Four unrelated security stories broke in the last few weeks. A researcher found that an aftermarket car alarm called KARR — installed in an estimated 2 million-plus vehicles — can be silently unlocked, disarmed, or disabled by anyone within Bluetooth range. A threat researcher at Bitsight discovered that a popular cheap streaming stick, the H96, has for years been quietly renting out its owners' internet connections and clicking fraudulent ads while posing as a mobile phone. A hacker pleaded guilty to breaches tied to over 100 million people's data, gained entry not through some clever exploit but through customer passwords that had been sitting around since an infostealer infection years earlier, on accounts that never had multi-factor authentication turned on. And researchers demonstrated that malware can, under the right conditions, extract passkeys synced through Google Password Manager — the very system many of us adopted specifically to get away from password risk.
Read individually, these are four different categories of problem: a hardware flaw, a supply-chain fraud scheme, a corporate breach, and a cryptography implementation issue. But they share a root cause that has nothing to do with the technology involved. In every case, the vulnerable thing was installed, activated, or created once — and then nobody looked at it again.
The pattern underneath the headlines
Security debt accumulates in exactly the places you stop paying attention to. A car alarm gets bolted in during a dealer add-on package and never crosses your mind again until it's the reason your car got into someone else's hands. A streaming stick gets plugged into the TV, works fine for years, and never raises a flag because it's still playing whatever you asked it to play — the ad-fraud traffic and bandwidth-sharing happen invisibly alongside that. A login credential gets created, works for a login prompt, and then sits in a database for years after the device that leaked it is long forgotten, because rotating a password you don't think about is not a task anyone puts on a calendar. A passkey gets set up specifically to be "more secure than a password," and that reputation becomes a reason to stop thinking about what's protecting the device it lives on.
None of these required a sophisticated attacker to find some novel flaw no one anticipated. The car alarm and the passkey theft did involve real technical research. But what actually let the damage happen at scale was the gap between "set up once" and "never revisited."
A 20-minute audit of things you already own
You don't need to buy anything or become a different kind of person to close most of this gap. You need one pass through the categories above, treated as a recurring chore rather than a one-time setup task.
1. Aftermarket and add-on devices
Walk around anything that was installed by a third party rather than built in — car alarms, dash cams, smart locks, aftermarket trackers. Check the manufacturer's app or site for a firmware update mechanism and actually run it. For the KARR alarm specifically, researchers noted that an easy visual cue is a "KARR" sticker on the driver's side window; if you have one, check with the installer or manufacturer about a patch before assuming it's fine. The broader habit worth building: anything with a radio and a manufacturer app is a device that needs occasional maintenance, the same as your phone or laptop.
2. Whatever's plugged into your TV
Generic streaming boxes sold on marketplaces with names like H96, often advertised around a one-time fee for "unlimited" content, are worth a hard look. If you own one, understand that its risk isn't just pirated content — it's that the device itself may be behaving like a second computer on your network with its own agenda. If you can't verify what a device is doing on your network, and it came from an unfamiliar brand promising something too good for the price, that's reason enough to isolate it on a guest network or replace it with a mainstream streaming device from a company that has a reputation to protect.
3. Old passwords, especially reused or dormant ones
The breach tied to the Snowflake-linked hacker's guilty plea wasn't caused by a flaw in the platform. It was caused by credentials harvested years earlier by malware on someone's computer, credentials nobody rotated, on accounts where multi-factor authentication had been switched off. That is a completely avoidable failure mode, and it's common: any account you set up once and log into rarely is exactly the kind of account that could be sitting on a leaked, years-old password right now. If your password manager offers a breach or reuse check, run it. If an account allows MFA and it's off, turn it on — this one control would have stopped the intrusion that exposed over 100 million people's records.
4. The account guarding your passkeys
Passkeys are a real improvement over passwords for the specific problem of phishing and reuse. But the recent research into stealing synced passkeys through Google Password Manager is a useful reminder that a passkey isn't magic — it inherits the security of whatever account and device it's synced through. That means the account holding your password manager or passkey sync deserves the strongest protection you have: a strong, unique passcode on the device itself, MFA on the account that does the syncing, and attention to what you install on that device, since the research relies on malware already running on the machine, not a flaw you can "patch" into passkeys themselves.
Why this is worth doing now instead of later
None of these four stories describe a threat you need to panic about today. But all four describe threats that grew for months or years precisely because nobody circled back. The fix isn't a new tool or a subscription — it's picking a recurring time, maybe alongside a habit you already have like checking your bank statement, to ask a boring question about the things you already own and already trust: when did I last check on this, and does anyone still have a reason to be watching it besides me?
