Keep being skeptical

found on ELC Information Security

When it comes to scams, being skeptical is one of your best defenses. That kid doesn't believe her and nor should he.

Digging yourself into a hole

from here

Not only was Mirai made to get a leg up in Minecraft, but then when things got too hot they gave away the source code for the botnet so that anyone could use it - making the problem that much worse.

The first rule of holes is: when you find yourself in one, stop digging.

Give up your data like a good little consumer

from here

It's amazing how different the reactions are to governmental and corporate surveillance. One people will pay to avoid while the other they'll actually pay to have.

No they can't

found on Imgur

Just remember, whenever anyone says that the government can keep their secret access / backdoor / golden key / whatever they want to call it safe from the bad guys, the correct response is

NO THEY CAN'T

Someone must really like to pay

from here

So a hospital that HAS backups still pays the ransom when they get ransomware because they don't think restoring from backups will be fast enough? (see story)

If your backups aren't good enough or fast enough then you're paying for something you can't use and should find a different solution. If your backups are just fine then you shouldn't need to pay the ransom. There is no good reason to pay for both, and in so doing fund the next wave of attacks by the ransomware purveyor.

Why have backups at all if not for emergencies?

Hootercoins for everyone

from here (source article)

Kodakcoins, Whoppercoins, Hootercoins, Long Island Iced Tea Coins. Seems like the blockchain has the Midas Touch. I can't imagine the effects will be long lasting, however.

I wonder what their score is now

from here

No, seriously, how many attacks have now been attributed to the Great Dark Spot? Are the government's attribution dice loaded? Did their spinner get stuck? Does anyone remember the last time it wasn't North Korea*?

It makes you wonder two things: 1) Why have we not yet figured out how to stop them?, and 2) Why have more capable and resourceful countries not figured out how to emulate them and become even more successful at it?

(*OK, so there was that one time Russia hacked the political parties to collect dirt and try to sway the outcome of the election, but other than that?)

Who wouldn't trust Facebook to protect their privacy?

from here

The idea to have people upload their nude photos to Facebook is definitely a weird one, and the admission by Facebook's head of security that employees would actually be looking at those nudes would certainly make me think twice even if I'd forgotten about all the privacy controversies, the ethically dubious psychological experimentation, and that old quote from Mark Zuckerberg himself - "They trusted me, dumb fucks".

Not the kind of 'friendly' skies you want to fly

from here

Maybe we could fly the professional skies in stead? Or better yet, how about the polite skies? That sounds good to me.

Where'd all that banking trojan money go?

from here

I don't know about you, but I think if I were responsible for a banking trojan, especially one that managed to make it onto the authorities radar, then I'd have enough money to get my own place.

Copy&paste attribution for the copy&paste cyber threat

from here

Lately it seems like you can't swing a cat without hitting a cyber attack launched by a country that can't keep the lights on. I understand sometimes all the evidence seems to point that way, but you're talking about something that notoriously copied the tools used by one nation state, there has to be a strong suspicion that signs of other nation state's tools are also copied.

Well there's your problem

from here

I genuinely don't understand why people keep using WordPress. Whenever I hear about a vulnerability discovered in a blogging ecosystem, it's almost always WordPress. It's almost as if the potential for compromise doesn't matter in the real world.

The Social Media Idea Of Security

found on Imgur (tweeted by Nick Owen)

It's unnerving how many social media sites these days want your cell phone number in order to enable 2 factor authentication, especially right after they've suffered a breach. I'm sorry, but if you can't protect one piece of sensitive information, what makes you think I'm going to give you a second?