This is a very interesting video where Cori walks David through how to do phishing and she made it look so easy. Fast too!
Author: Jason
Weekly Cybersecurity Wrap Up 1/30/23
A weekly roundup of my continued learning in cybersecurity. What webinars I attended, podcast I listened to, the articles I read and projects I’m working on.
Webinars
- SANS Institute – Not in Cyber Security? No Problem! Creative Ways to Gain Experience With No Experience – 1/28/23 – Creative Ways to Gain Experience with No Experience.
- PaloAlto Networks – 1/31/23 – Stop Zero-Day Malware with Zero Stress. Guest speakers, Chris Krebs and Rachel Tobac
Articles
- Economic headwinds could deepen the cybersecurity skills shortage – Security professionals will remain in high demand, but economic fallout will make hiring even harder.
- Hacker finds bug that allowed anyone to bypass Facebook 2FA – bug in system that Meta could have allowed malicious hackers to switch off an account’s two-factor protections just by knowing their email address or phone number.
- New Survey Reveals 40% of Companies Experienced a Data Leak in the Past Year SysKit report highlighting effects of digital transformation on IT admins and governance landscape released.
- Hunting Insider Threats on the Dark Web – Use threat intelligence to reduce chance of success for malicious insider and Dark Web threats.
- GoodRx pays $1.5 million to settle health privacy allegations – Failed to tell customers they shared data with Meta and Alphabet.
- Google Fi data breach let hackers carry out SIM swap attacks – Google Fi, has informed customers that personal data was exposed by a data breach at one of its primary network providers, with some customers warned that it allowed SIM swapping attacks.
Podcasts
- Smashing Security – 306: No Fly lists, cell phones, and the end of ransomware riches? – What are prisoners getting up to with mobile phones? Why might ransomware no longer be generating as much revenue for cybercriminals? And how on earth did an airline leave the US government’s “No Fly” list accessible for anyone in the world to download?
- Malicious Life – You Should Be Afraid of SIM Swaps – If SIM swap stories ever make the news, almost uniformly, they focus on people who lost a lot of money. But SIM swaps also take a psychological toll. Getting cut off from the grid all of a sudden, not knowing why, not being able to call for help. Even when it’s over, you never know if your attackers — whoever they are — will come back again.
- Security Masterminds – Why a Data-Driven cybersecurity Defense Will Protect Your Organization With Special Guest, Roger Grimes – Excellent podcast, bit of John McAfee bashing, not that it wasn’t deserved. Get past that and the content is great.
- Security Weekly News – SWN #269 – Empathy, Bitwarden, Lexmark, Exchange, Dragonbridge, & Derek Johnson Talks About Hive
- Security Weekly News – SWN #270– SwiftSlicer, vRealize, Google Play, KeePass, Huawei, & Github –
- Security Now 908 – Data Operand Independent Timing – Old Android apps, Kevin Rose, iOS 6.3 and FIDO, Hive hacked
Projects
TryHackMe – This week I focused on the How the Web Works. I’m working through the HTTP in Detail room.
Pluralsight Learning
- Risk Management and Information Systems Control: IT Risk Assessment – 1hr 31m – The process of risk assessment, the follow up to the risk framing and risk identification processes done previously. This will help you understand the entire risk management process and prepare for ISACA’s CRISC examination.
- Risk Management and Information Systems Control: Risk Identification – 1hr 50m – Addresses the key parts of the risk management process starting with risk identification.
What is Mastodon?
Deep Dive on Password Best Practices
On Tuesday, I attended a wonderful talk by Roger Grimes. The title of the webinar was A Master Class on Cybersecurity: Password Best Practices. Roger is very knowledgeable and a great resource for this information, but he talks fast. I really enjoyed the webinar, but it was an hour long and Roger fit a lot in that hour. For those that watch the above free webinar provided by BightTalk and (ISC)2. I thought I would provide some helpful links and videos to follow along in the webinar. First be sure to download the slides from Roger’s talk via BrightTalk.
Roger shows several Kevin Mitnick hacks during the webinar. Here is the No Link or Attachments Necessary hack link, unfortunately its not on youtube, so no embedding. Kevin is the “Chief Hacking Officer” at KnowBe4, the same company that Roger Grimes works at.
After the talk I also looked up my email address on haveibeenpwned.com. No surprises here. My email was in several breaches.
If they have your username they have half the puzzle (assuming you are not using any kind of 2 factor authentication, 2FA, which most are not). Now all they have to do is guess your password. If your password is on this list, Top 200 most common passwords, your screwed, this is exactly the kind of list that hackers will use first.
How do you make a more secure password then. I’ll let Kevin touch on this:
It is really even easier than that! If you ask chances are people will freely give you their password:
Okay, so let’s assume you are smarter than these folks and you can keep from freely telling people. But can you? You may be doing it, indirectly. According to a research paper from Google, 20% of recovery questions, those you answer when you use the Forgot Password link on every website, can be guessed by a hacker. But while the hacker can do it, 40% of users can’t remember their own according to the paper! When all else fails just review your social media, as 16% of answers can be found there!
My suggestion use a password manager. Then you say, what about LastPass. You have a point, but how often are password managers breached? Not as often as the other 100 sites you use a password to get into. Password managers are still a good choice. In addition to your password manager, why not try some 2FA hardware?
Be safe out there folks!
Weekly Cyber Security Wrap Up
My weekly roundup of my continued learning in cyber security. What webinars I attended, podcast I listened to, the articles I read and projects I’m working on.
Webinars
- Roger A. Grimes, KnowBe4’s Data-Driven Defense Evangelist – (ISC)2 – A Master Class on Cybersecurity: Password Best Practices – 01/24/23 – What really makes a “strong” password? And why are you and your end-users continually tortured by them? How do hackers crack your passwords with ease? And what can/should you do to improve your organization’s authentication methods? Password complexity, length, and rotation requirements are the bane of IT departments’ existence and are literally the cause of thousands of data breaches. But it doesn’t have to be that way! –
Security Briefings Webinars | (ISC)²
- Rachel Tobac, CEO of SocialProof Security – Webinar: Personal Data’s Role in Enterprise Social Engineering Attacks – 01/25/23 – During this webinar, Rachel and Rob will share their unique perspectives on: The state of privacy: Why individuals are losing control of their digital identities and how that’s driving business risk. The state of social engineering: How hackers use data found by data brokers to hack. The future of hacking: How new AI-based technology like facial recognition and voice-cloning will open up new pathways for bad actors
Articles
- NVIDIA Morpheus – NVIDIA Morpheus is an open application framework that enables cybersecurity developers to create optimized AI pipelines for filtering, processing, and classifying large volumes of real-time data. Bringing a new level of information security to the data center, cloud, and edge, Morpheus uses AI to identify, capture, and act on threats and anomalies that were previously impossible to identify.
- Security and the Electric Vehicle Charging Infrastructure – When EVs and smart chargers plug in to critical infrastructure, what can go wrong? Plenty.
- Decrypted: BianLian Ransomware – Avast has developed a decryptor for the BianLian ransomware and released it for public download.
- 2023 Insider Threat Report – 72 percent of organizations report insider attacks have become more frequent.
- LastPass Parent Company GoTo Suffers Data Breach, Customers’ Backups Compromised – The affected information, which varies by product, may include account usernames, salted and hashed passwords, a portion of multi-factor Authentication (MFA) settings, as well as some product settings and licensing information.
- Ticketmaster Blames Bots in Taylor Swift ‘Eras’ Tour Debacle – Ticketmaster testified in the Senate that a cyberattack was to blame for the high-profile Taylor Swift concert sales collapse, but some senators aren’t so sure.
- Justice Department Shutsdown Hive – The FBI has seized the computer infrastructure used by a notorious ransomware gang which has extorted more than $100 million from hospitals, schools and other victims around the world, US officials announced Thursday.
- Dutch hacker steals data from virtually entire population of Austria – The data was stolen from a misconfigured cloud database found by the attacker through a search engine
Podcasts
- 8th Layer Insights: Season 3 finale: What’s the deal with Authentication, MFA, and Password Managers? – Authentication and Password Managers.
- Security Weekly News #268: Chick-Fil-A, OneNote, XLLs, VastFlux, T-Mobile, ChatGPT, Ukraine, Lots of Microsoft
- Security Now 907 – PayPal Credential Stuffing. iOS 16.3 : Cloud encryption for all. InfoSecurity Magazine: “ChatGPT Creates Polymorphic Malware”. CheckPoint Research: OPWNAI : Cybercriminals Starting to Use ChatGPT. “Meta” fined for the third time. Bitwarden acquires “Passwordless.dev”. Closing the Loop. Credential Reuse.
- Control Loop: ICS/OT incident response plans: Don’t get caught unprepared. The NOTAM outage was reportedly caused by a corrupted file. Ukrainian hacktivists conducted DDoS attacks against Iranian sites. And a cyberattack against a Nunavut power utility.
Projects
TryHackMe – Completed Linux Fundamentals Parts 1-3. Completed Windows Fundamentals 1-3.
Implementation of Secure Solutions for CompTIA Security+ – 6 hours of prep training for the Security+.
10 of the Craziest Cyberattacks Seen In the Wild and How You Can Avoid Them
Am I too old to get into Cybersecurity?
This Week in Cybersecurity – Wrap Up
Educational Recommendations
This week I attended two webinars:
- (ISC)2 Webinar – How to Perform an Attack Surface Assessment
- (ISC)2 Webinar – Future Insights 2023
Interesting Articles this Week
- Ransomware attack hit KFC and Pizza Hut stores in the UK
- T-Mobile hacked to steal data of 37 million accounts in API data breach
- EXCLUSIVE: U.S. airline accidentally exposes ‘No Fly List’ on unsecured server
- PayPal Breach Exposed PII of Nearly 35K Accounts
- MailChimp discloses new breach after employees got hacked
- The FBI Won’t Say Whether It Hacked Dark Web ISIS Site – Technically last week, but the idea that Tor is not as anonymous as commonly perceived is fascinating.
Great Podcasts from this Week
- Security Now 906 – The Rule of Two
- Darknet Diaries – EP 131: Welcome To Video – WARNING: This episode is especially disturbing.
- Smashing Security – 305: Norton unlocked, and police leaks
- FROZEN, FORTINET, SCATTERED SPIDER, ROUTERS, APF, TELEGRAM, & CWP – SWN #267
Learning Projects
TryHackMe – I’m adding in some rooms from TryHackMe here and there to increase my overall understanding of cybersecurity. I’m focusing on Unix commands right now.
Kali Linux – I’ve installed a Kali Linux virtual machine on my MacBook Pro M1, which took a little more doing as the Apple silicon is still fairly new in the industry.
PluralSight – I’m still working through the 6+ hour long Implementation of Secure Solutions for CompTIA Security+ by Christopher Rees.
Rachel Tobac
I recently discovered David Bombal and Rachel Tobac. They got together on a video this month and it’s great.
Changing Mastodon Servers
What is Mastodon?
Mastodon is free and open-source software for running self-hosted social networking services. It has microblogging features similar to Twitter, which are offered by a large number of independently run nodes, known as instances, each with its own code of conduct, terms of service, privacy policy, privacy options, and content moderation policies.
I would argue it is better that Twitter primarily because it is not owned by Elon, but also because there is no algorithm choosing what you see, there are also no ads.
Why Change Servers?
Since each server is like it’s own community, you want to find like minded people on your server. Since I have been so absorbed in cybersecurity I initially chose to join ico.exchange. They had an instant join policy at the time, which means, no one had to manually review my application to join the server.
However, since joining I’ve followed more and more of what is going on at infosec.exchange. I follow more people there as well. So I finally decided to switch over. Which is not hard.
How I did it
I followed these step-by-step directions, which worked without issue for me. Since I hardly had anything on the server, I’ve only been on for a few months and I don’t post as much as many others, I don’t really find the downloading archive step necessarily, although it was nice to have a copy of my avatar image for the new server. What was necessary was the CSV of the followers, so I could follow the same people at the new server I was at the old server. Your followers are automatically notified that you have moved and follow you on the new server. There is nothing more you have to do. One big caveat is that you lose all your old post. They do not make the move over with you. So if you are thinking of moving servers do it before you have to many post or at least post you care about. Good luck!