NDC Melbourne so please get along to the event if you're in town, it's kinda amazing to think I'll finally be back at an NDC after all this time 😊

References

1. We're on another epic road trip (that's the tweet thread, I'll keep adding to it as we go)
2. Been listening to the Hardcore History podcast which is epic... (...but very heavy listening I need to break into smaller sessions)
3. It's NDC Melbourne nest week! (my first time back at an NDC since London in early 2020, and the inaugural event for Melbourne)
4. The DivX SubTitles breach was 783k records worth of plain text passwords (it's a 12-year-old incident, but still...)
5. Sponsored by: Meet compliance objectives in a remote-first world without resorting to rigid device management. Try Kolide for 14-days free!

Weekly Update 301

First up, I'm really sorry about the audio quality on this one. It's the exact same setup I used last week (and carefully tested first) but it's obviously just super sensitive to the wind. If you look at the trees in the background you can see they're barely moving, but inevitably that was enough to really mess with the audio quality. I do actually have a windsock for the mic, but it's in a drawer at home so for the remainder of this trip it'll be indoor recording only. Speaking of which, because there was a lot of enthusiasm for Charlotte and I to do one together on the cultural differences we've both experienced living in different parts of the world, that'll be next week's video. Less techie, but hopefully something you'll all enjoy 😊

References

1. NDC Melbourne was very much like a reunion being the first NDC event we've been back to since London in Jan 2020 (and being able to share it with the kids made it extra special 😊)
2. The travel thread continues, with much more to come yet before hitting home (a lot of gorgeous Aussie countryside scenes in there, and the best is yet to come)
3. Sixt had a data breach (but don't worry, lots of European companies are being hacked!)
4. Sponsored by: Varonis for Salesforce. Protect Salesforce data from overexposure and cyberthreats. Try it free!

Weekly Update 302

In a complete departure from the norm, this week's video is the much-requested "cultural differences" one with Charlotte. No tech (other than my occasional plug for the virtues of JavaScript), but lots of experiences from both of us living and working in different parts of the world. Most of it is what Charlotte has learned being thrown into the deep end of Aussieness (without the option of even getting out of the country until very recently), which I thought made for some pretty funny viewing 🤣

We almost got through the entire content I had planned... then my phone went into battery saving mode and killed the mic so apologies for that last little bit of missing content. But hey, it was worth it when the battery was low due to capturing these epic shots earlier in the day:

Stunning 🤩 pic.twitter.com/s1TRJ3bcb1

— Troy Hunt (@troyhunt) July 1, 2022

I think this made for fun viewing with heaps of audience engagement, I hope you enjoy watching it 😊

References

1. Sponsored by: Detack. Detect & prevent weak, leaked, shared passwords with EPAS, a patented, privacy compliant solution used in 40 countries. Try it free!

Weekly Update 303

And we're finally done with this trip. 26 days, 14 different accommodations, 5,146km of driving through 4 states and the last 4 weekly vids all done on the road. Travel is great, but right now going home is even better 😊 Next week's vid will be back in my comfy office with good lighting, video, audio and better planning. Until then, here's a (late) weekly update 303:

References

1. If you're going to scrape someone else's content, don't embed the images directly off their site! (referrer header based Rickrolls 😎)
2. The Shanghai police data breach is massive... (if it turns out to be legitimate)
3. SHA-1 is fine and k-anonymity isn't PII (and frankly, if an organisation doesn't understand these simple facts, they've got bigger issues to deal with)
4. The Polish government is the 34th to use HIBP's gov service (and I'm still toying with the idea of doing a "visit all the govs" tour one day)
5. My 12th MVP award came in this week (it's still such an important part of my career 😊)
6. Sponsored by: CrowdSec - The open-source & collaborative security stack: respond to attacks & share signals across the community. Download it for free

Weekly Update 304

It's very much a last-minute agenda this week as I catch up on the inevitable post-travel backlog and pretty much just pick stuff from my tweet timeline over the week 😊 But hey, there's some good stuff in there and I still managed to knock out almost an hour worth of content!

References

1. La Poste Mobile got themselves ransom'd and their data dumped (and they're still offline)
2. Mangatoon are very clearly covering up their breach (which is now hard to do given it's in HIBP and received plenty of press)
3. The "Seconds" app is my secret presenting sauce! (any workout app that can run a sequence of timed intervals will do it)
4. I'm totally loving Apple's AirTags to track all my things! (not loving that my AMG is still sitting Melbourne 🤦‍♂️)
5. The Wi-Fi BBQ thermometer is actually really neat (and it does benefit from being connected, too)
6. Sponsored by: Kolide can help you nail third-party audits and internal compliance goals with endpoint security for your entire fleet. Learn more here.

Weekly Update 305

I broke Yoda's stick! 3D printing woes, and somehow I managed to get through the explanation without reverting to a chorus of My Stick by a Bad Lip Reading (and now you'd got that song stuck in your head). Loads of data breaches this week and whilst "legacy", still managed to demonstrate how bad some practices remain today (hi Shadi.com 👋). Never a dull moment in data breach land, more from there next week 😊

References

1. The Yoda 3D print looks amazing (just don't touch his stick)
2. New flash - social media platform collects lots of data! (seriously, the TicTok hyperbole got a bit too much this week)
3. What if... some free stuff is actually free? (you're not always "the product" and in many cases, that's frankly a pretty disingenuous term)
4. Sponsored by: Kolide is a fleet visibility solution for Mac, Windows, and Linux that can help you securely scale your business. Learn more here.

Weekly Update 306

I didn't intend for a bunch of this week's vid to be COVID related, but between the breach of an anti-vaxxer website and the (unrelated) social comments directed at our state premier following some pretty simple advice, well, it just kinda turned out that way. But there's more on other breaches too, in particular the alleged Paytm one and the actual Customer.io one.

I'm really looking forward to next week's update, here's a little teaser of what you can expect to hear about then 🤣

References

1. I've updated the Paytm data breach to be flagged as "fabricated" (full thread on the reasons why, it's a tricky one)
2. Anti-vax dating site that let people advertise ‘mRNA FREE’ semen left all its user data exposed (😲😳😲)
3. I'm genuinely sympathetic to all politicians on any side of the political fence who have to deal with the COVID mess (just read the volume of ridiculous crap they're at the receiving end of)
4. We're still seeing the long tail of the Customer.io data breach (protecting against malicious insiders is a hard one)
5. Sponsored by: Kolide is an endpoint security solution for teams that want to meet SOC2 compliance goals without sacrificing privacy. Learn more here.

Weekly Update 308

It was all a bit last minute today after travel, office works and then a quick rebuild of desk and PC before doing this livestream (didn't even have time to comb my hair!) So yes, I took a shortcut with the description of this video, but it all worked out well in the end IMHO with plenty of content that wasn't entirely data breach related, but yeah, that does seem to be a bit of a recurring theme in these vids. Enjoy 😊

References

1. The acoustic panelling in my office is starting to look awesome (some stuff is not lining up so it will be a little longer yet before completion)
2. The QuestionPro breach has been pretty poorly handled (it's also now well beyond debate that it's real)
3. If you're sending a C&D notice to a data breach forum, you're really got no idea how these things work (and now their data is... everywhere)
4. Here's that UniFi Protect Theta cam (they're pumping out so much cool stuff lately 😎)
5. The stage at NEXTGEN's Cyber Republic event was pretty awesome (the delayed flight home, late night and early start the next day was... less awesome 🙁)
6. I got what will possibly be the funniest set of spammer responses to Password Purgatory this week 🤣 (also learned a few things, I'm determined to get even better at this!)
7. Sponsored by: Kolide believes that maintaining endpoint security shouldn’t mean compromising employee privacy. Check out our manifesto: Honest Security.

Weekly Update 309

Right off the back of a visit to our wedding venue (4 weeks and counting!) and a few hours before heading to the snow (yes, Australia has snow), I managed to slip in a weekly update earlier today. I've gotta say, the section on Shitexpress is my favourite because there's just so much to give with this one; a service that literally ships shit with a public promise of multiple kinds of animal shit whilst data that proves only horse shit was ever shipped, a promise of 100% anonymity whilst the data set clearly shows both shit-senders and shit-receivers and possibly the most eye-opening of all, the messages accompanying the shit. So, uh, yeah, enjoy! 💩

References

1. The acoustic panelling in my office is starting to come together, but it needs more work (I'll always notice those little misaligned lines... and you probably will too now that I've mentioned it!)
2. Kickstarter's password reset email left a lot of people confused (turns out they were just rolling people on Facebook auth to native Kickstarter accounts, but by their own admission the messaging was really confusing)
3. Turns out the source of the templated emails I was getting about removing data from HIBP was Rightly (their intentions are good, but IMHO their execution is poor)
4. Shitexpress - where do I even being with this one?! (just read my Twitter thread on it, it's all kinds of crazy this one)
5. Sponsored by: Kolide can help you nail third-party audits and internal compliance goals with endpoint security for your entire fleet. Learn more here.

Weekly Update 310

By all accounts, this was one of the best weekly updates ever courtesy of a spam caller giving me a buzz at the 38:40 mark and struggling with "pwn" versus "porn". It resulted in an entertaining little on-air call and subsequently caused me to go out and register both haveibeeninpwn.com and haveibeeninporn.com. I figure these will result in much ongoing hilarity the next time I get a call of this nature about one of those domains 🤣 Oh - and there's a whole bunch of data breach stuff this week, enjoy!

References

1. The Mudge v. Twitter scandal has some pretty serious accusations in it (there's a 6 min CNN vid in that tweet that's worth a look)
2. Plex has gone for another round of data breach this week (actually pretty impressed that they now have 30M subscribers!)
3. LastPass has also gone for another round (I know the optics aren't good, but the real world impact of this is almost certainly insignificant)
4. I got a very convincing SMS phish this week (think about the human vulnerabilities this exploits, no wonder phishing remains so lucrative)
5. Sponsored by: Kolide is a fleet visibility solution for Mac, Windows, and Linux that can help you securely scale your business. Learn more here.

Weekly Update 311

Well, after a crazy amount of work, a lot of edits, reflection, and feedback cycles, "Pwned" is almost here:

This better be a sizzling read @troyhunt or I'll be crashing the wedding in ways never done before.

Also, I thought they'd cancelled Neighbours? 😉❤️ pic.twitter.com/jrYIKtL0Uh

— Mike Thompson (@AppSecBloke) August 30, 2022

The preview cycle is in full swing with lots of feedback coming in and revisions being made before we push it live to the masses. This is really exciting and I can't wait to get the book out there in front of everyone, stay tuned 😊

References

1. There's clearly more going on behind the scenes with Krebs' "Final Thoughts on Ubiquiti" post (but hey, I love what they both do so hopefully that's that and everyone can get back to doing what they do best)
2. The Russian streaming service START made it into HIBP (should I have done anything differently because it's Russian, or mostly full of Russian subscribers?)
3. The Stripchat data is also now in HIBP (a very adult website so flagged as "sensitive" and not publicly searchable)
4. I love a good crazy corporate response on Twitter, so here's a couple of them for you 😊 (quite funny that Ocado now decides to delete their crazy tweet!)
5. Sponsored by: Kolide is an endpoint security solution for teams that want to meet SOC2 compliance goals without sacrificing privacy. Learn more here.

Weekly Update 312

I'm so excited to see the book finally out and awesome feedback coming in, but I'm disappointed with this week's video. I frankly wasn't in the right frame of mind to do it justice (it's been a very hard road up until this point, for various reasons), then my connection dropped out halfway through and I had to roll to 5G, and now I'm hearing (both from other people and with my own ears), a constant background noise being picked up by the mic. Argh! But, that's the reality of scheduled live streams and for better or worse, you end up getting the "warts and all" version. It is what it is, and next week's will be better 😊

References

1. book.troyhunt.com
2. Sponsored by: Kolide believes that maintaining endpoint security shouldn’t mean compromising employee privacy. Check out our manifesto: Honest Security.

Weekly Update 313

I came so close to skipping this week's video. I'm surrounded by family, friends and my amazing wife to be in only a couple of days. But... this video has been my constant companion through very difficult times, and I'm happy to still being doing it at the best of times 😊 So, with that, I'm signing out and heading off to do something much more important. See you next week.

Taking a bit of time off Twitter while @charlottelyng and I do more important things 💍 👰‍♀️ pic.twitter.com/9JJrPM9kWX

— Troy Hunt (@troyhunt) September 13, 2022

References

1. The Brand New Tube video site was breached and is now in HIBP (350k account details of what seems to be a very, uh, "unique" demographic were exposed)
2. The TikTok breach that... wasn't (why is this still getting media attention?!)
3. Sponsored by: Varonis. Reduce your SaaS blast radius with data-centric security for AWS, G Drive, Box, Salesforce, Slack and more.

Weekly Update 314

Wow, what a week! Of course there's lots of cyber / tech stuff in this week's update, but it was really only the embedded tweet below on my mind so I'm going to leave you with this then come to you from somewhere much more exotic than usual (and I reckon that's a pretty high bar for me!) next week 😎

Absolutely over the moon to formally make @Charlotte_Hunt_ a part of our family ❤️ 💍 pic.twitter.com/XfahXElboC

— Troy Hunt (@troyhunt) September 21, 2022

References

1. Optus disclosed a breach, but really didn't share much solid information about it... unlikely what Jeremy Kirk has since tweeted (these tweets came out after I recorded the vid so I didn't reference them, but it's the best analysis of the legitimacy of the data that I've seen to date)
2. Lots of gigabytes of TAP Air Portugal customers is now floating around (and it's searchable within HIBP)
3. Sponsored by: SecAlerts vulnerability awareness: Receive CVE & zero-day alerts, news & version updates all matched to your software. Discount code within!

Weekly Update 315

How's this weeks video for a view?! It's a stunning location here in Bali and it's just been the absolute most perfect spot for a honeymoon, especially after weeks of guests and celebrations. But whoever hacked and ransom'd Optus didn't care about me taking time out and I've done more media in the last week than I have in a long time. I don't mind, it's a fascinating story the way this has unfolded and that's where most of the time in this week's video has gone, I hope you enjoy my analysis of what has become a pretty crazy story back home in Australia.

References

1. Bali is a stunning place with postcard worthy shots around every corner (link through to the tweet thread with all the magic 😍)
2. I've never seen a data breach make as much local news as Optus has, not even close! (link through to Jeremy Kirk's thread explaining how it went down)
3. When people are wondering if they need to change their name and date of birth in the wake of a data breach, you know there's bigger problems to be solved (seriously, depending on numbers as some sort of secret source sufficient to form a significant part of an identity theft attack is madness and needs to die in a fire)
4. Sponsored by: Varonis. Reduce your SaaS blast radius with data-centric security for AWS, G Drive, Box, Salesforce, Slack and more.

Weekly Update 316

Geez it's nice to be home 😊 It's nice to live in a home that makes you feel that way when returning from a place as beautiful as Bali 😊 This week's video is dominated by the whole discussion around this tweet:

I love that part of the Microsoft Security Score for Identity in Azure improves your score if you *don't* enforce password rotation, what a sign of the times! Who out there still works somewhere that forces rotation (because "reasons")? pic.twitter.com/a2yQQvNRpa

— Troy Hunt (@troyhunt) October 6, 2022

I love this for the way it throws traditional logic out the window, logic we all knew sucked and I suspect the massive engagement the tweet drove is due to precisely that: Microsoft giving us all a good reason to whinge about a sucky practice that still prevails so broadly. So... I hope you enjoy listening to just how bad enforced password rotation sucks 😊

References

1. We've known that mandatory password rotation has passed its used by date for years now (that blog post was actually the genesis for Pwned Passwords)
2. The Bhinneka breach went into HIBP (Indonesian e-commerce service with 83% of pwnees being repeat visitors to HIBP)
3. The Wakanim breach also went in, a pretty fresh one from 6 weeks ago (actually thought this was quite under-reported for an incident impacting 6.7M people)
4. Sponsored by: Kolide can help you nail third-party audits and internal compliance goals with endpoint security for your entire fleet. Learn more here.

Weekly Update 317

I decided to do something a bit different this week and mostly just answer questions from my talk at GOTO Copenhagen last week. I wasn't actually in Denmark this time, but a heap of really good questions came through and as I started reading them, I thought "this would actually make for a really good weekly update". So here we are, and those questions then spurned on a whole heap more from the live audience too so this week's video became one large Q&A. I hope you enjoy this one, let me know if I should do more of these in the future.

References

1. I now have a teenager... on social media! (it's been fun setting stuff up with Ari and locking it down, lots of fundamentals there everyone should know)
2. Here's all the questions from GOTO (also includes the ratings, which please me 😊)
3. Sponsored by: Varonis. Reduce your SaaS blast radius with data-centric security for AWS, G Drive, Box, Salesforce, Slack and more.

Weekly Update 318

Aussie breachapalooza! That what it feels like this week between Optus (ok, it was weeks ago but it's still in the news), Vinomofo, My Deal and the mother of all of them (at least as far as media interest goes), Medibank. That last one totally smashed my week out with unprecedented press enquiries, so is it any wonder I totally missed the Microsoft one? I read through that last one live in this week's video and as you'll hear, a breach of any kind is never a good look but what stands out for me about this one isn't the breach itself, rather the marketing effort SOCRadar has made around it. As I say in the video, it just feels... icky. See if you agree.

References

1. The Optus breach really got the nation down here paying attention to data breaches (that alone got a huge amount of attention, and then Medibank happened...)
2. I myself got an email from My Deal saying I'm in the breach (ok, so password reset and then they tell me I have no account!)
3. Vinomofo also had themselves a data breach (they were just using production data for testing "as is industry practice" 🤦‍♂️)
4. The Medibank breach has made massive news down here (it's particularly nasty when we're talking about health data being held to ransom)
5. The BlueBleed marketing campaign (sorry - "breach") is more about how it was reported rather than what it actually is (note in the thread that Kevin mentions the search tool has now been removed)
6. Sponsored by: EPAS by Detack. No EPAS protected password has ever been cracked and won't be found in any leaks. Give it a try, millions of users use it.

Weekly Update 319

Geez we've been getting hammered down here: Optus, MyDeal, Vinomofo, Medibank and now Australian Clinical Labs. It's crazy how much press interest there's been down here and whilst I think some of it is a bit hyperbolic, bringing the issue to the forefront and ensuring it's being discussed is certainly a good thing. Anyway, let's see what happens between now and next week's video, at this rate there'll be at least one more major Aussie breach to talk about!

References

1. Big Ass Fan IoT integration has been a big pain in the ass (it really shouldn't be this hard)
2. Australian Clinical Labs is the latest Aussie company to make the data breach headlines (includes pathology test results 😲)
3. The E-Pal breach went into HIBP (100k email addresses, more than half in HIBP already)
4. The Doomworld breach also went into HIBP (they "got pwned by a script kiddie", according to their disclosure)
5. I've been putting a heap of work into the Stripe integration for the HIBP API key (deleting code is so satisfying!)
6. Sponsored by: Varonis. Reduce your SaaS blast radius with data-centric security for AWS, G Drive, Box, Salesforce, Slack and more.

Weekly Update 320

I feel like life is finally complete: I have beaches, sunshine and fast internet! (Yes, and of course an amazing wife, but that goes without saying 😊) For the folks asking via various channels, the speed is not exactly symmetrical at 1000/400 and I'm honestly not sure why that's the case here in Australia. I also had to shell out quite a bit extra to go from 50 up to a "business" plan of 400 up, but with the volumes of data I ship around it'll make a pretty big difference to the way I work over time. Also this week, much more on the work we're doing with HIBP from pricing the annual plans to a proper support system via Zendesk. I'm really hoping that by next week's update we'll have shipped the new rate limits too, stay tuned for that but for now, here's number 320:

References

1. Finally - I have fast internet! (just a "little" 25x speed boost, thank you very much 😊)
2. Everyone seems to be doing 17% discounts for annual over monthly billing (that's Slack's pricing page and as someone pointed out in the live stream, it's effectively 2 free months)
3. We now have a proper support system up and running for the HIBP API keys (we're really happy with Zendesk, hoping this makes both subscribers' and our lives easier)
4. Sponsored by: Kolide is a fleet visibility solution for Mac, Windows, and Linux that can help you securely scale your business. Learn more here.

Weekly Update 321

What a week to pick to be in Canberra. Planned well before things got cyber-crazy in Australia, I spent a few days catching up with folks in our capital and talking to the Australia Federal Police for scam awareness week. That it coincided with the dumping of Medibank customer health records made it an especially interesting time to talk with police, politicians and industry leaders. A bit of a bizarre, whirlwind week if I'm honest, but full of very positive encounters even though it coincided with such a demanding time for many of us in this industry down here.

References

1. Mastodon has been... entertaining 🤣 (just a collection of fun tweets that perfectly illustrate how much many of us have struggled to wrap our heads around it)
2. HTML email signatures are a complete nightmare ("mjml" bubbled to the top a few times as a way of tackling this)
3. HIBP API keys can be bought at different rate limits and paid a year in advance! (by some unexplainable miracle, 100% of feedback has been positive!)
4. I've honestly become a bit lost for words over the Medibank ransom saga, it's just absolutely horrendous (that's a link to my thread commentating on the data dumps)
5. Sponsored by: Varonis. Reduce your SaaS blast radius with data-centric security for AWS, G Drive, Box, Salesforce, Slack and more.

Weekly Update 322

It's very strange to have gone 1,051 days without spending more than a few hours apart, but here we are... very temporarily:

Only 15,501km away 😢 And only 4 days until I head back to Oslo 😊 pic.twitter.com/PDn1Syplig

— Troy Hunt (@troyhunt) November 20, 2022

Which means that right now, I'm throwing myself into a gazillion other things to keep me busy including how schools advise parents to manage devices, wrapping gup that HTML signature, asking probing questions about paying ransoms and, unbelievably, fighting off the most ridiculous claim of HIBP having been P'd. That last one especially, FFS, just listen...

References

1. Does your child's school provide any guidance around the use of native parental controls on their devices? (not a poll, but a near unanimous "no" response anyway)
2. My HTML email signature is finally done - it was not a fun process 😭 (for my next trick - making it actually work in Exchange for iOS)
3. Should there be a government ban on paying a ransom to stop breached data from being publicly leaked? (this one is a poll... with a very clear result)
4. Have I Been Pwned didn't get pwned (I can't believe how this got written in the first place, nor how anyone ever even took it seriously 🤦‍♂️)
5. Sponsored by: Varonis. Reduce your SaaS blast radius with data-centric security for AWS, G Drive, Box, Salesforce, Slack and more.

Weekly Update 323

Finally, after nearly 3 long years, I'm back in Norway! We're here at last, leaving our sunny paradise for a winter wonderland. It's almost surreal given how much has happened in that time, not just the pandemic but returning to Oslo with Charlotte as my Norwegian wife is super cool 😎 Other things this week are not so different, namely people complaining on Twitter (albeit also complaining about Twitter). As I find myself continually caveating, YMMV but it does feel like events are being overly dramatised by some at present. Time will tell, but I think we'll all still be using the platform to complain about things just as effectively in a year from now as we are today 🙂

References

1. Catch me this week in Oslo doing a free meetup for NDC and NNUG (Tuesday from 17:00 onwards)
2. Have you heard there's some controversy surrounding Twitter at present? (geez this thread opened a can of worms, it's a massively divisive topic right now)
3. Acxiom didn't get breached, but that doesn't stop people shipping around "The Acxiom Breach" (I hate breach misattribution with a passion)
4. You can now get Pwned for 30% less! (because it's a holiday in America, we've made my book cheaper 😊)
5. Sponsored by: 1Password, a secure password manager, is building the passwordless experience you deserve. See how passkeys work

Weekly Update 324

We're in Copenhagen! Scott and family joined us in Oslo for round 2 of wedding celebrations this week before jumping on the ferry to Copenhagen and seeing the sights here. There's lots of cyber things in this week's vid relating to HIBP's birthday, Medibank and financial penalties for breaches, but I'm just going to leave you with one of the most amazing moments of my life captured in pics:

🇳🇴 ❤️ 👰‍♀️ 🤵 pic.twitter.com/pPY49DArIF

— Troy Hunt (@troyhunt) December 2, 2022

References

1. Scott joined Charlotte and I for our second wedding celebration in Oslo (a very special occasion with some amazing pics... just wait until you see what's coming)
2. I stopped by NDC in Oslo this week to do a joint user group for them and NNUG (first time back in Oslo for almost 3 years!)
3. It's HIBP's 9th birthday today (well that escalated... quickly?)
4. The ransomware crew that hit Medibank has announced "case closed" (it's certainly far from that for Medibank, but hopefully that's the end of dumped data)
5. The Ministry of Foreign Affairs of Russia is throwing shade at Australia for attributing the Medibank hack back to Russian criminals (this was always going to get messy)
6. The Aus government has laid down some serious maximum penalties for future data breaches ("maximum" being the operative word, this isn't about killing companies)
7. Sponsored by: Kolide is an endpoint security solution for teams that want to meet SOC2 compliance goals without sacrificing privacy. Learn more here.

Weekly Update 325

For the first time in I don't know how long, I couldn't do this live. Turns out both cell and wifi in Lapland are, with the benefit of hindsight, exactly what you'd expect from a remote location in the Arctic circle. The rest of the place was pretty amazing though, and a good deal of this week's content has gone to that. Plus, there's the whole "Australia becoming the world's most cyber-secure country" goal which deserves discussion. Oh - and the tweet with that pic I discuss - I'll just leave that one here 😊

Sometimes, life feels like a fairytale. This is now my favourite photo ever ❤️ pic.twitter.com/lspKwVVSly

— Troy Hunt (@troyhunt) December 9, 2022

References

1. Will Australia become the world's most cyber-secure country by 2030? (Is it feasible? Measurable? Does it even matter?)
2. Abandonia was breached again (7 years on, and still salted MD5 password hashes 🤦‍♂️)
3. I mentioned my Hack Your Career talk as it relates to dealing with snarky comments online (deep linked to the point where I cover this exact topic)
4. Sponsored by: Varonis. Reduce your SaaS blast radius with data-centric security for AWS, G Drive, Box, Salesforce, Slack and more.

Weekly Update 326

Despite having both my tripod and mic in the wrong suitcase in the wrong place, Scott and I still pulled together a weekly vid from the Norwegian mountains. Much of this week is a combination of our travels here, responses to my tweets around cookie warnings and reactions to Elon's various decisions (and undecisions) on Twitter. Plus, there's the CoinTracker and Gemini breaches which appear to have stemmed from the SendGrid breach, the connection to that incident having been made by CoinTracker just after we had a friendly exchange about the description in HIBP 🙂

I'll leave you with some epic pics we snapped a few hours after this video, what a sight to behold, especially whilst sitting in the hot tub with good friends and cold beer 😊

🤯 pic.twitter.com/Q5hYc0tGHd

— Troy Hunt (@troyhunt) December 17, 2022

References

1. 99% of people vehemently hate cookie warnings, and 1% just want to argue about whose fault it is 🤷‍♂️ (that tiny minority is really missing the point)
2. Reading Elon's tweets is... entertaining (but the propensity for some to be outraged at his every move is also... entertaining)
3. The penny dropped whilst doing this livestream that CoinTracker has now published a post specifically naming SendGrid as the "third party" that exposed their data (wonder why they - and Gemini - didn't initially name them?)
4. Sponsored by: Kolide believes that maintaining endpoint security shouldn’t mean compromising employee privacy. Check out our manifesto: Honest Security.

Weekly Update 327

It's my last weekly update on the road for a while! As enjoyable as travel is, I'm looking forward to getting back to a normal routine and really starting to smash out some of the goals I have for the coming year. For now though, I've published this a couple of days after recording, and a day after an awesome hot, beachside Christmas. Hope yours has been amazing too, see you from home next week 😊

References

1. LastPass has added an update re their recent security incident (if keychains have been downloaded - even fully encrypted ones - that's bad news)
2. Personally, I quite like the public view count on all tweets (if you dislike it just purely because it was introduced under Elon's reign, that's a different problem)
3. Sponsored by: 1Password, a secure password manager, is building the passwordless experience you deserve. See how passkeys work

Weekly Update 328

We made it! That's 2022 done and dusted, and what a year it was, both professionally and personally. It feels great to get to the end of the year with all the proverbial ducks lined up, some massive achievements now behind us (not least of which was the wedding), and a clean slate coming into 2023 to do amazing things. I'm super excited about next year and can't wait to share a whole bunch of new stuff over the coming 52 Fridays. For now though, here's the last of it from a pretty crazy year, enjoy 😊

References

1. We spent Xmas day poolside in Singapore (yes, some places in the world are actually hot when Santa comes!)
2. Could ChatGPT be used to toy with spammers? (let's find out, I'll keep the thread updated with any responses 🙂)
3. I've been shuffling around a bunch of my Home Assistant entities from switches to lights (anecdotally, these changes appear to have really improved things thus far)
4. Sponsored by: 1Password, a secure password manager, is building the passwordless experience you deserve. See how passkeys work

Weekly Update 329

Strap yourself in, this is a big one! Big video, big breach (scrape?), and a big audience today. The Twitter incident consumed a heap of my time before, during and after this live stream, but then I go and get a sudden itch to do stuff like the number plate capturing and, well, there goes even more hours I don't have. But hey, I love what I do and I have no regrets, I hope you enjoy watching this week's vid 😊

Oh - one more thing: today I set up an official Mastodon account for HIBP. If you've got a footprint in the fediverse, please go and give the account a follow. There are a bunch of others out there that definitely aren't run by me, it's only this one, it only follows me personally and it has a verified website of haveibeenpwned.com so should be easy to find even if you don't follow the link above.

References

1. The old legacy rate limit for the HIBP API is now gone (loads of warning on this, but the stats show a lot of extra requests being rate limited since the change hit)
2. The Deezer breach has been really poorly communicated on their behalf (seems like they forgot to notify, well, everyone!)
3. Looks like the scraped Twitter data all came by throwing previously breached email addresses at a vulnerable API (you can't even blame Elon for that one... but you can probably blame him for the zero comms on the incident)
4. I had way too much fun letting ChatGPT mess with a spammer (he wasn't quite as amused as me 🤣)
5. I've been playing around with capturing number plates via my Ubiquiti gear (after more trialling today, my conclusion is that I need to get my hands on some of their new AI gear and stop trying to build this myself)
6. Sponsored by: 1Password, a secure password manager, is building the passwordless experience you deserve. See how passkeys work

Weekly Update 330

Big week! So big, in fact, that I rushed into this week's update less prepared and made it a very casual one, which is just fine 😊 It's mostly password books and kitchen equipment this week, both topics which had far more engagement than I expected but made them all the more interesting. Next week I'll get back into the pattern of switching between last thing Friday and first thing Friday so it'll be my morning again on the 20th, see you then!

References

1. After all this week's action, I was a little bit less organised today (link through to a Facebook post, I put a lot more pics and vids there than on other platforms)
2. I'm ok with password books (you can buy them down at our local post office)
3. I'm so ok with password books, that I wrote an entire blog post on it a few years ago (well, on that and other aspects of why chasing the perfect security solution isn't the right approach)
4. It's looking increasingly dire for 3rd party Twitter clients using their API (surely it would be communicated in advance if they were being killed?)
5. My kitchen rebuild tweet thread had some awesome responses to it (the suggestions there will definitely help shape the final product)
6. Sponsored by: CrowdSec - The open-source & collaborative security stack: respond to attacks & share signals across the community. Download it for free

Weekly Update 331

Well and truly back into the swing of things in the new year, I think what I've found most satisfying this week is to sit down and pump out a decent blog post on something technical. It's an itch I just haven't had enough time to scratch properly in recent times and I really hope Pwned or Bot makes up for that. I love that it's generating discussion (both for and against) and that it's causing people to stop and think about how we establish the legitimacy of identities in an increasingly bot-centric world. I hope you enjoy this week's update and all the conversation surrounding it.

References

1. Pollies, porn and pyrotechnics (and now I know why Canberra is know for porn)
2. The Twitter API situation is a complete flustercuck (I'd be less upset if they made the native app way better)
3. What is 1Password had a data breach? (read about how they protect your keychain such that even after a data breach, the master password alone would be useless)
4. Since recording this morning, I've poured hours into what presently has a working titled of "Down the Cloudflare / Stripe / OWASP Rabbit Hole: A Tale of 5 Rabbits Deep 🐰 🐰 🐰 🐰 🐰" (I just kept going until I got stuck and pumped out the linked tweet)
5. Pwned or Bot is drumming up plenty of good feedback and in true Twitter form, plenty of controversy (no, you shouldn't be penalised for not being breached, go back and read the whole thing again)
6. Sponsored by: CrowdSec - Gain crowd-sourced protection against malicious IPs and benefit from the most accurate CTI in the world. Get started for free.

Weekly Update 332

Breaches all over the place today! Well, this past week, and there's some debate as to whether one of them is a breach, a scrape or if the term just doesn't matter anyway. Plus, we've been kitchen shopping, I'm helping friends out with connected doorbells and other random but somehow related things this week. Enjoy 😊

References

1. I'll be "at" GOTO Aarhus in May (there online, but definitely speaking at the show)
2. Following all the awesome input, we decided to forego the teppanyaki plate on the Bora Professional 3.0 (there's a surprising amount of good culinary advice from my audience!)
3. Zurich Japan was breached (big name, but small portion of people already in HIBP)
4. Autotrader had a heap of data breacraped (breached? scraped? does it matter?)
5. Speaking of which, when actually is a scrape a breach? (my more concerted thoughts on the matter all in one place)
6. Norwegian adventure store KomplettFritid was also breached (apparently, they decided to not tell their customers)
7. GoTo, the owner of LastPass, "shared more bad news" (I do have some historical views on this organisation...)
8. Hey, it's my views on GoTo! (nearly 13 years old now, but this remains poor behaviour IMHO)
9. Sponsored by: CrowdSec - Gain crowd-sourced protection against malicious IPs and benefit from the most accurate CTI in the world. Get started for free.

Weekly Update 333

Getting everything out nice and early today so we can get out there in hit the wake park in the balmy "well over 30C" weather (the radio is talking about "severe heatwave weather" as I write this). But hey, we're surrounded by water and a beer delivery is due today so no crisis 😎 There's also a heap more data breach news and I'll be putting that connected BBQ to use for the first time today, stay tuned for epic pics on all of the above over the coming hours!

References

1. HTTPS still doesn't equal trust, it never did, it never will and Aussie Broadband were way off the mark to imply otherwise (they did later recant on that position, but the messaging still isn't completely right)
2. Namesco in the UK sent out messaging to customers which shows they have absolutely no idea about some of the most basic, fundamental tents of how SSL works (hoping we get a follow-up on this, it's inexcusable in this day and age)
3. Planet Ice in the UK was breached (240k people with 82% of them already in HIBP)
4. Pitt Meadows School District in British Columbia was breached (only 0.1% of accounts were already in HIBP)
5. I'm getting seriously sick of the lack of proper disclosure from many organisations (it really isn't this hard - it shouldn't be this hard)
6. I bought a connected BBQ! (stay tuned for deliciousness 🤤)
7. Sponsored by: CrowdSec - Gain crowd-sourced protection against malicious IPs and benefit from the most accurate CTI in the world. Get started for free.

Weekly Update 334

Did I really need to get a connected BBQ? No more than I needed to connect most of the other things in the house which is to say "a bit useful but not entirely necessary". But it's a fascinating process when looked at through the lens of how accessible the technology is to your average person given it's embedded in a consumer-orientated product. In short - it's painful - but listen to this week's update to hear precisely why. Plus, there's a heap of new data breach and some really, really good news about the NTLM hashes now being available in Pwned Passwords. Enjoy 😊

References

1. BBQ'ing shouldn't be this hard (not the cooking, I mean getting the damn thing connected to the network!)
2. Instant Checkmate was breached (12M email addresses right there)
3. TruthFinder was also breached (same parent company, another 8M addresses there)
4. The LimeVPN breach also went into HIBP (you really want to be able to trust your VPN provider)
5. Weee was breached too (another case where it was too hard to get in touch with them)
6. Full parity for NTLM hashes in Pwned Passwords is now live! (once again, bit shout out to Stefán Jökull Sigurðarson for his work on this)
7. Sponsored by: Kolide ensures only secure devices can access your cloud apps. It's Device Trust tailor-made for Okta. Book a demo today.

Weekly Update 335

No cyber. It's literally a "cyber-free" week, as least far as the term relates to security things. Instead, I'm unboxing an armful of Insta360 goodies and lamenting the state of IoT whilst putting even more IoT things into our massive garage renovation. I'm enjoying it though. Honestly. I think...

References

1. The Ubiquiti AI Bullet camera with license plate recognition is... 😲 (as for criticism received for pointing a security camera into a public place, that's... 🤦‍♂️)
2. Trying to find an IoT door lock that does everything is... 🤬 (unfortunately, the best one I can find doesn't actually exist yet)
3. When it does launch, the Aqara U100 looks pretty sweet (really liking the Apple Home Key integration in particular)
4. The digitally rendered video for our upgraded garage is... 😲 (lots of detail needs to change, but you get the idea)
5. Sponsored by: Kolide ensures only secure devices can access your cloud apps. It's Device Trust tailor-made for Okta. Book a demo today.

⚡Top Cybersecurity News Stories This Week — Cybersecurity Newsletter

Hey 👋 there, cyber friends! Welcome to this week's cybersecurity newsletter, where we aim to keep you informed and empowered in the ever-changing world of cyber threats. In today's edition, we will cover some interesting developments in the cybersecurity landscape and share some insightful analysis of each to help you protect yourself against potential attacks. 1. Apple 📱 Devices Hacked with

Weekly Update 336

Hey, it's double-Troy! I'm playing with the Insta360 Link cam, a gimbal-based model that can follow you around the room. It's tiny and pretty awesome for what it is, I'm doing some back-to-back with that and my usual Sony a6400 this week. A little note on that: during the live stream someone suggested there was some lag from that camera (very minor, they suggested), but others couldn't see it. I've just been watching a bit of the video while writing up this post and I reckon they're right. Try the 3:02 mark, for example, where on Insta360 Link I have my finger up but on the Sony a6400, I don't:

It's very minor, but it's just enough to notice. Anyway, see what you think, all that a much more in weekly update 336:

References

1. I spoke at the Association of Superannuation Funds Australia this week (very happy to see cybersecurity on the agenda at a finance conference)
2. These Insta360 cameras are kinda blowing my mind 🤯 (super weird to think of 360 video that allows you to later go back and "point the camera" wherever you wanted it to be)
3. 🐰 🐰 🐰 🐰 🐰 🐰 (maybe I just like putting rabbit emojis in a blog post title, or maybe the firewall stuff with Cloudflare, Stripe and OWASP was an interesting little adventure)
4. Twitter is killing SMS-based 2FA if you're not paying them any money (their messaging was poor, but the outcome is probably the right one)
5. What happens if your DNA get pwned? (probably nothing... yet)
6. Sponsored by: Kolide ensures only secure devices can access your cloud apps. It's Device Trust tailor-made for Okta. Book a demo today.

Weekly Update 337

Guns! You know, the things you kinda want to keep pretty well protected and out of the hands of nefarious parties, like the kinds of folks that following their data breach could match firearms to an individual at an address on a phone number of a gender and specific age. But don't worry, no financial information was compromised! 🤦‍♂️

All that and more in the 337th addition of my weekly update, enjoy!

References

1. GunAuction.com got pwned (it only took them 2 months to tell absolutely nobody about it too)
2. The Ticketcounter hackers have been pwned (3 kids, surprise surprise)
3. The office acoustic work is finally complete! (I love this, it's amazing 😍)
4. The Ubiquiti AI 360 cam is really impressive (check out how that fisheye view can be flatted into frames of other parts of the room)
5. We got burgled - but only a little bit (I'm more annoyed about the lapses in my own security, but mitigating controls ultimately made this a non-event)
6. Sponsored by: Kolide ensures only secure devices can access your cloud apps. It's Device Trust tailor-made for Okta. Book a demo today.

Weekly Update 338

I'm going lead this post with where I finished the video because it brought the biggest smile to Charlotte's and my faces this week:

This. Is. Amazing 😍 pic.twitter.com/wOl4kpK841

— Troy Hunt (@troyhunt) March 3, 2023

When I talked about the McLaren in this week's video, Frits made the comment "the smile on your face says it all", which absolutely nailed it. But more than that, it brings a smile to the face of everyone who sees it (I suspect the colour helps), we're just loving seeing the excitement expressed by kids and adults alike. It's so much fun 😊

Less fun is dealing with Eye4Fraud. 24 hours on from recording this video, there's still zero visible progress and I lament that this one is just going to slip beneath the radar. If you're in the breach, do push for answers, it really shouldn't be this hard. All that and more in this week's video, enjoy!

References

1. Oh Namesco, you do provide entertainment! (still selling SSL like it's 2015)
2. Eye4Fraud - the one that gives merchants "guaranteed protection" - had lots of millions of their merchant's transactions dumped (and to date, they don't appear to have actually told anyone)
3. Cloudflare's cache reserve is pretty amazing stuff (as expected, the cache hit ratio is even better one day on with 100 less origin requests and only a slight decrease in overall traffic)
4. It was almost a decade ago when I last wrote about a car (should I do another one for the McLaren?)
5. Sponsored by: Kolide ensures only secure devices can access your cloud apps. It's Device Trust tailor-made for Okta. Book a demo today.

Weekly Update 339

Why can't I audio right? It's my 339th video and I still make mistakes 🙂 But it came good and we got a decent show out of it with lots of interesting engagement even though doing this a lot later in the day than usual. I found the discussion around IoT door locks especially interesting as it's a real nexus of security, usability and a bit of critical thinking about real world risks. That term "security absolutism" that came up in the comments is gold, I hope you enjoy watching this episode.

References

1. Yale IoT door locks seem to be the least bad ones you can buy! (you can have that slogan for free guys 🙂)
2. The HDB Financial Services breach went into HIBP (after their parent company denied the breach...)
3. Canada's Shopper+ also went into HIBP (another 878k records dating back to 2020)
4. Latitude Financial announced a breach this week (another major one down under as Australia continues representing in data breach land)
5. At long last, Eye4Fraud has acknowledged their breach... (via one the most half-arsed disclosure statements I've ever seen)
6. Sponsored by: Kolide ensures only secure devices can access your cloud apps. It's Device Trust tailor-made for Okta. Book a demo today.

Weekly Update 340

I'm excited about coming to Prague. One more country to check off the list, apparently a beautiful city and perhaps what I'm most stoked about, it's the home of Prusa 3D. Writing this as I wrangle prints out of my trusty MK3S+, I'm going to do my best to catch up with folks there and see some of the super cool stuff they're doing. Other than that, this week is full of the usual; data breaches, IoT and a cold 🍺

References

1. I'm coming to Prague! (Experts Live Europe, see you there September 18)
2. I'm crow-sourcing a new and improved version of the HIBP email extractor (and no, it's not going to facilitate cybercrime 🤦‍♂️)
3. TheGradCafe was breached (they apparently know about it, but just won't reply to anyone trying to reach them on it)
4. The kitchen shall be black! (as you can probably glean from this thread, there's a huge amount of thought going into this)
5. My network got, uh, too big 😲 (it was always going to be better to VLAN the IoT devices anyway, and now it's done)
6. The garage is now starting to look more finished (within the next couple of weeks, other than the joinery work it should look pretty complete)
7. Sponsored by: Kolide ensures only secure devices can access your cloud apps. It's Device Trust tailor-made for Okta. Book a demo today.

Weekly Update 341

Most of this week's video went on talking about the UniFi Dream Wall. What a unit! I mean it's big, but then it wraps a lot of stuff up in the one device too. If you watch this and have thoughts on how I can integrate it into the new garage such that it doesn't clash with the dark theme, I'd love to hear about it. I'll share more once I set it up in the coming weeks but for now, enjoy this week's video 🙂

References

1. The UniFi Dream Wall is an impressive unit (that's a link to the video I was referring to and it does show 2 HDDs so... 🤷‍♂️)
2. The tweet that went nuts (can we all just agree that Twitter - and Elon - are polarising, but both are still here, still working and probably not going anywhere soon?)
3. Pwned Passwords has now surpassed 4 billion monthly requests! (I'm getting kinda curious as to just how big this thing is going to get...)
4. Sponsored by: Kolide ensures only secure devices can access your cloud apps. It's Zero Trust tailor-made for Okta. Book a demo today.

Weekly Update 342

Next time I post a poll about something as simple as "when is next Friday", I don't expect I'll get as much interest. Of course "next time" will be whatever poll follows the last one, not the poll that falls after that one! But more seriously, I cannot think of a better example of ambiguous language that's open to interpretation and so easily avoided (hello MM-DD people!)

Also, Genesis Market and Operation Cookie Monster. This is just amazing stuff and a testament to a coalition of law enforcement agencies across the globe that have now made well over 100 arrests. Off the back of the NCA's DDoS market honeypot, the BreachForums admin arrest and the takedown of RaidForums before that, if you're playing in this space you'd have to be looking over your shoulder by now. Interesting times in cyber(crime) space.

References

1. I'll be in New Zealand next Friday, which is the Friday that falls at the end of next week, not the week after (what is wrong with 78% of people?! 🤣)
2. And now I know how an epoxy floor is laid (think of it as "feeding chickens")
3. "Operation Cookie Monster" is a fascinating story of identity theft, a coalition of law enforcement agencies, and HIBP 😊 (millions of email addresses and passwords provided by the FBI are now searchable)
4. Sponsored by: Kolide ensures only secure devices can access your cloud apps. It's Zero Trust tailor-made for Okta. Book a demo today.

Weekly Update 343

A bit late this week as I've prioritised time out with the family doing as many New Zealand adventure things as we can. And we've seriously maxed out the time, as you can see via the FB link below. But that hasn't stopped a couple of new data breaches flowing into HIBP nor me having some pretty direct thoughts on the premise that the vast bulk of IT pros are being told not to report data breaches. I hope you enjoy this impromptu vid from a faraway location at an odd time, I'll be back to normal again next week.

References

1. New Zealand has pretty much just been back-to-back adventure activities 😎 (I've tended to put most of these on Facebook, loads of pics there)
2. The Kodi Foundation self-submitted their 400k record breach to HIBP (really high hit ratio for both existing pwned accounts and HIBP subscribers in the breach)
3. OGUsers got breached again - for the fifth time now! (no news on it to link to, just remember that if you're part of one of these communities your data is almost certainly going to end up in law enforcement hands sooner or later)
4. Apparently 71% of IT pros are being told to keep quiet about data breaches (if you're in this category, may you perpetually be looking over your shoulder waiting for an email from me...)
5. Sponsored by: Kolide ensures only secure devices can access your cloud apps. It's Zero Trust tailor-made for Okta. Book a demo today.

Weekly Update 344

I feel like a significant portion of this week's video went to discussing "the Coinbase breach that wasn't a Coinbase breach". There are various services out there that are used by the likes of password managers to alert their customers to new breaches (including HIBP in 1Password) and whoever Dashlane is using frankly, royally cocked up the attribution. What was a garden variety list of email addresses someone had just chucked the "Coinbase" name on had absolutely nothing to do with a breach of the crypto company. It's frustrating to watch, and I suspect that will come through when you watch the video too. See what you think.

References

1. I take an inordinate amount of pleasure in screwing with scammers / spammers (and judging by the reactions to that thread, so do you! 🤣)
2. Misattributing a data breach can be a pretty serious issue, and Dashlane's provider incorrectly implicating Coinbase as having been pwned isn't a good look (I'm especially frustrated given how much time I invest doing verification so precisely this doesn't happen!)
3. Domain searches via API are coming to HIBP! (that's a link to a "started" UserVoice idea, vote there if you'd like to be kept in the loop on progress)
4. I'm trialling using a Twitter subscription to provide earlier insights into breaches and seek community support in handling and disclosing them (no need to explicitly let me know if that's not of interest, just don't sign up 🙂)
5. Sponsored by: Kolide ensures only secure devices can access your cloud apps. It's Zero Trust tailor-made for Okta. Book a demo today.

Weekly Update 345

I stand by my expression in the image above. It's a perfectly accurate representation of how I looked after receiving the CityJerks breach, clicking on the link to the website then seeing what it actually was 😳 Fortunately, the published email address on their site did go through to someone at TruckerSucker (😳😳) so they're aware of the breach and that it's circulating broadly via a public hacking website. That segment is last up in this week's video and I do give fair warning just in case you're not in the best environment to be watching that part of the update. Viewer discretion advised!

References

1. Apparently, there are a whole bunch of accounts impersonating me on Mastodon (my tweet was deliberately crafter for amusement value hence the popcorn and tongue in cheek emojis, but that didn't stop people on Twitter losing their minds about Twitter)
2. Hence, "Exhibit B" (even with a follow-up tweet containing a meme of a massive box of popcorn, some minds have been lost 🍿)
3. Terravision got breached to the tune of more than 2M accounts (no reply to multiple attempts to disclose either)
4. MEO face masks in New Zealand also got breached (they did reply to me, but only by their Facebook account and then didn't engage any further)
5. CityJerks, the, uh, "mutual masturbation" website got breached (I think you just need to watch the video to properly understand this one 😳)
6. As to the question about garage progress, here's a thread with some cool internal shots (ok, so it's mostly car shots, but it gives you a good sense of the mood in there now)
7. Sponsored by: Kolide ensures only secure devices can access your cloud apps. It's Zero Trust tailor-made for Okta. Book a demo today.

Weekly Update 346

It's a bit of a mixed bag this week with a very light-hearted look at the death of the browser padlock icon (which has been replaced by an icon that looks like a sex act), and a much more serious discussion about divorce. It took a long time to write and be ready to publish that blog post, many years in fact, but I'm so glad I did. You don't have to scroll far through the responses to the launch tweet or the comments on the blog itself to get a sense of how it's impacted people, and as I said in the very opening of the post, this sort of openness tends to be really well received. Wherever you are in your own stage of life, I hope you enjoying reading that post and share it generously with those for whom it might just make a real difference.

References

1. Catch me at the cybersecurity unlocked meetup in Perth next week (super casual, no idea what I'm going to be talking about yet 🤔)
2. You can also catch me keynoting at the Cyber West Summit (loads of good stuff about what I've learned processing billions of breached records for HIBP)
3. The padlock icon is dead! (long live the, uh... "you know exactly what it looks like" icon 🙄)
4. The feedback to my blog post on divorce has been pretty amazing (it's obviously a delicate topic and it took me a long time to be ready to talk about it, but doing so seems to have made a difference to a lot of people)
5. Sponsored by: Kolide ensures only secure devices can access your cloud apps. It's Zero Trust tailor-made for Okta. Book a demo today.

Weekly Update 347

A late one this week as I cover from the non-stop conferencing that was the Azure user group in Perth, followed by the Cyber West keynote, then the social drinks that night, the flight back home straight into the AusCERT gala dinner, the panel on data governance that morning then wrapping up with the speed debate Friday arvo. I think that's all... Anyway, better later than never and nothing too serious in this week's update. Personally, I'm finding the house works the most fun to talk about so I'm going to hit the publish button on this post now then go back to drafting the blog series on everything we've done 😊

References

1. The RentoMojo data breach entered circulation and ended up in HIBP (another couple of million accounts right there)
2. I started a thread with before and after shots of the house works (writing up a much more comprehensive blog series right now...)
3. This is the story I mentioned about the bloke in Melbourne copping it from the public for craning his McLaren into his apartment (its' "guitar lessons" all over again!)
4. To the audience question about door locks, I did go back and look again and there's a Yale Assure Lock 2 that supersedes the SL I had an order (still no Apple HomeKey support though 😔)
5. Sponsored by: Kolide ensures only secure devices can access your cloud apps. It's Zero Trust tailor-made for Okta. Book a demo today.

Weekly Update 348

I feel like the .zip TLD debate is one of those cases where it's very easy for the purest security view to overwhelm the practical human reality. I'm yet to see a single good argument that is likely to have real world consequences as far as phishing goes and whilst I understand the sentiment surrounding the confusion new TLDs with common file types, all "the sky is falling" commentary I've seen is speculative at best. But hey, there's no rolling it back now, we can start judging by what actually happens with the TLD rather than sitting around creating misuse hypotheses.

References

1. The .zip TLD situation really isn't going to impact phishing (and if you don't agree, too bad, it's here now so we'll know for sure soon enough)
2. The ABC's "mosaic effect" visualisation of HIBP data is really cool (give this a go, it's a great way of seeing what the impact of data breaches really looks like)
3. Luxottica had over 70M unique customer records exposed (also looks like they never contacted impacted individuals)
4. Sponsored by: Kolide can get your cross-platform fleet to 100% compliance. It's Zero Trust for Okta. Want to see for yourself? Book a demo.
   

Weekly Update 349

This week's update is dominated by my experience with "Lena", the scammer from Gumtree who tried to fleece my wife of $800. There's a blow-by-blow rundown of how it all happened in this video and it's fascinating to think that these things can actually be successful given all the red flags. But they are, and in Australia alone innocent victims are stung to the tune of more than 3 billion dollars every year by fraudsters which is a staggering number. Understanding how these scams work and sharing that knowledge broadly with the less technical of those around us is part of how to combat this, so please share the tweet thread generously... and enjoy the entertainment 😊

References

1. That Xbox problem with all the suggestions around weird HDMI behaviour? (not one single person suggested checking I'd plugged the cables into the right inputs 🤦‍♂️)
2. When disclosure doesn't happen and victims are notified by a third party, it can leave the implicated service in a really uncomfortable position (this shouldn't be happening, and I'm sympathetic to Synduit's position here whether they were actually breached or not)
3. Our household didn't escape unscathed from the Luxottica data breach (congratulations Charlotte!)
4. I blew a lot of hours on a really flakey Azure Functions / storage queue problem that only appeared after a recent update (that pretty much wrote off my entire Wednesday)
5. Ah, scammers, the source of endless entertainment for us all! (but also a source of great pain for so many people, so it was nice to inflict some back on them for a change 😊)
6. Sponsored by: Kolide can get your cross-platform fleet to 100% compliance. It's Zero Trust for Okta. Want to see for yourself? Book a demo.

Weekly Update 350

And so ends a long period of back-to-back weeks of conferences and talks. It's funny how these things seem to cluster together at times and whilst the last 6 or 8 weeks (I honestly lose track!) have been chaotic, I've now got a few weeks of much less pressure which will give me time to finally push out some HIBP stuff that's been in the wings for ages. I've just got to get through this weekend first, stay tuned for pics on social for that, it's going to be pretty epic 😎

References

1. The garage joinery is looking epic (the promised pic from just before this week's video started)
2. The Yale IoT locks are beautifully made, but the digital UX is an absolute nightmare (I'll look at doing the Zigbee and Home Assistant bits properly next week)
3. But hey, at least the doors look good! (they'll outlive the IoT by a massive order of magnitude and I suspect they'll see many different locks over the years)
4. I promised axe throwing pics! (how they serve you beer before throwing them is... curious)
5. There was a rather sizeable dump of Polish credentials (I'm not normally loading credential stuffing lists these days, but this one was a little different)
6. And then there was the RaidForums dump (you'd have to be feeling pretty uneasy if you were on there doing criminal things)
7. Sponsored by: Kolide can get your cross-platform fleet to 100% compliance. It's Zero Trust for Okta. Want to see for yourself? Book a demo.

Weekly Update 351

I spent most of this week's update on the tweaking I went through with Azure's API Management service and then using Cloudflare to stop a whole bunch of requests that really didn't need to go all the way to the origin (or at least all the way to the API gateway sitting in front of the origin Azure Function instance). I'm still blown away by how cool this is - tweak the firewall via a web UI to inspect traffic and respond differently based on a combination of headers and response codes and bam! A massive reduction in unnecessary traffic follows. That's so cool, I love cloud 😊

References

1. I couldn't help but talk about Yale smart locks again (they've been oh so painful, but I do actually have them working well now)
2. I went down a bit of a rabbit hole trying to optimise Azure's APIM service (I'm super happy with the result though, that's a whole heap of traffic I no longer need to process in Azure - thanks Cloudflare!)
3. Why no, I can't think of anything whatsoever that could go wrong by letting anyone set whatever photo they like to appear on the Apple device of the person they're calling 🤣 (if this ships consistent with my understanding of the feature, much hilarity - and scamming - will ensue)
4. Sponsored by: Kolide can get your cross-platform fleet to 100% compliance. It's Zero Trust for Okta. Want to see for yourself? Book a demo.