Troy Hunt

MARCH 1, 2018

As this service has grown, it's become an endless source of material from which I've drawn upon for conference talks, training and indeed many of my blog posts. I ran it on a coffee budget (the goal was to keep the operating costs under what a couple of cups from a cafe each day would cost) and I made it freely accessible.

Government 75

Government Passwords Data breaches Authentication 75

eSecurity Planet

APRIL 16, 2024

Compromised AI workloads: Affect the integrity of AI model results, allow for model theft, and potentially infect model training to alter future results. Hijacked compute: Repurposes expensive AI compute power for attackers’ needs, primarily cryptojacking, which mines for cryptocurrencies on stolen resources.

Cybersecurity 113

Cybersecurity Cloud Encryption Access 113

KnowBe4

JULY 5, 2023

This latest impersonation campaign makes the case for ensuring users are vigilant when interacting with the web – something accomplished through continual Security Awareness Training. Blog post with links: [link] [Live Demo] Ridiculously Easy Security Awareness Training and Phishing Old-school awareness training does not hack it anymore.

Phishing 81

Phishing Security awareness Passwords Computer and Electronics 81

The Last Watchdog

DECEMBER 14, 2023

Instead of arguing about MFA strength, VPN vendor, or nation-state treat actors, let’s finish our conversation about using dedicated administrator accounts and unique passwords. Implementation may require increased use of cloud-based security solutions and a stronger focus on user training and awareness.

Cybersecurity 235

Cybersecurity Cloud Risk Mining 235

eSecurity Planet

JULY 25, 2023

Phishing attacks: Deceptive techniques, such as fraudulent emails or websites, trick individuals into revealing sensitive information like credit card and payment information, passwords, or login credentials. Cryptojacking : Unauthorized use of a computer’s processing power to mine cryptocurrencies.

Ransomware 98

Ransomware Passwords Data breaches Access 98

ForAllSecure

APRIL 12, 2022

Should infosec now be considered vocational training just like becoming an electrician or a plumber? Or the future talent is so bad I spent 10 years working on building these programs, finding these individuals, training them and helping to get employment. Maybe you need to put some training towards them. So they're out there.

Cybersecurity 52

Cybersecurity Military IT Security 52

Troy Hunt

MAY 7, 2018

And again, we come back to the point about training people to look for negative indicators and act on those rather than to simply assume everything is fine in the presence of a positive one. For example, from that talk of mine: That's stripe.ian.sh Remember when web security was all about looking for padlocks?

Phishing 47

Phishing Security Encryption Education 47

ForAllSecure

APRIL 30, 2020

Gary McGraw is a good friend of mine and I've talked to him about software security for almost two decades now. Did someone just forgot to change the default password? Literally nobody was thinking about the consequences of having your entire home connected to the internet with default passwords and no network security in front of it.

Security 52

Security IoT Manufacturing IT 52

ForAllSecure

APRIL 30, 2020

Gary McGraw is a good friend of mine and I've talked to him about software security for almost two decades now. Did someone just forgot to change the default password? Literally nobody was thinking about the consequences of having your entire home connected to the internet with default passwords and no network security in front of it.

Security 52

Security IoT Manufacturing IT 52

ForAllSecure

APRIL 30, 2020

Gary McGraw is a good friend of mine and I've talked to him about software security for almost two decades now. Did someone just forgot to change the default password? Literally nobody was thinking about the consequences of having your entire home connected to the internet with default passwords and no network security in front of it.

Security 52

Security IoT Manufacturing IT 52

Krebs on Security

JULY 22, 2020

“can u edit that comment out, @tankska is a gaming twitter of mine and i dont want it to be on ogu :D’,” lol wrote. Twitter added that it is working with law enforcement and is rolling out additional company-wide training to guard against social engineering tactics. “just dont want my irl getting sus[pended].”

Access 287

Access Mining IT Libraries 287

ChiefTech

JULY 10, 2008

Mine was: Boffo. The more subtle points of user-centered design or goal-driven design are not discussed explicitly; only the trained ear will detect them. You know the ones: you type in your name, choose a username, enter your email address, and your password (twice), hit the submit button…and…bad things happen.

Mining 52

Mining Marketing IT Paper 52

Troy Hunt

SEPTEMBER 17, 2020

HTTPS Still has a Long Way to Go This is such a mess it's difficult to even know where to begin, so let me just start with the easy bits then progressively unveil just what a train wreck the current state of encrypted web traffic is. If you're pregnant and hopping over to pregnancybirthbaby.org.au

Privacy 143

Privacy Phishing Encryption Security 143

ForAllSecure

MAY 13, 2022

And could you craft a message that these meters would carry across and I kind of equated it to like, freight hopping like if there's a train going down, and a you know, a hobo or something hops on this train. The train keeps going. The train isn't affected at all by this person hopping on. It's mine.

Energy and Utilities 52

Energy and Utilities Computer and Electronics IT Communications 52

eSecurity Planet

MAY 2, 2024

Compromised Credentials Compromised identities from phishing, info stealers, keyloggers, and bad password habits provide the entry point for most ransomware attacks and data breaches. 583% increase in Kerberoasting [password hash cracking] attacks. 64% of managers and higher admit to poor password practices.

Cybersecurity 70

Cybersecurity Ransomware Passwords Cloud 70

ForAllSecure

AUGUST 10, 2021

Vamosi: In 2016 I took a two day car hacking training session at BlackHat USA in Las Vegas. And they, they just didn't password protect something as simple as that, that they, if they had added a password, it would have made that a little bit more difficult honestly impossible but more difficult to to propagate that particular bug.

Manufacturing 52

Manufacturing Computer and Electronics Communications Access 52

ForAllSecure

MAY 2, 2023

You had to figure out how to configure Kermit, get passwords to get on. Mine was 2000. And then they started sending me to, you know, get training on how to formally do forensics and get all the software and all that kind of stuff. Hacker was more about the pursuit of knowledge. Daniel’s first Black HAt was in 1999.

IT 40

IT Sales Security Honeypots 40

Troy Hunt

APRIL 15, 2019

Then there was CloudPets leaking kids voices because the "smart" teddy bears that recorded them (yep, that's right) then stored those recordings in a publicly facing database with no password. Really bad ones: Guess what: a train wreck. Wearco produces "mining consumables". mSpy leaked data. We'll come back to that later.

Passwords 111

Passwords Privacy Manufacturing Access 111

ForAllSecure

MARCH 22, 2023

VAMOSI: Let’s start with the definition of the dark web as opposed to the web we use everyday, either password-protected or open. You need some form of authentication to access it that might be through a login and password or through a paywall or other sorts of authentication methods. That is your private emails.

Marketing 52

Marketing Ransomware Access IT 52