Security

I got a rather odd invoice via PayPal the other day, it looks like this: Naturally the first thing I did was to look for spoof email indicators, but none of the usual suspects were showing up: 1. It was from member@paypal.com.au 2. The mail headers were legit 3. The “View and Pay Invoice” button linked directly to https://www.paypal.com/ Which all struck me as quite odd so I tweeted it out [https://twitter.com/troyhunt/status/683386377904361472]. I suggested that it was spam because that...

I’ve had a couple of experiences recently where guests have come to stay and then requested to jump on my wifi. In each case, I’ve declined and in turn they have expressed some degree of shock and outrage. Because it will happen again and because I don’t want upset guests staying in my house, allow me to articulate clearly and objectively why my network is off limits and why perhaps you too want to think twice about allowing access to yours. It’s not that I don't trust my guests… Let’s start he...

Every now and then, a Pluralsight course completely defies the odds of what I expected it to do. Now it’s not that I don’t think this latest one [https://app.pluralsight.com/library/courses/play-by-play-ethical-hacking-troy-hunt/table-of-contents] is a good course, rather it’s that it’s a play-by-play which effectively went like this: Pluralsight: Hey, how about you hack Gary Eimerman [https://twitter.com/garyeimerman] and we record it? Me: You had me at “hack”! And that’s about it – now it’...

I suspect we’re all getting a little bit too conditioned to data breaches lately. They’re in the mainstream news on what seems like a daily basis to the point where this is the new normal. Certainly the Ashley Madison debacle [https://www.troyhunt.com/2015/08/heres-what-ashley-madison-members-have.html] took that to a whole new level, but when it comes to our identities being leaked all over the place, it’s just another day on the web. Unless it’s our children’s identities, that’s a whole new l...

In running Have I been pwned? (HIBP) [https://haveibeenpwned.com/], I often get asked – “Can I trust you with my email address?” – which I find to be a very odd question. It’s odd because for the most part, we never really think about how trustworthy a website is before we enter the address. What I mean by this is that we all sign up for dozens if not hundreds of services ranging from shopping to social to professional and enter a whole heap of data, including our email address all the time. We...

So someone sent me this on the weekend: They asked me to censor the Bitcoin address because as you can see above, it’s unique to them and quite understandably, they don’t want anything that can tie this blackmail attempt back to them going public. Except that the address is a perfect match with this one: > Looks like some people are attempting to capitalize on the @Patreon [https://twitter.com/Patreon] hack/leak. @Troyhunt [https://twitter.com/troyhunt]. Kinda funny to me. pic.twitter.com/8...

I did a security workshop in a faraway land recently. I’ll not say which one because I want to ensure there’s an appropriate level of anonymity for this story as it could be rather inconvenient for the subject of it otherwise. Anyway, I do my usual thing of showing attendees how to hack their own things. We do SQL injection and XSS and a whole bunch of other really hands on stuff targeted at developers. The niche I find myself filling these days is security content that talks to folks who actua...

As I wrote recently, somehow I have found myself over in Europe at the cold end of the season [https://www.troyhunt.com/2015/10/troys-uk-and-bit-of-norway-tour-dates.html] , including in Oslo which as I understand it is both cold and dark in Jan. But the invite to do what I‘m doing was just too tempting to say no so let me outline it here for those who may be able to get along. Hack Yourself First Workshop: Wed 20 and Thu 21 Jan I’ve written about this workshop many times before in various pl...

If you’re reading this, it’s possible I directed you here with little more than a mere URL in my reply to you. It’s likely that you asked for data that has been breached from an online system. Perhaps it was your data you asked for, perhaps it was other people’s data you were seeking but regardless, the response is the same. No, I cannot. In running Have I been pwned? [https://haveibeenpwned.com/] (HIBP) I obviously come across a lot of data breaches with a lot of sensitive data. I understand t...

It’s a bit hard to even know where to begin with this one, perhaps at the start and then I’ll try and piece all the bits together as best I can. As you may already know if you’re familiar with this blog, I run the service Have I been pwned? [https://haveibeenpwned.com/] (HIBP) which allows people to discover where their personal data has been compromised on the web. When a breach hits the public airwaves, I load in the email addresses and those who subscribe to the service (it’s free) get noti...