110 Fun Facts About Cybersecurity

What is the fraud of sending messages posing as a trusted sender to trick people into revealing passwords called?

Phishing takes its 'ph' spelling from phreaking, the older hobby of hacking phone systems; the word was first recorded in AOHell, a 1995 AOL cracking toolkit.

Malware that encrypts a victim's files and demands payment for the key is called what?

Ransomware dates to the 1989 AIDS Trojan, which scrambled file names on victims' PCs and demanded $189 be mailed to a post-office box in Panama; its weak symmetric cipher was soon reversed.

The 'CIA triad' at the heart of information security stands for confidentiality, integrity and what?

Availability, the third leg of the CIA triad, means legitimate users can reach their data when they need it; the acronym has nothing to do with the US intelligence agency.

A software flaw exploited by attackers before the vendor even knows it exists is called what?

Zero-day counts the days the vendor has had to fix it, which at the moment of discovery is none.

In cybersecurity, a decoy system set up to attract attackers and study them is known as what?

A honeypot makes suspicion automatic: no legitimate user has a reason to touch it, so anything that does is an attacker.

Multi-factor authentication requires how many distinct types of evidence before granting access?

Multi-factor authentication demands two or more distinct factor types: something you know (a password), something you have (a phone or key) and something you are (a fingerprint).

Malware that disguises itself as a normal program to mislead users is named after what?

Trojan-horse malware is named after the hollow wooden horse of Greek myth that smuggled Greek soldiers inside the walls of Troy; the computing sense dates from the early 1970s.

Manipulating people psychologically into divulging information or taking unsafe actions is called what?

Social engineering attacks the person rather than the machine; its sub-genres include pretexting (an invented scenario), baiting (a tempting USB stick) and tailgating through a secure door.

Which networking term, borrowed from building construction, names a system that filters traffic between networks?

Firewall originally meant a wall that confines a fire within a row of buildings; the word jumped to networking in the 1980s.

A computer that is physically isolated from the internet and other unsecured networks is said to be what?

An air-gapped computer has no network connection at all, so data must move by hand on removable media; an infected USB stick is how Stuxnet crossed the gap into Iran's enrichment plant.

An analyst at which research firm named the 'never trust, always verify' model 'Zero Trust' in 2010?

Forrester analyst John Kindervag coined 'Zero Trust' in a 2010 report; the model gained ground as cloud and mobile use dissolved the old network perimeter.

What is generally considered the first computer worm, a 1971 program on ARPANET?

It printed 'I'M THE CREEPER: CATCH ME IF YOU CAN', and a program called Reaper was written to hunt it down, making Reaper the first antivirus.

The Morris worm of 2 November 1988 was written by a graduate student at which university?

Robert Tappan Morris was a Cornell graduate student who launched the worm from MIT to disguise its origin; his was the first felony conviction under the 1986 Computer Fraud and Abuse Act.

What sentence did Robert Tappan Morris receive for releasing the 1988 internet worm?

Morris received three years' probation, 400 hours of community service and a $10,050 fine; the appeals court put the clean-up cost per site at anywhere from $200 to over $53,000.

The ILOVEYOU worm of May 2000 was written by a college dropout from which country?

Onel de Guzman, a computer-college dropout from Manila in the Philippines, had all charges dropped because the Philippines had no law against hacking at the time.

Which 1999 virus spread via infected Word documents emailed to a victim's first 50 contacts?

Melissa, released by David L. Smith on 26 March 1999, arrived as a Word attachment innocuously named list.doc and mailed itself to the first 50 addresses in each victim's Outlook address book.

Elk Cloner, an early 'in the wild' virus written by a 15-year-old around 1982, targeted which computer?

Rich Skrenta wrote Elk Cloner for the Apple II as a prank and spread it on game floppies; every 50th boot it displayed a short poem.

Brain, considered the first virus for the IBM PC, was written in 1986 by two brothers in which city?

Basit and Amjad Farooq Alvi ran a computer shop in Lahore, Pakistan, and embedded their names, address and phone numbers in Brain's code; they were reportedly swamped with calls.

Stuxnet, uncovered in 2010, is believed to have destroyed nuclear centrifuges at which Iranian facility?

Stuxnet hijacked the Siemens controllers running Natanz's enrichment centrifuges and reportedly wrecked almost a fifth of Iran's centrifuges by spinning them outside their safe range.

The joint US-Israeli effort that reportedly built Stuxnet is known by what code name?

Operation Olympic Games was revealed by New York Times reporter David Sanger in 2012 as a programme begun under George W. Bush and expanded under Barack Obama.

The May 2017 WannaCry attack spread using EternalBlue, an exploit originally developed by which agency?

EternalBlue was built by the NSA and leaked by the Shadow Brokers in April 2017, a month before WannaCry; the US and Britain later blamed North Korea for the attack itself.

WannaCry was halted within hours when researcher Marcus Hutchins did what?

The malware checked whether an unregistered web address existed before running; once he bought it, new infections stopped.

Heartbleed, disclosed in April 2014, was a bug in which widely used cryptography library?

Heartbleed was a missing bounds check in OpenSSL's TLS heartbeat extension (CVE-2014-0160) that let anyone read up to 64 KB of a server's memory per request; it arrived with its own logo.

The 2017 Equifax breach exposed private records of roughly how many Americans?

An unpatched Apache Struts flaw let attackers in, and the US later indicted members of China's People's Liberation Army.

The 2020 supply-chain attack on US government agencies came through which SolarWinds product?

The attackers slipped a backdoor into updates of SolarWinds' Orion network-monitoring platform; fewer than 18,000 of its 33,000 customers installed the tainted build, and the SVR-linked group Cozy Bear was blamed.

Which group was identified by the FBI as responsible for the May 2021 Colonial Pipeline extortion attack?

The FBI named the DarkSide ransomware gang on 10 May 2021; Colonial paid 75 bitcoin, about $4.4 million, within hours, and panic buying then emptied filling stations across the Southeast.

The 2013 Yahoo breach, not disclosed until 2016, affected how many user accounts?

Yahoo revised the 2013 breach in October 2017 to all 3 billion accounts, three times the 1 billion first admitted; a separate 2014 intrusion hit 500 million, and Verizon cut its purchase price by $350 million.

The 'Guardians of Peace' hackers leaked Sony Pictures data in 2014 demanding it pull which film?

The Interview, a comedy starring Seth Rogen and James Franco as a TV host and producer recruited to assassinate Kim Jong Un, was pulled from wide release before a limited Christmas Day opening in 2014.

Log4Shell, the critical December 2021 flaw, hit Log4j, a logging library for which language?

Log4j is the Apache logging library for Java; the flaw had lurked since a 2013 JNDI lookup feature, was reported by Alibaba Cloud's Chen Zhaojun, and got its 'Log4Shell' name from the LunaSec team.

NSO Group, developer of the Pegasus phone spyware, is based in which country?

NSO Group is headquartered in Herzliya, Israel, and every foreign sale of Pegasus needs an export licence from the Israeli defence ministry; the US Commerce Department blacklisted the firm in November 2021.

The 2016 Mirai malware that took down Twitter and Netflix via DNS provider Dyn infected what?

Mirai scanned for internet-of-things devices such as IP cameras and DVRs left on factory-default passwords; its creators first used it to hit Minecraft servers and run a protection racket.

In February 2009 Microsoft offered what reward for information on Conficker's author?

Microsoft posted a $250,000 bounty on 12 February 2009 for information leading to the arrest and conviction of Conficker's creators; the worm had already infected millions of Windows PCs via the MS08-067 flaw.

Kevin Mitnick, once the FBI's most-wanted hacker, was arrested in February 1995 in which city?

The FBI arrested Mitnick in his Raleigh, North Carolina apartment on 15 February 1995 after Tsutomu Shimomura helped track him down; Shimomura co-wrote Takedown about the chase, and Mitnick spent five years in prison.

John Draper's toy cereal-box whistle, source of his 'Captain Crunch' nickname, produced which tone?

The Cap'n Crunch whistle blew 2600 Hz, the tone AT&T's long-distance network used to signal an idle trunk line, so the whistle could seize a line and unlock free calls.

Which British agency had secretly developed an RSA equivalent four years before its 1977 publication?

At GCHQ, Clifford Cocks wrote down the RSA scheme in 1973, building on James Ellis's 'non-secret encryption'; it stayed classified until 1997, so Rivest, Shamir and Adleman got the credit and the name.

The Advanced Encryption Standard adopted by NIST in 2001 was originally called what?

Rijndael, a blend of its designers' names, was submitted by Belgian cryptographers Joan Daemen and Vincent Rijmen and beat Serpent and Twofish in the NIST competition; AES uses 128, 192 or 256-bit keys.

Which 1976 paper introduced public and private key pairs, letting strangers agree a secret over an open channel?

Whitfield Diffie and Martin Hellman's 'New Directions in Cryptography' (1976) introduced public-key cryptography; Ralph Merkle conceived the idea independently, and GCHQ's Malcolm Williamson had found the exchange in secret in 1974.

Which substitution cipher shifts each letter a fixed number of places down the alphabet?

The Caesar cipher is named for Julius Caesar, who shifted letters by three in private correspondence, as Suetonius recorded; its 13-place variant ROT13 is its best-known descendant.

Who first broke the German Enigma machine's message keys, in December 1932?

Marian Rejewski used permutation theory and French-supplied documents to reconstruct Enigma in December 1932; in July 1939 the Poles handed replicas and methods to British and French intelligence, weeks before the war began.

What was the first programmable electronic digital computer, used to break Lorenz ciphers at Bletchley Park?

Colossus, designed by Post Office engineer Tommy Flowers at Dollis Hill and run at Bletchley Park from February 1944, used about 1,600 valves to break the German Lorenz 'Tunny' teleprinter cipher.

CTSS, the first computer system to require a login password, debuted in 1961 at which institution?

CTSS was built at MIT's Computation Center under Fernando Corbató; its LOGIN command asked for a password, and in 1962 a PhD student simply printed the password file to steal extra machine time.

Who coined the term 'computer virus', which his student Fred Cohen then used in a 1984 paper?

Leonard Adleman, Cohen's doctoral adviser at USC, suggested the name 'virus' for Cohen's 1983 self-replicating experiment; Adleman is also the 'A' in RSA encryption.

In the 1970s the Soviets planted keyloggers in the US Embassy in Moscow, hidden inside what?

The Selectric bug hid inside the typewriter's frame and used magnetometers to sense the print ball's movement, radioing every keystroke; NSA's Project GUNMAN found the bugged IBM Selectric typewriters in 1984.

Which company coined 'bug bounty' in 1995 with a programme for its Navigator 2.0 beta?

Netscape's 'Bugs Bounty', announced in October 1995 for the Navigator 2.0 beta, paid cash and merchandise for reported flaws; the US government's first, 'Hack the Pentagon', came in 2016.

In which city was the first DEF CON hacker convention held in 1993?

Jeff Moss, then 18, organised the first DEF CON at the Sands Hotel in Las Vegas in 1993, originally planned as a farewell party for a hacker friend.

The hacktivist collective Anonymous, known for Guy Fawkes masks, originated in 2003 on which website?

Anonymous grew out of 4chan's /b/ board, where posts without a name default to 'Anonymous'; its best-known early campaign, 2008's Project Chanology, targeted the Church of Scientology.

What does the acronym CAPTCHA stand for?

CAPTCHA expands to Completely Automated Public Turing test to tell Computers and Humans Apart; Luis von Ahn and colleagues at Carnegie Mellon coined it in 2003, and von Ahn later founded reCAPTCHA and Duolingo.

GDPR fines for the worst breaches can reach €20 million or what share of a company's worldwide annual turnover, whichever is greater?

4% is the top tier; even failing to appoint an EU representative can cost €10 million or 2%.

CISA, the US cyber-infrastructure agency, sits within which federal department?

CISA is part of the Department of Homeland Security; it grew out of DHS's National Protection and Programs Directorate and was renamed by an act signed in November 2018.

In which month is Cybersecurity Awareness Month observed in the United States?

October has been Cybersecurity Awareness Month in the US since 2004, launched by the Department of Homeland Security and the National Cyber Security Alliance; Europe and Australia use the same month.

Who created the breach-checking site Have I Been Pwned in December 2013?

Troy Hunt, an Australian security researcher, launched Have I Been Pwned on 4 December 2013; the main catalyst was the Adobe breach of 153 million accounts two months earlier.

The Wi-Fi Alliance introduced WPA in 2003 to replace which badly broken wireless security standard?

WEP, whose name promised 'Wired Equivalent Privacy', ran RC4 with 24-bit initialisation vectors that repeated, and the 2001 Fluhrer–Mantin–Shamir attack recovered its keys; WPA's TKIP was the stopgap fix.

The Tor network's core technique, developed at the US Naval Research Lab, is called what?

Onion routing, invented at the US Naval Research Laboratory in the mid-1990s by Paul Syverson, Michael Reed and David Goldschlag, wraps traffic in nested encryption that each relay peels off one layer at a time.

SQL injection is sometimes nicknamed 'Bobby Tables' after a strip from which webcomic?

xkcd strip 327, 'Exploits of a Mom', has a mother naming her son Robert'); DROP TABLE Students;-- and hoping the school has sanitised its database inputs.

In WarGames (1983), a teenager dials into a NORAD supercomputer known by which acronym?

WOPR, the War Operation Plan Response computer, is pronounced 'whopper'; it also answers to Joshua, and it learns futility by playing tic-tac-toe against itself.

Who created Mr. Robot, the USA Network series starring Rami Malek as hacker Elliot Alderson?

Sam Esmail's show was praised by security professionals for using real tools and realistic attacks rather than Hollywood typing.

In the 1995 film Hackers, Jonny Lee Miller's Dade Murphy was banned from computers at 11 under what handle?

Zero Cool had crashed 1,507 systems and caused a seven-point drop in the stock exchange; Angelina Jolie played his rival.

The 2018 Facebook data scandal that shut down Cambridge Analytica concerned harvesting user profiles for what kind of work?

Political consulting was the British firm's business; formerly SCL USA, it lost CEO Alexander Nix and closed the same year.

A network of compromised computers controlled remotely to send spam or launch attacks is called what?

A botnet ('robot network') is herded from a command-and-control server; Conficker enslaved millions of Windows PCs in 2008–09, and Mirai's infected cameras and routers peaked at about 600,000 in 2016.

Which December 2013 retail breach exposed data on up to 110 million customers?

Target's point-of-sale systems were seeded with card-skimming malware via a heating contractor's stolen credentials; 40 million card numbers and 70 million customer records were taken, and CEO Gregg Steinhafel resigned in May 2014.

Which US vice president had his heart implant's wireless link disabled for fear assassins could hack it?

Dick Cheney's doctor made the change to his defibrillator in 2007. Cheney later called a Homeland plot built on the same idea 'an accurate portrayal of what was possible'.

Hackers once stole a casino's high-roller database through a smart thermometer in which lobby feature?

Fish tank sensors gave the intruders their way in: Darktrace's Nicole Eagan said they found the database and pulled it 'out the thermostat, and up to the cloud'.

Cloudflare keeps a wall of which retro novelty items in its office lobby as a source of random numbers?

Lava lamps work because their warm wax blobs ooze in chaotic patterns nobody can predict. Silicon Graphics devised the idea in 1996 under the name Lavarand.

'White hat' and 'black hat' hackers take their labels from the heroes and villains of which film genre?

Westerns typically dressed the 'good guys' in white hats and the 'bad guys' in black ones, a costume shorthand that hackers borrowed decades later.

Junk email is called 'spam' after a 1970 café sketch by which British comedy troupe?

Monty Python's sketch has Vikings drowning out a café by chanting 'Spam', much as junk messages bury real ones. The earliest known spam email went to hundreds of ARPANET users in 1978.

In the early 1970s, Steve Wozniak and Steve Jobs sold illegal 'blue boxes' that let buyers do what?

Make free phone calls is exactly what the boxes did, by imitating the telephone network's own control tones. Wozniak once used his to ring the Vatican posing as Henry Kissinger.

A virus feared in 1992 for wiping hard disks every 6 March was named after which artist born that day?

Michelangelo was predicted to hit millions of PCs, but when 6 March 1992 came only 10,000 to 20,000 cases of data loss were reported.

Which intelligence contractor flew to Hong Kong in 2013 and gave journalists classified US surveillance files?

Edward Snowden then spent 39 days in a Moscow airport before being granted asylum, and he became a Russian citizen in 2022.

Scottish hacker Gary McKinnon said he broke into US military and NASA computers looking for evidence of what?

UFOs and suppressed 'free energy' technology were what he claimed to be hunting. US prosecutors called it the biggest military computer hack of all time, but Britain blocked his extradition in 2012.

Which 2010 documentary gave its name to luring someone into a relationship with a fake online persona?

Catfish took its title from a tale told on camera: fishermen supposedly shipped catfish alongside live cod to keep them active, as an impostor keeps people on their toes.

Advance-fee email scams are nicknamed '419' fraud after a section of which country's criminal code?

Nigeria's Criminal Code deals with fraud in section 419, but the con is far older than email: it updates the 'Spanish Prisoner' letter scam, known since at least the early 19th century.

Which antivirus pioneer, wanted for questioning in Belize in 2012, died in a prison cell near Barcelona in 2021?

John McAfee founded the antivirus company that bears his name in 1987, then resigned in 1994 and sold his remaining stake.

Which heroine of Stieg Larsson's Millennium novels is a hacker known online by the pseudonym 'Wasp'?

Lisbeth Salander was Larsson's idea of how Pippi Longstocking might have turned out as an adult, and her hacker alias matches the wasp tattooed on her neck.

Who hacked as a teenager under the handle 'Mendax' and went on to found a whistleblowing website in 2006?

Julian Assange took 'Mendax' from the poet Horace's phrase splendide mendax, 'nobly untruthful'. His site, WikiLeaks, posted its first leak in December 2006.

Security researchers run suspicious programs in an isolated environment named after which children's play area?

Sandbox is the name because, as in the play area, whatever is inside can build, destroy and experiment without causing any real-world damage.

Which name does Chrome give its private browsing mode, which stops the browser storing history on the device?

Incognito mode keeps history, cookies and form entries off the device, but it is a common misconception that it stops websites or internet providers from tracking a user.

Microsoft has bundled its monthly security fixes since 2003 into a release day nicknamed 'Patch' what?

Tuesday, the second of each month, gives administrators a date to prepare for. The day after is nicknamed 'Exploit Wednesday', when attacks on still-unpatched machines may appear.

Which country is widely blamed for the Lazarus Group, the hackers linked to the 2016 Bangladesh Bank heist?

North Korea's alleged hackers tried to move close to $1 billion, but a misspelling of 'foundation' as 'fandation' raised suspicion and most of the transfers were blocked.

The 2001 Code Red worm got its name from a flavour of which soft drink its discoverers were drinking?

Mountain Dew Code Red was what the eEye Digital Security researchers had to hand when they found the worm. A fix for the flaw it used had been available for a month.

A fake Wi-Fi hotspot that copies a real network's name to eavesdrop on users is called an evil what?

Twin fits because the fake hotspot can carry the same network name as the real one; some just collect a username and password, then claim the service is temporarily unavailable.

Which ex-Soviet republic was hit by a wave of cyberattacks in 2007 after moving a Soviet-era war memorial?

Estonia saw the websites of its parliament, banks and newspapers attacked after it moved the Bronze Soldier statue, and a NATO cyber defence centre opened in Tallinn the following year.

The 1987 hijacking of Chicago stations WGN and WTTW showed a person in a mask of which fictional character?

Max Headroom's impersonator cut into a nightly newscast and, two hours later, an episode of Doctor Who. Nobody was ever identified as responsible.

In 1903 magician Nevil Maskelyne hacked a demonstration of which inventor's supposedly private wireless telegraph?

Guglielmo Marconi had promised 'secure and private communication', so Maskelyne broke in with a broadcast of his own to make that claim look foolish.

Since a 1978 paper by RSA's inventors, cryptographers have explained their schemes using which fictional pair?

Alice and Bob replaced the bare labels A and B, because a message sent 'from Bob to Alice' is easier to follow than one sent 'from B to A'.

The 2005 Samy worm pasted 'but most of all, samy is my hero' onto a million profiles on which site?

MySpace saw the worm reach over a million users within 20 hours, then the fastest spread of any virus. It did little beyond sending its author, Samy Kamkar, a friend request.

Which chip flaw, disclosed alongside Meltdown in 2018, leaks data by abusing the way processors guess ahead?

Spectre is named after its root cause, speculative execution, the guess-ahead shortcut that speeds up modern chips. Intel said it would redesign its processors in response.

Which ride-hailing firm paid hackers $100,000 in 2016 to keep quiet a breach affecting 57 million users?

Uber dressed the payment up as a 'bug bounty' reward, and its security chief Joe Sullivan was convicted in 2022 for his part in the cover-up.

Which dating website did a group calling itself 'The Impact Team' breach in 2015, threatening to expose its users?

Ashley Madison, billed as a site for extramarital affairs, had promised its members secrecy. The hackers demanded that its parent company shut the site down.

Which gaming service went dark for over three weeks in 2011 after a breach of some 77 million accounts?

PlayStation Network's shutdown, then the longest in its history, locked PlayStation 3 and PSP owners out of online play, and Sony made amends with a 'Welcome Back' package of free games.

Which company announced it would stop censoring Chinese search results after the 2009 'Operation Aurora' hacks?

Google revealed the break-in on its own blog in January 2010, said more than 20 other companies had been hit too, and warned it might quit China altogether.

The login protocol Kerberos is named after the ferocious guard dog of Hades, a beast with three what?

Heads, three of them, belonged to Cerberus, a name also spelled Kerberos. The protocol was developed in the 1980s to protect the network services of a university scheme called Project Athena.

What does the first D stand for in DDoS, an attack that floods a website with traffic from many sources?

Distributed is the word, and it is what makes the attack hard to stop: with traffic pouring in from many machines at once, the victim struggles to identify and block them all.

Which design, used by messaging apps such as Signal, means even the service provider cannot read users' messages?

End-to-end encryption scrambles each message on the sender's own phone, so that only the intended recipients hold the means to unscramble it.

Which technique hides a message inside an ordinary-looking picture or letter rather than scrambling it?

Steganography literally means 'covered writing'. The word was first used in 1499 by Johannes Trithemius, in a treatise on hidden writing that he disguised as a book on magic.

Cryptography that uses the same shared key to both lock and unlock a message is described by which term?

Symmetric encryption has one main drawback: both parties must hold the same key before they can talk privately, a requirement that public-key encryption does away with.

Which security principle gives every user account and program only the access rights needed for the job at hand?

Least privilege is why everyday work is best done in a normal user account, opening a password-protected administrator account only when a task absolutely demands it.

Which attack steals data from a phone through a rigged public USB charging point?

Juice jacking is possible because one USB cable carries both power and data. Researchers have demonstrated it, yet as of 2023 reviews had found no credible cases outside the lab.

In computing, the '3-2-1' rule guards against fire, theft and floods by describing how to keep what?

Backups, the rule says, should run to three copies of the data on two different types of storage, with one copy kept off-site in a remote location.

Which organisation, founded in 1982 as an association of computer dealers, issues the Security+ certification?

CompTIA began life as the Association of Better Computer Dealers, or ABCD. Its entry-level A+ certificate had been earned by over a million people by 2014.

Britain's 1990 anti-hacking law followed a failed case against two men who hacked which royal's mailbox?

Prince Philip's mailbox sat on BT's Prestel service, where an engineer's account had the password '1234'. With no hacking offence on the books, the pair's forgery convictions were quashed.

Clifford Stoll exposed a hacker selling stolen data to the KGB after chasing an accounting error of what size?

75 cents of unpaid computer time at a California laboratory in 1986 was the loose thread. It led to the hacker Markus Hess, and Stoll told the story in his book The Cuckoo's Egg.

Hacker Kevin Poulsen seized a Los Angeles radio station's phone lines in 1990 to make sure he won which prize?

A Porsche 944 S2 was promised to the 102nd caller, and Poulsen made sure that was him. When Unsolved Mysteries later featured him, the show's own phone lines mysteriously crashed.

In The Matrix Reloaded, Trinity breaks into a power plant's computers using which real network scanner?

Nmap, short for Network Mapper, first appeared in 1997 as an article in the hacker magazine Phrack, with its source code printed alongside.

Which Boston hacker collective told Congress in 1998 that it could take down the internet in 30 minutes?

L0pht, pronounced 'loft', grew out of a shared loft space in South Boston, where two founders' wives ran a hat business in the other half of the room.

Which alias did Quebec's Michael Calce use when he knocked CNN, eBay and Amazon offline in February 2000?

Mafiaboy named his opening strike 'Rivolta', Italian for 'rebellion'; it shut Yahoo down for almost an hour. He later became a security expert himself.

Which search engine, launched in 2009, looks for internet-connected webcams and routers instead of web pages?

Shodan takes its name from SHODAN, a character in the System Shock video games. Its creator, John Matherly, first had the idea of searching for connected hardware in 2003.

Software flaws such as Heartbleed and Log4Shell are catalogued under IDs starting with which three letters?

CVE stands for Common Vulnerabilities and Exposures, a public list launched in 1999 to give every known flaw one identifier that all security tools can share.

Charlie Miller and Chris Valasek remotely hacked which vehicle, taking over its brakes and steering?

Jeep Cherokee owners were exposed by a weakness in Fiat Chrysler's UConnect system that let outsiders reach the steering and brakes. The company recalled 1.4 million vehicles in response.

In the 1992 film Sneakers, the black-box codename 'Setec Astronomy' turns out to be an anagram of which phrase?

Too many secrets is what Robert Redford's team of security specialists unscramble, a discovery alarming enough that they lock themselves in the office with the stolen box.

Peter Shor's 1994 algorithm worries cryptographers because a quantum computer could use it to do what quickly?

Factor large numbers fast enough and RSA can be broken, because its safety rests on that task being impractical for ordinary computers.