Graham Cluley

"... "I think the Mac user base will end up becoming polluted by some of the same people who have been infected time and time again in the Windows environment,” Mr Cluley says. “It's mainly the same people who buy a computer primarily to download porn and visit file-sharing sites." ..." quote from security specialist ~ http://www.grahamcluley.com "... 'I think Apple will start to become a victim of its own success. I think hackers will see this community as a soft target.' The particularly craven hackers, phishing fraudsters and malware writers ply the trade for cash, not kicks. They follow the big fish, looking to infiltrate victims' ..." The article author ~ http://www.bernhardwarner.com/about.html It's always a good idea to get a picture of who writes this tripe - It's "crackers" not "hackers". Misuse of the term makes the title misleading.

I wouldn't be surprised if that happens regularly. There's lots of insecure code on SO, either because it was written in an insecure way or best practices changed (like md5 hashing passwords). https://grahamcluley.com/take-care-copy-pasting-code-stack-overflow/

I check this every week: https://www.zdnet.com/blog/security/ Don't be put off that it's ZDNet, they monitor the infosec landscape really well. The only personal blog that covers infosec, similar to Krebs is Graham Cluley, but it's usually watered down language explained in simple terms: https://grahamcluley.com/

NIST stopped recommending forced/regular password changes a few years ago. There are probably better citations but this is the first I found: https://grahamcluley.com/new-nist-guidelines-do-away-with-periodic-pas…

I agree. Part of what I'm pointing out is that AOL's user base has decreased so much that something that would be newsworthy about 6 years ago, isn't newsworthy at all today. I think this is even odder, because there are still high-profile hacks of AOL accounts. A good example of this is when the director of the CIA had his account hacked. https://www.grahamcluley.com/2015/10/cia-boss-personal-email-account-h…

To say that the "Chinese government" is involved I think understates the situation. We know as fact that their army has invested considerable time and money in a cyberwarfare unit. And that the company that operates the Firewall is a military contractor. When Sony was hacked a few months ago, the media couldn't wait to label it a "terrorist act" by North Korea. I just now searched Google News for "github terrorism". 1. http://www.itpro.co.uk/security/24319/github-falls-victim-to-possible-… 2. https://grahamcluley.com/2015/03/github-ddos-attack/ That's all, even though the evidence appears more clear that the Chinese government is involved. Whereas North Korea's responsibility was in doubt. The silence speaks volumes. But is "terrorism" even the correct word for this? When Saddam invaded Kuwait, was that a terrorist act? Consider this quote written by a Chinese military analyst 30 years ago: those who take part in information war are not all soldiers. Anybody who understands computers may become a "fighter" on the network. Think tanks composed of non-governmental experts may take part in decision-making; rapid mobilization will not just be directed to young people; information- related industries and domains will be the first to be mobilized and enter the war.. (From http://fmso.leavenworth.army.mil/documents/chinarma.htm) However, the Chinese may respond by claiming this was a preemptive defense. That GreatFire.com was designed to…

https://grahamcluley.com/shouldnt-gmail-zip-files-password-infected/ Its been a while so i had trouble finding it (but Grok obliged) Moreover its always the edge cases that people are 'OK' with, but again if they can do it (setup the infrastructure) for one thing they can do it for anything, and it makes 'trusting' them seem naive. Since trusting was the original statement.

It's been a long time since I've been into this, so my tastes might have changed. But my favorites were: Photopia, 9:05, and I-0 by Adam Cadre The Enchanter trilogy. My first introduction to Enchanter was actually this unofficial sequel: https://ifdb.org/viewgame?id=x6ne0bbd2oqm6h3a, which I loved. Slouching Toward Bedlam: https://en.wikipedia.org/wiki/Slouching_Towards_Bedlam If you like Zork, "Janitor" will make you laugh: https://ifdb.org/viewgame?id=utic1iedvvnnsf3a Also have very fund memories of Humbug and Jacaranda Jim (wow it took me a very long internet search to find the names.. I forgot almost everything about what those games were about, and all I had to go on is that they were DOS executables and that the author was some anti-virus author). https://grahamcluley.com/misc/jacaranda-jim/ https://grahamcluley.com/misc/humbug/

But as noted in an article published 16 minutes earlier by the same person on the same blog, Fortinet did say something. https://grahamcluley.com/tooth-be-told-toothbrush-ddos-attack-claim-wa…

You can't make this optional because they will be "taught" how to do it by the likes of Epic and Facebook. If its available people will be exploited. Has already happened: https://grahamcluley.com/android-security-fortnite/

but be aware that Wacom drivers sent logs of every program you open to Google and Wacom with an opt-out policy that resets on every update: https://grahamcluley.com/wacom-drawing-tablet-spying/

Of course they do. See also: https://grahamcluley.com/facebook-suffers-a-data-breach-about-how-its-… Submitted here: https://news.ycombinator.com/item?id=26877012

Yes. A news search points to last July when many social media/tech orgs decided to switch from whitelist/blacklist to allowlist/denylist. see https://grahamcluley.com/blacklist-whitelist-terminology/ I would've gone with yeslist/nolist - due to being shorter in writing and speech.

I don't think this is a thing for two reasons : * firstly, not many people outside the security world knows that bugs are a valuable commodity for attackers. Same thing with internal orgs diagrams which are something you can sell to economic intelligence firms. * secondly, top-tier orgs like FAANG usually peppers a lot of telemetry around known bugs in production code in order to see if someone isn't exploiting them (or simply to better track down the root cause). That being said, attackers are reaaaaaally interested in getting access to internal bug trackers : https://grahamcluley.com/microsoft-bug-tracking-hack/

Sure hope it is actual hardwired, and not hardware with an updatable firmware chip controlling the LED like apple used to do. https://grahamcluley.com/webcam-spying-without-turning-led-researchers…

As others have mentioned, there is speculation about coercion from a certain 3 letter agency. Some have even suggested that the maintainers of TC left an encoded message to users: > Using TrueCrypt is not secure as it may contain unfixed security issues. Not Secure As. Whether this holds any weight, only the maintainers would know. More info: https://grahamcluley.com/truecrypt-hidden-message/

Could be worse. They might write it on a flipboard next to a window. https://grahamcluley.com/plymouth-passport-offices-pitiful-password-pr…

> We got a big LG 'smart' TV a year or so ago, and we use it for exactly four things: youtube, netflix, xbox and (primarily) to watch content I put on USB sticks. Are you okay with the content you watch, and the filenames on the USB sticks being sent back to LG? https://grahamcluley.com/lg-smart-tv-can-spy/

https://www.grahamcluley.com/magic-crystals-viruses/ And this hilarious video: https://www.youtube.com/watch?v=-MM0Z_jCrGo

Please reread Someone1234’s comment. In my words: Nest devices had security issues in the past [1]. It’s very likely that they still have issues today (like most software). Once a hacker gains enough control of the device she can turn off the led because it’s software controlled[2]. [1] https://gizmodo.com/this-nest-security-flaw-is-remarkably-dumb-1793524… [2] https://www.grahamcluley.com/webcam-spying-without-turning-led-researc…

news has been out about facebook seeking access to medical records for a while now https://www.grahamcluley.com/facebooks-secret-plan-to-access-hospital-…

> because users OK all that when they sign up Reminds me of the "Facebook Security Simulator" game that was made around that time - https://www.grahamcluley.com/facebook-security-simulator/ and the term "privacy zuckering" was invented round about then to describe this UX dark pattern - https://darkpatterns.org/types-of-dark-pattern/privacy-zuckering So while Facebook may be on safe ground here _legally_ there was still an obvious train crash coming back then; when users they tricked into sharing everything find out what they actually agreed to

Absolutely: https://www.grahamcluley.com/2013/12/webcam-spying-without-turning-led…

>The only way that the NSA could be actively making systems less secure would be if they were putting vulnerabilities into the source code or silicon. I just wanted to point out that the NSA does that.[1][2] [1]http://www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-… [2]https://www.grahamcluley.com/2013/12/nsa-bribe-rsa-encryption/

Here's some good ones: * http://joelonsoftware.com/ * https://blog.codinghorror.com/ * http://joelonsoftware.com/ * http://martinfowler.com/ * http://www.hanselman.com/ * https://www.grahamcluley.com/

> My only audio recording device is my webcam and it is incapable of being in use without the light being on as far as I am aware. You assume that the light isn't controlled by the same software, that's not always the case, the FBI has admitted this. https://grahamcluley.com/2013/12/webcam-spying-without-turning-led-res… I take the view that anything under software control or the control of a chip I can't open is suspect, I've taped the webcam on laptops and physically disconnected built in microphones (I use a headset, built in ones suck). I'm not really happy about my Nexus 4 at all either, I think my next phone will be a dumb mobile. The sad thing is that I try to avoid paranoia with this stuff but the threat landscape is so large it's practically a full time job staying up to date with whats going on.

it's a joke: http://grahamcluley.com/2013/09/page-46-apples-new-ios-agreement-funny…

The news "leaked" a bit early. http://grahamcluley.com/2014/05/change-ebay-password/

I believe some important documents were accessed via this loophole - http://grahamcluley.com/2014/05/dropbox-vulnerability-privacy/