Blocking .zip Domains

Key takeaways

Users should block .zip and .mov domains to mitigate risks associated with potential phishing attacks.
Stay updated on software vulnerabilities and regularly install updates to enhance personal cybersecurity.
Sensational headlines regarding AI may misrepresent the capabilities and risks of AI technology.
Use Brave's "Request Off The Record" feature for enhanced privacy when browsing sensitive topics.
Kerry's book serves as a comprehensive guide for individuals looking to improve their cybersecurity awareness and practices.

Summary

The Impact of New Domain Extensions

The episode discusses the implications of the introduction of two new top-level domains, .zip and .mov, which can be exploited by malicious actors to mislead users. The host explains how clever manipulations of these domains can trick even tech-savvy individuals into clicking on harmful links. Consequentially, the episode emphasizes the need for users to proactively block these domains to prevent potential threats.

Recent Security Vulnerabilities and Breaches

Kerry addresses various new and ongoing security concerns, including an iTunes update to fix a vulnerability, the revelation of significant Android malware downloads, and the serious ramifications of data breaches such as Luxottica's exposure of customer records. Each incident highlights the common vulnerabilities in widely used applications and services, stressing the importance of staying updated and vigilant about personal data security.

AI and Security: Misleading Headlines and Reality

The podcast clarifies recent sensationalized news about AI, specifically addressing a claim that an AI-controlled drone killed its operator in a simulated environment, which was later retracted. Kerry emphasizes the difference between the misconceptions surrounding AI capabilities and the reality of its current functionalities. He posits that while AI presents risks, they have been blown out of proportion by media.

New Features in Digital Tools

The Brave browser's new "Request Off The Record" feature is introduced, which enables users to visit certain sites privately without leaving traces, designed primarily for individuals needing to protect sensitive queries from unwanted scrutiny. This innovation aims to improve the safety of users browsing sensitive topics while advocating for broader application across other browsers.

The Dear Carey Segment

In this segment, a listener named Claymont asks for a comprehensive cheat sheet to improve computer security practices. Kerry recommends his own book as an extensive resource for users while also mentioning the availability of a downloadable cheat sheet to assist viewers with quick tips outlined in the book.

Tips on Blocking New Domains

The host offers valuable advice on how to block .zip and .mov domains using browser settings and filters to avoid potential security risks. This section outlines the risks associated with these domains, especially regarding their potential use by malicious parties to craft convincing and dangerous links.

Show notes

Two weeks ago, I told you about the availability of two new top-level domains that also happen to be popular file name extensions: .zip and .mov. The ambiguity will undoubtedly be exploited by ne'er-do-wells to trick people into doing something they shouldn't do. There are clever ways to manipulate website addresses that would trick even tech-savvy people into clicking malicious links. Today I'll tell you how these tricks work and explain you can avoid all of these issues by simply blocking these new domains.

In other news: iTunes for Windows patches a nasty bug; Android malware downloaded over 420 million times; Android phones vulnerable to fingerprint brute-force attacks; Luxottica exposes 300 million customer records; free VPN service SuperVPN exposes 360 million user records; Amazon gets slap on the wrist for Ring video doorbell private data access; KeePass "master password crack" not as bad as it sounds; Twitter adding Content Notes 'fact checks' to images; Microsoft now scanning inside password-protected zip files; drone pilot is NOT killed by drone; AI is NOT likely to cause human extinction; and Brave introduces new Off The Record browsing mode. Plus my Dear Carey question: recommended cheat sheet for computer safety.

Article Links

[MacRumors] PSA: If You Run Windows, Make Sure to Update iTunes to Fix Security Vulnerability https://www.macrumors.com/2023/06/01/itunes-windows-vulnerability/

[Lifehacker] This Android Malware Was Downloaded Over 420 Million Times https://lifehacker.com/this-android-malware-was-downloaded-over-420-million-ti-1850492306

[BleepingComputer] Android phones are vulnerable to fingerprint brute-force attacks https://www.bleepingcomputer.com/news/security/android-phones-are-vulnerable-to-fingerprint-brute-force-attacks/

[bitdefender.com] Luxottica 2021 breach: 300 million customer records up for grabs online https://www.bitdefender.com/blog/hotforsecurity/luxottica-2021-breach-300-million-customer-records-up-for-grabs-online/

[hackread.com] Free VPN Service SuperVPN Exposes 360 Million User Records https://www.hackread.com/free-vpn-service-supervpn-leaks-user-records/

[AppleInsider] Amazon gets slap on the wrist over privacy violations with Ring cameras https://appleinsider.com/articles/23/05/31/amazon-gets-slap-on-the-wrist-over-privacy-violations-with-ring-cameras

[Naked Security] Serious Security: That KeePass “master password crack”, and what we can learn from it https://nakedsecurity.sophos.com/2023/05/31/serious-security-that-keepass-master-password-crack-and-what-we-can-learn-from-it/

[Mashable] Twitter will now put Community Notes 'fact checks' on images https://mashable.com/article/twitter-notes-on-media-images

[Ars Technica] Microsoft is scanning the inside of password-protected zip files for malware https://arstechnica.com/information-technology/2023/05/microsoft-is-scanning-the-inside-of-password-protected-zip-files-for-malware/

[VICE] USAF Official Says He ‘Misspoke’ About AI Drone Killing Human Operator in Simulated Test https://www.vice.com/en/article/4a33gj/ai-controlled-drone-goes-rogue-kills-human-operator-in-usaf-simulated-test

[Schneier Blog] On the Catastrophic Risk of AI https://www.schneier.com/blog/archives/2023/06/on-the-catastrophic-risk-of-ai.html

[brave.com] Request "Off the Record" https://brave.com/privacy-updates/26-request-off-the-record/

Tip of the Week: Blocking .zip Domains: https://firewallsdontstopdragons.com/how-to-block-the-new-zip-domain/

Further Info

How to send files securely: https://firewallsdontstopdragons.com/how-to-send-files-securely-like-tax-info/

Checklist of Tips for my book: https://firewallsdontstopdragons.com/wp-content/uploads/2023/02/FDSDv5-workbook-v1.pdf

10 Years After Snowden: https://www.eff.org/deeplinks/2023/05/10-years-after-snowden-some-things-are-better-some-were-still-fighting

The Wayback Machine: https://web.archive.org/

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch

Give the gift of privacy and security: https://fdsd.me/coupons

Send me your questions! https://fdsd.me/qna

Support our mission! https://fdsd.me/support

Subscribe to the newsletter: https://fdsd.me/newsletter

Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book

Generate secure passphrases! https://d20key.com/#/

Table of Contents

Use these timestamps to jump to a particular section of the show.

0:01:27: DEF CON update

0:02:40: News preview

0:04:59: If you use iTunes on Windows, update your app soon

0:06:25: Android malware was downloaded over 420M times

0:10:29: Android phones vulnerable to fingerpint brute force attacks

0:16:59: Luxottica breach exposes 300 million records

0:20:00: Free VPN service SuperVPN exposes 360 million user records

0:24:21: Amazon gets slap on the wrist over Ring privacy violations

0:26:10: KeePass "master password crack"

0:29:59: Twitter to put Community Notes on images

0:32:48: Microsoft is scanning contents of password-protection zip files

0:37:47: AI drone did NOT kill its human operator

0:43:19: About that AI article leading to human extinction

0:50:54: Brave browser's new Off The Record feature

0:56:14: Dear Carey: cheatsheet for computer cleanup?

0:58:01: Tip of the Week: Blocking .zip domains

1:03:36: Wrap up and look ahead