Firewalls Don't Stop Dragons Podcast

Today there is a thriving market for legal, for-profit smartphone spyware (aka mercenary spyware). Companies like the NSO Group are free to create and sell highly sophisticated, zero-click malware such as Pegasus which has been used to spy on dissidents, politicians, activists and journalists around the world. There are also several apps available to parents to track their children, but are often...

Connecting all our stuff to the internet – making devices “smart” – brings with it a lot of risks. Besides the more obvious cybersecurity vulnerabilities, these devices are also collecting a lot of personal data, offsetting razor thin profit margins by monetizing our data. In most cases, we can limit this data exfiltration using outbound firewalls and DNS services, or just by disconnecting the dev...

What happened to the internet? It had so much promise. Social media and search results are full of stuff we never wanted to see. Surveillance capitalism is monetizing our most private information to serve us so many ads that we can never seem to consume the actual content. And if we’re all so unhappy with the incumbents, where are the competitors offering better service? Cory Doctorow helps...

Email is old and was never built for security and privacy. Thankfully there are several modern secure email services. My personal favorite is Proton Mail and I’ll explain to you today why you should really give it a try. I will also (finally) answer several interesting “Dear Carey” questions from listeners. In other news: If you use WinRAR, you need to update right away; hackers...

There are several privacy-focused services available today. And the products we use have a dizzying array of privacy and security settings. How do you know which products you need and which vendors you can trust? How do you know which protections you need and which ones you don’t? It comes down to understanding your personal threat model. We each have different things to protect and differen...

October is national Cybersecurity Awareness Month here in the US. One of the four key themes this year is Recognizing and Reporting Phishing. We just discussed this at length with Nick Oles, but I wanted to give my perspective and tell you how to report phishing emails to the proper authorities. In other news: cheap Android TV boxes come laced with malware and fraud software; 23andMe investigating...

The weakest link in most cybersecurity systems is you – that is, human beings. And one of the primary ways that people are tricked into infecting their devices (and potentially then threatening other devices on the network) is through phishing. We’ve all seen the Nigerian Prince scams, but with AI tools like ChatGPT, scam emails are going to get a lot harder to spot. On today’s s...

Apple has just released a major update to its mobile operating system: iOS 17. There are tons of fun new features, but today I’ll walk you through some of the security and privacy enhancements. These include new protections in Lockdown Mode, the Check In feature which can alert loves ones if you fail to arrive at your destination, some privacy-enhancing web browser features, and support for...

When the New York Times broke the Clearview AI story in 2020, we suddenly had to face the reality that no one could truly be anonymous in public any more. This powerful app could take a picture of any face and find dozens of public images on the internet that they were in – even just in the background. And if those pictures were associated with a social media profile, we could identify the o...

Today I wrap up my four-part series on how to secure your home network. We’ve enumerated our devices, gotten rid of stuff we don’t need, assessed the state of our devices and now it’s time to actually remediate any vulnerabilities we found. I’ll walk you through everything you need to do. In other news: Chrome’s Topics API has rolled out (and I’ll tell you how t...

In the US today we’re dealing with a completely unfettered free-for-all of data harvesting. Without meaningful privacy regulations like the EU’s GDPR, our private information is being collected, collated, packaged and sold by data brokers to all comers. Ad companies like Google and Facebook collect and hoard our data to sell targeted ads for high profits without commensurate benefits t...

In the third part of my series on securing your home network, we’ll assess your security and privacy vulnerabilities. In prior weeks, we’ve exhaustively listed our network devices (Scan) and removed any devices that we no longer need or don’t need to be “smart” (Simplify). Now it’s time to investigate the remaining devices and think about what we need to do to s...

Unless you’ve been living under a rock, you’ve seen several news stories about AI, machine learning and so-called Large Language Models. While tools like ChatGPT hold a lot of promise, many are deeply concerned about AI replacing jobs, generating potent malware, and being used in phishing and disinformation campaigns. Today I will ask AI expert Michael Littman to explain clearly what A...

Every summer, hackers from around the US and around the globe descend on Las Vegas, Nevada, for a series of computer security conferences which are lovingly referred to as hacker summer camp. These conferences – BSides Las Vegas, BlackHat and DEF CON – run for over a week, each overlapping the other. They bring top tier security researchers, government and industry leaders, and eager h...

In the early 1980s, personal computers started entering our homes. Prior to the internet and services like America On Line (AOL), there were online bulletin board systems (BBS) where people could share text files via phone modem connections. Of course, if you wanted to connect to a BBS outside your home area code, you would have to dial long distance – which at the time could be prohibitivel...

Last time, I told you how to enumerate all the devices on your home network. Before we go to the trouble of analyzing and mitigating their vulnerabilities, we should take the opportunity to cull the inventory. Do you really need all of these devices? Or could you forego the “smart” features that require them to be connected to your network? Today we’ll talk about reducing your at...

Despite growing demand from US citizens for privacy protections, the federal government has failed repeatedly to enact basic privacy laws. However, one US state – California – has led the charge on privacy and passed regulations that have benefited people outside the state. Today I’ll speak with Ernesto Falcon who is currently running for California State Senate in District 7. He...

The Internet of Things (IoT) has added internet connections to lots of home devices. Each and every one of those devices runs software on a computer chip. Almost all software has bugs and those bugs may be exploitable by bad guys. We’re going to take another look at protecting our home networks using a simple, logical methodology. Step one: SCAN. That is, first of all, we need to understand...

After lengthy negotiations and revisions, the White House has finally released its National Cybersecurity Strategy document, outlining it’s priorities and goals. It’s a wide-ranging and ambitious document consisting of five major areas of focus, or “pillars”. What’s new here? What will it mean for businesses and critical infrastructure? And what does this mean for you...

You’re using a password manager. You’re even using two-factor authentication. Great! When done properly, this will keep the bad guys out. Unfortunately, if you’re not careful, it may also keep you out. If you forget your master password or lose access to your 2FA device, you’ll be in real trouble… unless you have an access backup plan. This same plan can also help you...

Right now there are thousands of satellites orbiting above our heads performing crucial tasks. At the end of the day, they’re just computers running software – albeit at thousands of miles up and thousands of miles per hour. Can they be hacked? What are the dangers? Aaron Myrick and the Hack-A-Sat team are trying to answer those questions. And they’re doing it by launching an act...

I launched my mission to improve people’s privacy and security almost ten years ago now. It’s been quite a journey and I’ve learned a lot in that time. One thing I’ve realized is that there’s only so much I can do on my own. And so I’ve encouraged the more technically savvy members of my audience to help others where they can. One downside to being a podcaster is that I don’t have much insight int...

At some point, when you care enough about a particular cause, you shift from following the issue to actually trying to advance the issue – to make a difference. The easiest way to do this is to find groups that are already working for this cause and supporting them with donations of your time and/or money. But what do you do if you can’t find such a group, or maybe there’s no loc...

Two weeks ago, I told you about the availability of two new top-level domains that also happen to be popular file name extensions: .zip and .mov. The ambiguity will undoubtedly be exploited by ne’er-do-wells to trick people into doing something they shouldn’t do. There are clever ways to manipulate website addresses that would trick even tech-savvy people into clicking malicious links....

Modern cars are more like smartphones on wheels. Like our cell phones, they are chock full of sensors, computer chips and software, and they’re connected to the internet 24/7 via cellular modems. What data is being collected? Who owns this data? How secure is your data? Who is it being shared with? And most importantly, what – if anything – can you do about it? Since we last spok...