Weekly Update 387
It’s a short video this week after a few days in Sydney doing both NDC and the Azure user group. For the most part, I spoke about the same things as I did at NDC Security in Oslo last month… except that since then we’ve had
Author Archives: Troy Hunt
Weekly Update 386
Somehow, an hour and a half went by in the blink of an eye this week. The Spoutible incident just has so many interesting aspects to it: loads of data that should never be returned publicly, awesome response time to the disclosure, lacklustre transparency in their disclosure, some really fundamental
How Spoutible’s Leaky API Spurted out a Deluge of Personal Data
Ever hear one of those stories where as it unravels, you lean in ever closer and mutter “No way! No way! NO WAY!” This one, as far as infosec stories go, had me leaning and muttering like never before. Here goes:
Last week, someone reached it to me
Continue reading How Spoutible’s Leaky API Spurted out a Deluge of Personal Data
Weekly Update 385
I told ya so. Right from the beginning, it was pretty obvious what “MOAB” was probably going to be and sure enough, this tweet came true:
Interesting find by @MayhemDayOne, wonder if it was from a shady breach search service (we’ve seen a bunch shut down
The Data Breach “Personal Stash” Ecosystem
I’ve always thought of it a bit like baseball cards; a kid has a card of this one player that another kid is keen on, and that kid has a card the first one wants so they make a trade. They both have a bunch of cards they&
Weekly Update 384
I spent longer than I expected talking about Trello this week, in part because I don’t feel the narrative they presented properly acknowledges their responsibility for the incident and in part because I think the impact of scraping in general is misunderstood. I suspect many of us are
Weekly Update 383
They’re an odd thing, credential lists. Whether they’re from a stealer as in this week’s Naz.API incident, or just aggregated from multiple data breaches (which is also in Naz.API), I inevitably get some backlash after loading them: “this doesn’t
Inside the Massive Naz.API Credential Stuffing List
It feels like not a week goes by without someone sending me yet another credential stuffing list. It’s usually something to the effect of “hey, have you seen the Spotify breach”, to which I politely reply with a link to my old No, Spotify Wasn’
Continue reading Inside the Massive Naz.API Credential Stuffing List
Weekly Update 382
Geez it’s nice to be back in Oslo! This city has such a special place in my heart for so many reasons, not least of which by virtue of being Charlotte’s home town we have so many friends and family here. Add in NDC Security this
Weekly Update 381
It’s another weekly update from the other side of the world with Scott and I in Rome as we continue a bit of downtime before hitting NDC Security in Oslo next week. This week, Scott’s sharing details of how he and Joe Tiedman registered a domain