Cybersecurity researcher: I found that Flock did not require their clients to use multi-factor authentication. This led me to find Flock law enforcement accounts for sale by a Russian vendor on a dark web marketplace. In addition to this, we found insufficiently protected sensitive information stored on Flock cameras, including photos, license plate data, logs, API keys, passwords, and communications.

Some NPR podcasts started getting mysterious comments on Spotify. They made no sense to the staff reading them – until someone from a younger generation cracked the code. Hear the story: link.podtrac.com/phns92ui

We're screening for North Korean IT workers in the wrong place. Most of the advice on North Korean IT workers is about catching them in the interview. I think that's the wrong place to put most of our effort. The joint advisory four governments just put out is a good example. The hiring advice is almost entirely human: check the applicant's IP against where they say they live, call their phone number, drill the resume live, and ask about their hometown and hobbies. (Apparently "tell me about your hometown" is a security control now.) I'm not knocking any of it. Talking to a real person is still one of the better fraud checks we have. But it only works on applicants, and a laptop farm exists to beat the IP check anyway. None of it helps with the one who already passed, got the laptop, and built a normal work record. And I'd assume one already has. At @OneRSAC last year, @Mandiant's Charles Carmakal said nearly every Fortune 500 CISO he'd talked to about this problem admitted hiring at least one North Korean IT worker. I wouldn't bet on smaller shops doing better. (I'd love to be wrong on that.) The advisory does mention least privilege, in one line, next to revoking accounts once you suspect someone. Revoking only helps once somebody notices. I'd put least privilege at the center for new remote hires. Access should grow with tenure instead of arriving on day one, and you should have a tested answer for how fast you can pull it back. Pick your newest remote engineer. What could they reach, exfiltrate, administer, deploy, or monetize before anyone had a reason to wonder? I built the brand new FOR500: SANS Windows Forensic Analysis case with @HeatherMahalik Barnhart and @ovie Carroll around exactly that hire. Operation Crimson Ledger puts you on the Windows 11 laptop of a remote engineer who cleared the interview and looked normal for months: two remote-access tools, a consumer VPN, an AI coding agent with more screen time than Office, company files staged to a personal Google Drive, a mailbox exported through a second copy of Office, and a wiper run seven times in the two minutes around the upload. (Least privilege wouldn't have stopped all of it, but it would have made the trail a lot shorter.) Advisory: ic3.gov/CSA/2026/260918.pdf SecurityWeek: securityweek.com/japan-disma…

Another alternative to put antennas outside of you car - these hang on your car window, is easy to remove, use on rental cars, etc. Grab the files from here: thingiverse.com/thing:567875…

You have heard of the 24 Hours of Le Mans - now mark your calendar for the 24 Hours of HHB! We are encouraging everyone to wardrive and upload to @wiglenet during that 24 hours. Just for fun! 🎉 Saturday October 17th from 00:01 PDT to 23:59 PDT #AllTheWiFi #HHB24Wigle 1/2

Having your devices outside of your car will yield superior results in wardriving. External antennas or something like the Wiglefin work well. You still have time to make one before the 24 Hours of HHB next month. Courtesy of @thebaldgeek - thebaldgeek.github.io/wardri…