Tech-2 Security

2020-08-02T15:37:00.000+01:00

Privilege Access Management

It is in the Security 101 manual that end users (no matter who they are) should not have admin rights on their workstations. Certain users may be allocated an administrative account for their workstation, but this account must not have internet access or an associated email account and must not be used for normal day to day tasks. However, in general this is not a recommended approach and also has its share of problems.

The reason for this is simple, admin rights enable applications and processes to execute in the context of a privileged user which in essence means code can get installed or access the system at a low level, in many cases without the user knowing. Removing admin rights on a Windows workstation will immediately thwart somewhere in the region of 80% of current threats. It also allows the Domain administrators to take back control of their endpoints.

How often have we heard this from decision makers?

“I don’t mind users having admin rights, they know what they’re doing and don’t click stuff !”

Obviously for those of us who are in the business we know that these kinds of individuals are very hard to convince until they have to pay out tens of thousands to recover from something which could have been avoided for a few thousand pounds…Assuming a recovery is a success.

However, removing admin rights does come with its challenges.

Users are unable to install any software
Users are unable to install a software update
Users cannot manage printers
Users cannot change network settings

Plus, many more examples.

There is a solution though, and that is to implement a quality privilege access management solution which gives back the users just enough control on their machines for them to remain efficient, without breaking the security model.

For example:

Give access to printer settings allowing users to install and manage queues/
Give access to network settings for some users.
Being permitted to install and upgrade approved applications from trusted sources
Some older applications may require admin privileges to run. This can be provided whilst the user is still only a standard user type on their system.

There are many solutions out there but one which offers a huge amount of flexibility is DefendPoint by BeyondTrust.. Policies can be as broad or specific are you like right down to different user groups in the Domain having different privileges.

Email Retention Policies

2019-05-15T15:38:00.000+01:00

Many companies have little to no email retention policies in place. The idea here is to ensure that if a business related email is required, it can be recovered for up to a 6 year period.
However it has also been raised that 6 years may not actually be sufficient when projects which are completed over a long period of time are concerned. Therefore 6 yrs from time of project completion should be the consideration. In some cases financial data may need a slightly longer period of retention to match other financial requirements.

The question is how do you manage this type of thing. Users have the ability to delete their emails etc and therefore relying on users to manage their own mailboxes completely may not be the best option.

Many companies opt for an email archiving solution which provides a copy of every email in and out to be stored safely and all access to these stored messages audited for compliance.

With the adoption of cloud email services this retention can present further challenges and many companies using services like O365 do't even see any need to perform separate backups of their O365 data which is obviously a very risky view. ( That's another story coming soon).

NotPetya Cyberwarfare ?

2017-06-29T15:41:00.001+01:00

It is interesting that many are regarding this latest NotPetya attack as Cyberwarfare and not Ransomware.
The main reasons for this assumption are as follows:

Due to the nature of the infection, it would appear that Ransomware is being used to mask the true nature of the attack.
The files seem to be unrecoverable.
Similar to wiping a hard disk, the entire drive is rendered unuseable by overwriting the Master File Table.

It would definitely appear that the intention is to destroy rather than hold to Ransom.

Athena Spyware and EternalRocks

2017-05-24T11:03:00.001+01:00

Wikileaks last week released documents detailing an application created by the CIA used to covertly monitor and control virtually any current version of Windows.
Basically the application named Athena is spyware which gives full rights over the PC to the control.
There is even a full user guide.HERE.

And there is also news of a rival to Wannacry called EternalRocks which has the potential to be even more destructive. Eternal rocks makes use of seven of the NSA exploits leaked. Wannacry used two of the exploits. At present there is no reported activity related to this malware but it is very covert and includes serveral techniques to avoid detection.

So the question is, who are the bad guys? The ones who leak the information or the ones who know about it but decide not to tell anyone?

We know in reality that the bad guys are already two steps ahead of the authorities when it comes to CyberSecurity so would it not be in everyones interest if the Authorities actually made a true contrubution to the security community and used their research to plug the holes and not secretly exploit them.

SHA-1 Certificates will be rejected by the latest browsers.

2017-05-11T16:52:00.001+01:00

Websites and systems protected using certificates using Sha-1 algorithms will no nonger be accepted by new browsers. IE11 and Chrome for example wont allow a user to continue on to the site regardless.

Most public CA's have been issuing more scure certificates for some time now, however many internal CA's are still using Sha-1 to sign their certificates.

Its time to check and upgrade/reconfigure if you want your systems to keep running smoothly.

Microsoft for example has several articles on how to deal with the situation in their support site.

I recently helped a customer running Windows Server 2008 Domain to upgrade their CA to issue the higher security certs.

Is your company ready for GDPR ?

2017-05-07T18:49:00.001+01:00

What is it ?

Put simply it is a set of new policies adding to the current Data Protection Laws in the EU.

Companies will be required to respect "the right to be forgotten". This means that you must be fully in control of your data in such a way that all digital traces pertaining to any individual must be fully deleted should the request be made.

Whats is in scope ?

Basically all of your data must be cleansed of any identifying data if requested. This will include all past and present data including archives and backups.

What if I dont comply with a request ?

Penalties will be imposed of up to 4 percent of worldwide turnover.

How should this be implemented ?

You will need to be able to demonstrate a process which is implemented and fully documented which complies with each request.

What problems need to be overcome ?

The biggest issue is knowing your data. In other words having fully indexed data and systems which will ensure this can be conducted in a thorough and effective manner.

When does it come into effect ?

May 2018

Tech-2 question......

If a request is made by an individual to "be forgotten" then presumably there should also be no record of the request itself being made. This surely would make it very difficult to prove that the request was ever received and implemented. A more thorough understanding of this type of question needs to be investigated.

More information...

For more information visit http://www.eugdpr.org/

Fortinet releases 5.6 FortiOS for Fortigate but Analyzer users should not upgrade yet.

2017-05-07T18:07:00.002+01:00

The new release of FortiOS has been around for several weeks now, however many users are realising that they cannot continue to use their FortiAnalyzer running the 5.4 code. It needs to be upgraded to 5.6 on the Analyzer as well.

One problem is that we are still waiting for 5.6 for FAZ. Therefore people are downgrading.

In all fairness the FAZ compatibility guide is quite clear but why release one without the other.

The Governments Snooping Laws

2016-11-18T17:09:00.002+00:00

So it looks like the Government will finally get the law passed requiring websites to retain all user browsing activity logs for a minimum of 1 year.
I really cannot understand how this will achieve much at all. The real criminals arent going to do much "in the clear" and the odd time something does lead to conviction will be so minimal that it wont be worth all the effort.
Its a shame the logs arent protected under the data protection act by the ISP, as it would make life a little more difficult.
I guess if this concerns you, now is the time to go TOR if you arent already.

configuring the zmodo ZP-IBi-13W camera to work with Blue Iris Software.

2016-07-08T19:14:00.002+01:00

Off topic.......configuring the zmodo ZP-IBi-13W camera to work with Blue Iris Software.

Many people have had issues getting these cameras to display video in any other sotware except the supplied z-viewer. Here is how I got it working with the Blue Iris Software. The settings may work with other software but have not been tested.

Pre-Requisites

First set the camera up using the instructions with the camera using zviewer and zsight software.

You will need to find the cameras wireless ip address. If possible set this statically by connecting to the cameras IP address using internet explorer. ..http://ip-of-camera... Note it does not work with Firefox of chrome.

Once working you need to install Blue Iris Software on a machine which can contact the cameras. Usually this will be sitting on the same network but it will work over a router network providing the required ports are allowed

Blue Iris Installation

Load up the Blue Iris Software and Add a new camera

On the video tab tick the option for Anamorphic (force size) then type 1280 x 720.

Select Max.rate 25.00 fps.

Click configure

Now the important settings:

Using the IP address of your camera, enter it in the address field.

Set the port to 9000

Set Make to Zmodo

Set Model to ISV-BFS2 etc……..(mobile port)

The other two option I selected are circled below also.

Click okay and all being well your camera will display.

Also you can configure the Motion Capture and record settings as required allowing video to be captured.

New EU Data Protection Laws (GDPR) and Cloud Services

2016-04-18T17:03:00.002+01:00

Over the past few days the new EU data protection laws have been passed which will for the first time in 20 years rewrite the requirements and responsibilities of those who store data. It will also give more rights to the users who have data stored.

The new General Data Protection Regulation (GDPR) will require many businesses to re-think and rework their current strategies. One area which interested me was in the effect of the GDPR on cloud service providers.

I have studied many articles and discusssions and thought I could take the main points and simplify them here.

First some terminology

Data Controller - The business who actually owns the data
Data Processor - The cloud provider

The current situation:

All of the responsibility of data protection currently lies with the Data Controller. The Data Processor basically facilitates a platform on which the systems run.

With the introduction of the GDPR

Both the Data Controller and the Data Processor will be responsible for the data.

A breach will need to be reported in 72 hours and fines will fall into one of two categories depending on specific criteria.

2% of global annual turnover or €10 million
4% of global annual turnover or €20 million

Obviously the new regulations will cover many more aspects in much more detail and clarity, but it doesn't take much to assume that there will be a rise in service costs due to the extra responsibility being placed on both the businesses and cloud providers.

Quicktime For Windows Needs To Be Uninstalled.

2016-04-15T17:09:00.001+01:00

After Trend Security Researchers discovered two new flaws in Quicktime they contacted Apple to report the issue. Apple allegedly responded that they would not fix the issues as they were removing support for Quicktime on Windows.

It is reported that even the Department of Homeland Security’s United States Computer Emergency Readiness Team (US-CERT) has recommended Windows users uninstall this software as well.

Make a date for April 12th...Microsoft release the fix for the critical Badlock vulnerability.

2016-03-31T09:20:00.002+01:00

On April 12th, 2016, a crucial security bug in Windows and Samba will be disclosed. It has been named Badlock and like Heartbleed it has its own website.

Full details of the vulnerability have not been disclosed but the name and logo for once are a good indication of what to expect.

Visit the official website for more information.

http://badlock.org/

Apple Vs FBI

2016-03-29T12:09:00.001+01:00

Re: The FBI and Apple story involving the FBI trying to force Apple to unencrypt an IPhone in their possession.

The FBI have now reportedly withdrawn their court battle with Apple after a third party has given the FBI the ability to access the phone without Apple assistance.

Based on this new information, there is likely a lesser known vulnerability in the IOS which is now known to the FBI. The question is whether Apple know of its existence and will they release a patch.

Also what are the implications of this being known to the FBI. More questions are raised.

Hackers target US Dam control systems

2016-03-29T12:03:00.005+01:00

The US acknowledged that Iranian hackers were responsible for hacking into a Dam's online control systems in 2013. It is thought that the only reason that the water contained by the Dam wasn't released was because the sluice gate system was manually taken offline for maintenance.

Drown Attack - Summary

2016-03-15T14:00:00.000+00:00

The DROWN attack (CVE-2016-0800) was made public last week.

Drown is a Cross-protocol attack on TLS using SSLv2. it allows attackers to break the encryption and access potentially sensitive communications like passwords or credit card details.
At the time of writing this, researchers have estimated that around a third of all HTTPS servers are vulnerable to this attack.

For an indepth discussion on the DROWN attack please visit the site. https://drownattack.com/

A Long Time Ago

2016-03-15T13:54:00.004+00:00

To be honest I havent posted anything for absolutely ages. It was getting difficult to find something newsworthy which wasn't already in thousands of other places already. So I decided that this blog should contain the following:

My views on security issues
Highlighting key security issues and news
Product reviews
A large dose or sarcasm........

SSL 3.0 POODLE Vulnerability

2014-10-16T22:26:00.001+01:00

A vulnerability in SSL version 3.0 (SSL3.0), CVE-2014-3566, known as "POODLE" was announced on 14 October 2014. This vulnerability allows the plaintext of secure connections to be calculated by a network attacker.

SSL 3.0 is nearly 18 years old, but support for it remains widespread. Most importantly, nearly all browsers support SSL 3.0 and browsers will retry failed connections with older protocol versions, including SSL 3.0 to work around bugs in HTTPS servers. A network attacker can cause connection failures and because of this, they can trigger the use of SSL 3.0 and then exploit this issue.

Reference material can be found here:
http://googleonlinesecurity.blogspot.ie/2014/10/this-poodle-bites-exploiting-ssl-30.html

Generic advisory is that SSL 3.0 should be disabled in all affected applications, in favor of the newer encryption mechanism TLS (Transport Layer Security).

source text: www.ssh.com

Shellshock Update

2014-09-26T16:46:00.000+01:00

The Shellshock Vulnerability ( CVE – 2014 – 6271/7169) has been rated as a 10/10 for criticality and therefore should be addressed as soon as possible. To remedy the issue you will need to first work out which systems are affected and apply the relevant vendor patches.

Any system running a linux or linux based OS could potentially be at risk, including some versions of OS X, therefore keep in mind all appliances as well as servers and workstations when investigating your estate.
Most vendors have by now issued statements as to the current status of their products so visiting the vendor websites is always a good place to start.

Visit this site to find out more information and how to test for the vulnerability.

https://www.cert.gov.uk/resources/alerts/update-bash-vulnerability-aka-shellshock/

ShellShock - Fortinet's Response

2014-09-26T09:47:00.001+01:00

Fortinet's Response to Shellshock vulnerability.

What is Shellshock?

Shellshock is a vulnerability discovered in the ubiquitous GNU Bourne Again Shell (Bash) program which can allow an attacker to remotely execute arbitrary code on a target system. Bash is commonly used in many Linux, Unix and Mac OS X operating systems. It also likely impacts Apple's iOS mobile operating system and Google's AndroidOS.

Who is affected?
While Bash is a local shell, it is used in many programs on the Internet to set environment variables which are then used in the execution of other programs.

How does it work?
Programs often use environment variables in their operations. If specially crafted extra code is added inside an environment variable, the operating system will execute that code. For example:

Should I be worried?
If you are the owner or maintainer of a server or other Internet infrastructure, you should patch your machines as quickly as possible. The nature of this exploit is such that it would be trivial for an attacker to compromise your machine(s) or create a self-propagating worm, reminiscent of the SQL Slammer worm in 2003, leading to potential Distributed Denial of Service attacks.

What can I do? How can I check my exposure?
On the server side of the equation, there are multiple things you should do as a best course of action to provide the highest level of security to your employees, users and customers:
It is important to note that FortiOS is not affected by Shellshock. FortiOS does not use the Bash shell.
Ensure you have appropriate IPS signatures deployed to monitor and mitigate any potential attacks on your infrastructure. Fortinet is issuing a Hot Update to our customers with IPS signatures to detect and prevent Shellshock attacks. This signature will be available in the next few hours. In situations such as this, our threat research teams are able to respond to urgent or immediate security incidents promptly to protect our customers (and our customers' customers) from exploitation.
Ensure you have deployed the latest AV DB packages to your systems and endpoints. Fortinet issued a Hot Update to our customers to detect and prevent Shellshock attacks.
Deploy the patches to affected systems as soon as possible.
What about Fortinet? How did Fortinet respond?
Fortinet released Bash.Function.Definitions.Remote.Code.Execution via Hot Update 5.552 on the afternoon of September 25th.
FortiGuard's PSIRT (Product Security and Incident Response Team) became aware of the issue on Wednesday, September 24th when the bug was publicly disclosed. Our team developed an in-house POC immediately to verify the vulnerability and started to determine the extent of our exposure in our products.
PSIRT issued a security advisory - FG-IR-14-030 on Thursday with initial information and our industry-leading security research team concurrently created initial IPS signatures to assist customers in determining if attackers attempting to exploit Shellshock were targeting their systems.
Patch development began in the morning of Thursday September 25th, and our QA teams have started testing the updates.
Many of our products, including FortiOS, were not affected by Shellshock and a patch is not required. The product security advisory lists our affected products.

http://www.fortiguard.com/advisory/FG-IR-14-030/

Text taken from Fortinet Blog as is. Tech-2 does not own this text and has not verified the content.

HeartBleed Vulnerability

2014-04-11T22:34:00.005+01:00

It's been quite a while since a vulnerability like this has been uncovered. There is no doubt that this is a serious one and it affects many products. What makes this a problem is not only that it has serious consequences, but also that it isn't that hard to exploit. Affected versions of OpenSSL have also been around for a long time since around April 2012 meaning the impact up to now is unknown.
Recommendations are to patch the affected products, renew certificates and ensure users change their passwords.

OpenSSL versions 1.0.1 - 1.0.2. OpenSSL advise Affected users should upgrade to
OpenSSL 1.0.1g and users unable to immediately upgrade can opt to recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS. 1.0.2 will be fixed in 1.0.2-beta2.

The list below are links to some of the affected products. There are many more.

VMWare
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2076225

Fortinet
http://www.fortiguard.com/advisory/FG-IR-14-011

Juniper
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10623

Cisco
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-heartbleed

Watchguard
http://watchguardsecuritycenter.com/2014/04/08/the-heartbleed-openssl-vulnerability-patch-openssl-asap

Aruba
http://www.arubanetworks.com/support/alerts/aid-040814.asc

CheckPoint
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk100173

RedHat
https://access.redhat.com/security/cve/CVE-2014-0160

F5
http://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html

McAfee

https://kc.mcafee.com/corporate/index?page=content&id=SB10071

Symantec
http://www.symantec.com/business/support/index?page=content&id=TECH216558

Ubuntu
http://www.ubuntu.com/usn/usn-2165-1/

FreeBSD
http://www.freebsd.org/security/advisories/FreeBSD-SA-14:06.openssl.asc

RedHat
https://access.redhat.com/site/announcements/781953

If you are still running Windows XP then you should migrate.

2014-03-01T23:06:00.001+00:00

As we know, many home users and businesses are still running Windows XP as their Desktop Operating System. With support for Service Pack 3 ending in April this year (2014), the likelihood of increased malware and virus' is very high on these systems. This information should not be taken lightly, due to the very real threat which will continue to rise the older the Operating System gets. If a vulnerability is found and remains un-patched then businesses will be taking unnecessary risks. When support is discontinued there will be no patches so the security holes will remain open waiting to be exploited. Contrary to what many believe, this isn't Microsoft looking for ways to make more money. XP is three generations old if you count Vista, Windows 7 and now Windows 8. It's time to upgrade Windows or Migrate to a different OS completely.

Credit Card Fraud Warning

2014-03-01T22:47:00.000+00:00

I received a voicemail, then text then a call to my home phone from the bank to call them. I verified the number was legit and contacted the bank. They didn't ask any questions but were able to verify my recent transactions so were genuine. However twenty minutes prior to the call someone had placed an order on Play.com for £500 using my details. Luckily for me the bank had the sense to block the transaction and contact me. I had to cancel my card. I decided to contact Play.com to tell them what had happened and after some cross referencing they could see that an order had been placed on a very recently created account using my bank details, but a different delivery address. The customer services lady was a bit shocked when she then cross referenced the delivery address to find that six other orders using other peoples details had also been placed today for delivery to that address. Unfortunately for those people it looks as if the transactions had at that point completed. Play.com were very grateful for my calling them as they could stop the deliveries and hopefully let the other card holders know. The issue here is that somehow these details had been leaked, most likely from a hack against either their own or more likely another online vendors system. I wonder how long this will take to be found. I immediately accessed all my accounts for various vendors, removed all card details and changed credentials. I know this was not a phishing attack as I never click on or use anything sent in an email. So be warned.... I now have something else to add to my list of things to follow up...

Yahoo Email Security Breach

2014-02-01T13:43:00.000+00:00

Click here to read the article. Yahoo Mail Breach

A Potential Scam currently under investigation.

2013-12-30T17:37:00.004+00:00

Tech-2 are currently in the process of investigating another potential online scam which dupes the user into making a booking through what appears to be a valid website. Infact it would appear that the booking money is taken, yet the user never receives what they have paid for. More details will be posted on this investigation including the offending website URL if proven true. Watch this space.

LAN2LAN Hacker Aware Event A Success

2013-11-30T17:40:00.000+00:00

A two day seminar held by LAN2LAN Limited in Leatherhead was deemed a success judging by the participant reviews. The seminar focused on hacking techniques, malware and demonstrations in order to provide more awareness of the types of issues we may be faced with.