Category: Tech Notes

What is Salt Typhoon and why should I care?

???? What is Salt Typhoon?

Salt Typhoon is a state-sponsored Chinese Advanced Persistent Threat (APT) believed to operate under China’s Ministry of State Security. Its espionage operations began around 2020 and have heavily targeted U.S. critical infrastructure CyberScoop.

???? How did they infiltrate U.S. telecom networks?

Initial access via unpatched vulnerabilities in critical network gear—especially Cisco routers, Fortinet, and Versa Director systems—often exploiting default or weak admin credentials.
Once inside, they leveraged existing tools (“living-off-the-land” such as PsExec, WMIC) to avoid detection and maintain stealthy network access.
They carefully erased logs and stayed embedded for months—or longer. Cisco Talos notes one case with persistent presence for over three years.

???? Scope of the breach: What was affected?

At least eight U.S. telecom firms were breached (Verizon, AT&T, T‑Mobile, Spectrum, Lumen, Windstream, Consolidated, and another unnamed firm); a ninth was confirmed later by the White House.
Access extended to infrastructure handling lawful intercepts (CALEA systems), exposing text and call metadata—and in some cases, even call audio—of over a million individuals, including senior political figures (Trump, Vance, Harris campaign).
Metadata included timestamps, phone numbers, IP addresses, and live intercepts.

???? Broader implications

Senate Intelligence Chair Sen. Mark Warner described it as “the worst telecom hack in our nation’s history”—worse even than SolarWinds or Colonial Pipeline .
The intrusion extended beyond espionage: it potentially granted visibility and control over communications infrastructure—vital in crisis or conflict scenarios.
U.S. authorities fear this is a strategic campaign to enable future disruption, pre-positioning within critical inter-state communication networks.

????️ Government response & policy shifts

U.S. agencies (FBI, CISA, NSA, FCC) issued hardening guidance—patching, monitoring, stronger authentication, log retention.
Calls emerged for mandatory cybersecurity regulations for telecoms, culminating in new FCC rules championed by Chair Rosenworcel.
The Treasury .
However, full eviction of the hackers is still a challenge—remediation may require replacing thousands of devices.

???? Summary: Key facts at a glance

Category	Details
Actor	Salt Typhoon (MSS-affiliated)
Breach timeline	From at least mid-2023 through late 2024, possibly earlier .
Firms affected	8–9 major U.S. telecoms
Data compromised	Call metadata, wiretap systems, live audio
Depth of access	Router-level access via Cisco exploits
Strategic threat level	Espionage w/ potential for disruption

???? What this means for you

While the average consumer’s daily service hasn’t been significantly disrupted, this breach compromises the integrity and privacy of communications infrastructure. As a result, safer communication practices like using end-to-end encrypted apps (Signal, WhatsApp) are now recommended WIRED.

? Why do the carriers not care?

The fact of the matter is that this had no impact on the carriers financially. Yes, they have failed to secure our data and communications but there is no real downside to them.

July 18, 2025

Are you hosting a BotNet node?
Cybercrime Alert: FBI Warns of Botnet-Driven Attacks on old network routers

The FBI’s Internet Crime Complaint Center (IC3) has issued a critical alert regarding the 5Socks proxy service, a tool exploited by cybercriminals to mask malicious activities. This service facilitates the operation of botnets—networks of compromised devices—enabling a range of cyberattacks that threaten individuals and organizations alike.

Understanding Botnets: The Hidden Threat

A botnet is a collection of internet-connected devices, such as computers and smartphones, that have been infected with malware and are controlled remotely by cybercriminals. These compromised devices, often referred to as “bots” or “zombies,” can be orchestrated to perform coordinated attacks without the owners’ knowledge.

Botnets are utilized for various malicious purposes, including:
- Distributed Denial-of-Service (DDoS) Attacks: Overwhelming targeted systems with traffic to disrupt services.
- Spam Distribution: Sending massive volumes of unsolicited emails.
- Data Theft: Harvesting personal and financial information.
- Credential Stuffing: Using stolen login credentials to access multiple accounts.
- Cryptocurrency Mining: Exploiting device resources to mine digital currencies.
5Socks Proxy Service: A Cybercriminal’s Tool

The 5Socks proxy service has been identified as a facilitator for cybercriminals to anonymize their activities. By routing malicious traffic through this service, attackers can obscure their origins, making it challenging for law enforcement and cybersecurity professionals to trace and mitigate threats.

Protecting Yourself Against Botnet Threats

To safeguard against botnet-related attacks:
- Maintain Updated Software: Regularly update operating systems and applications to patch vulnerabilities.
- Use Robust Security Solutions: Employ reputable antivirus and anti-malware programs.
- Be Cautious with Emails and Links: Avoid clicking on suspicious links or downloading attachments from unknown sources.
- Implement Strong Passwords: Use complex passwords and consider multi-factor authentication.
- Monitor Network Activity: Keep an eye on unusual device behavior or network traffic.
Reporting Suspicious Activities

If you suspect your device is part of a botnet or notice unusual online activities:
- Report to IC3: Visit www.ic3.gov to file a complaint.
- Seek Professional Assistance: Consult cybersecurity experts to assess and remediate potential infections.
Free Device Tracking Spreadsheet
If you would like a template for device tracking, here is an Excel template.
May 12, 2025
CouchDB: This NoSQL Database Stands Out for Scalability and Flexibility
CouchDB came up on my radar a few weeks ago when researching the Erlang OTP SSH vulnerability CVE-2025-32433 exploit. CouchDB is a super interesting database because it is schema-free, document-oriented, and great at syncing across devices. Here are some common uses:

???? 1. Mobile Applications (especially Offline-First Apps)
- CouchDB’s ability to sync databases (even when offline) makes it a natural fit for mobile apps that need to work without internet access.
- Example: A delivery app where drivers can still log deliveries without a connection and sync everything later.
???? 2. Web Applications with Complex User Data
- Since CouchDB stores data as JSON documents, it’s flexible for apps that need to save lots of user-generated content (comments, posts, custom settings).
- Example: A customer portal where users can update settings, upload files, and personalize dashboards.
???? 3. Distributed Systems
- CouchDB is designed for master-master replication, so multiple databases can talk to each other and stay in sync. Perfect for multi-location apps.
- Example: A retail chain where every store has a local copy of the database, syncing nightly with headquarters.
???? 4. Event Logging and Audit Trails
- It’s great for storing events or logs because documents are easy to append and you don’t need to worry about rigid table structures.
- Example: A cybersecurity system recording user login attempts and system changes.
???? 5. E-commerce Product Catalogs
- CouchDB’s flexible document model is good for products that have different attributes (e.g., a laptop vs. a T-shirt).
- Example: An online store where some products have 20 fields and others have 3.
???? 6. IoT Device Data
- Collecting small, varied bits of data from lots of IoT devices is easier with CouchDB because of its schema flexibility and ability to sync in chunks.
- Example: Smart home devices sending temperature readings, device settings, and usage logs.
???? 7. Content Management Systems (CMS)
- Great when you need a flexible backend for a CMS that might have articles, videos, events, and other content types.
- Example: A news platform where every article can have a totally different structure or metadata.
If it’s good for a CMS…can we use it for WordPress?

The realistic answer is ‘no’ because CouchDB is a NoSQL database and cant replace the WP database easily. Being an engineer, the real answer is … technically, it could be made to work but you would need to rewrite almost all of WP.

????️ WordPress is Built for SQL Databases
- WordPress is designed around relational databases like MySQL or MariaDB.
- It expects tables like wp_posts, wp_users, wp_options, and uses complex SQL queries (joins, foreign keys, etc.).
- CouchDB is a NoSQL document database — it does not use tables, rows, or SQL at all.
Bottom Line:
WordPress expects structured, relational data. CouchDB offers flexible, unstructured documents. They speak totally different languages.

???? WordPress Core Would Need a Rewrite
- You would need to reprogram the entire database layer of WordPress (called wpdb) to talk to CouchDB.
- All the plugins, themes, and core functionality that expect SQL would break.
???? Different Strengths
- MariaDB is great for structured content where relationships matter (like posts belonging to users, comments on posts, etc.).
- CouchDB is better for dynamic, changing, or highly variable content, and syncing between devices — not rigid relational structures.
???? Could it theoretically be done?
- Yes, with massive effort:
  - Build a compatibility layer that translates WordPress SQL queries into CouchDB document queries.
  - Rewrite plugins and themes that directly touch the database.
- Some experimental projects (like “NoSQL for WordPress”) tried this idea with MongoDB (another NoSQL database) but none really caught on.
???? In Summary:
- CouchDB cannot replace MariaDB in WordPress easily.
- Stick with MariaDB or MySQL for WordPress.
- If you want CouchDB, it’s better suited for custom apps or new CMS builds where you design around document storage from the beginning.
April 29, 2025
Phishing Kits Are Fueling Toll and Delivery Scams Across the U.S.
A sophisticated SMS phishing campaign, known as “smishing,” is sweeping across the United States, targeting unsuspecting individuals with fake toll and delivery notifications. At the heart of this operation is a Chinese-developed smishing kit created by a threat actor known as Wang Duo Yu. This kit has been instrumental in facilitating widespread fraud, affecting users in multiple states and countries. Read more

???? The Toll Scam: A Nationwide Deception

Since October 2024, cybercriminals have been impersonating U.S. electronic toll collection systems like E-ZPass, sending fraudulent SMS messages and Apple iMessages to individuals in states including Washington, Florida, Pennsylvania, Virginia, Texas, Ohio, Illinois, and Kansas. These messages claim the recipient has an unpaid toll, urging them to click on a link to resolve the issue.

Upon clicking, victims are directed to a fake E-ZPass page, where they are prompted to enter personal information and payment details. This data is then harvested by the attackers for financial theft.

???? The Delivery Deception: Failed Package Notifications

In addition to toll scams, the same smishing kits are used to send fake package delivery notifications. Victims receive messages claiming a package delivery failed due to incomplete address information, directing them to a fraudulent website to update their details and pay a small redelivery fee. This tactic has been employed globally, targeting postal services in over 121 countries.

???? The Smishing Kit: A Cybercriminal’s Toolkit

The smishing kit developed by Wang Duo Yu is a comprehensive tool that allows cybercriminals to easily create and manage phishing campaigns. It includes features like:
- Customizable Templates: Pre-designed phishing pages mimicking various services.
- CAPTCHA Challenges: Fake security measures to add legitimacy.
- Payment Processing: Forms to collect credit card information.
- Backdoor Access: A hidden feature that sends collected data back to the kit’s creator, enabling double theft.
These kits are sold on Telegram channels, with prices ranging from $20 to $50, depending on the features included according to The Hacker News

❓Why the “Reply ‘y’ to this message”

Ever wonder why they want you to reply to the SMS message? The answer is fairly simple: they need you to.

Apple restricts sending URL’s in messages from unverified sources. There are two ways they verify the sender:
1. They are an established entity with Apple.
2. You have exchanged communication with the sender.
Now, by replying to the sender with anything, you’ve validated them. That opens up them sending you a URL link to their website which will steal your information. If you don’t reply to them, they are blocked from sending you the *really* bad stuff. 🙂 And unfortunately, replying “Please remove me” also validates them.

Also, a reply validates you as a sucker…er, active phone number and that isn’t good either. You will be on a target list and they know they only need to find the right angle to get you hooked.

???? Global Reach and Impact

The Smishing Triad, the cybercrime group utilizing these kits, has a vast infrastructure, with over 60,000 domains used to host phishing sites. They claim to have “300+ front desk staff worldwide” to support their operations, which include credential harvesting from banks and financial organizations in Australia and the Asia-Pacific region.

????️ Protecting Yourself from Smishing Attacks

To safeguard against these scams:
- Think: Ask yourself if this really seems legit and if this is how they would send important information.
- Verify Messages: Contact the organization directly using official channels.
- Avoid Clicking Links: Do not click on links in unsolicited messages.
- Use Security Software: Keep your devices protected with up-to-date security solutions.
- Report Scams: Inform authorities about suspicious messages to help combat these threats.
Stay vigilant and informed to protect yourself from these evolving cyber threats.
April 25, 2025
Why You Should Consider Using a Password Manager (And What to Watch Out For)
In today’s world, passwords are the keys to our digital lives—whether it’s banking, work accounts, or personal apps, keeping our data secure often comes down to how well we can manage our passwords. Using a password manager can be a game-changer, especially as they promise to simplify and strengthen the way we handle our logins. But with this convenience also come some risks. Here’s an overview of the benefits, potential drawbacks, and some security concerns to consider before committing to a password manager.

Password Managers

What Is a Password Manager?

A password manager is a digital tool designed to store and manage your passwords securely. It can generate complex passwords for you, automatically fill in login details, and even alert you if any of your passwords have been exposed in a data breach. Essentially, it acts as a vault that holds all your passwords, accessible only through a single, ultra-strong master password.

Pros of Using a Password Manager
1. Enhanced Security: Password managers create and store complex, unique passwords for each account, reducing the risk associated with reusing passwords. This is especially useful for accounts where sensitive information is stored.
2. Convenience: With autofill and automatic login features, password managers can save time and effort when accessing various accounts. No more remembering long strings of characters or constantly resetting forgotten passwords.
3. Password Audits: Many password managers come with built-in auditing features that alert you to weak or reused passwords. They may also notify you if any of your accounts are compromised in a data breach, so you can change the password promptly.
4. Encrypted Storage: Password managers encrypt your passwords, making it nearly impossible for anyone other than you to access the information without the master password.
5. Cross-Platform Accessibility: Most password managers offer apps or browser extensions that sync across your devices. Whether you’re on a computer, tablet, or smartphone, you can access your passwords wherever you need them.
Cons of Using a Password Manager
1. Single Point of Failure: If someone gains access to your master password, they could potentially access all your stored credentials. This makes the security of the master password crucial.
2. Cost: Although many password managers offer free versions, their full feature set often requires a paid subscription. For some, this additional cost may be a barrier.
3. Compatibility Issues: Some websites and applications may not support password manager autofill features, requiring manual entry and reducing convenience.
4. Learning Curve: Setting up and using a password manager can be a bit intimidating for non-tech-savvy users. Some users may find it challenging to transition from their old methods of password management.
5. Dependency on Technology: Password managers rely on technology that can, on rare occasions, fail or experience downtime. Being locked out during such times can be frustrating if you haven’t kept a backup of critical passwords.
Security Risks Associated with Password Managers

Although password managers are generally safe, they aren’t without security risks. Here are a few potential vulnerabilities to keep in mind:
1. Cloud-Based Storage Risks: Many password managers use cloud storage to sync passwords across devices. While they employ encryption, the data is still theoretically vulnerable to sophisticated cyberattacks if a hacker breaches the provider’s servers.
2. Master Password Vulnerability: The master password is the key to all your other passwords. If it’s weak, exposed in a phishing attack, or guessed, it can jeopardize the security of all your stored data. It’s recommended to use multi-factor authentication (MFA) with your password manager to add an extra layer of protection.
3. Malware and Keyloggers: If your device is compromised with malware or a keylogger, an attacker could potentially intercept your master password or other sensitive information. Keeping your devices secure with antivirus software and being cautious about phishing scams can help mitigate this risk.
4. Data Breaches: While rare, password managers have been the target of data breaches. Ensuring you select a reputable manager with a solid track record of data protection is key.
5. Risk of Losing Access: If you forget your master password and don’t have a recovery option set up, you could permanently lose access to your accounts. Some password managers offer recovery methods, but not all, so it’s important to plan accordingly.
Top Password Managers to Consider

If you’re considering a password manager, here are five reputable options, each with different features to suit a variety of needs and preferences:
- 1Password: This is a popular choice for Apple users, though it’s available across platforms. It’s known for strong encryption and a robust family-sharing feature. It has breach monitoring, secure file storage, and multi-factor authentication.
- Keeper: Keeper is packed with features such as breach monitoring, secure file storage, and multi-factor authentication. It’s an excellent choice for those who prioritize security and are willing to invest in a subscription.
- Dashlane: Dashlane provides a simple, intuitive experience and stands out for its advanced security features like VPN services and identity theft protection.
- Bitwarden: As an open-source password manager, Bitwarden is highly regarded for transparency and security. It’s affordable and provides a free version with essential features, making it a great choice for budget-conscious users.
- LastPass: Most well know for their security issues a few years ago, LastPass is still a solid option. Known for its user-friendly interface and a solid balance of features, LastPass offers both free and paid plans with options for cloud-based storage, password audits, and dark web monitoring.
In Summary

Password managers can significantly enhance both the security and convenience of managing your online accounts. They can generate strong passwords, alert you to potential security threats, and simplify the login process across devices. They are no magical, however, and aren’t without risks. Users should be ready for a *bit* of extra work but once you get used to them, they are wonderful. For the best results, pick a password manager that aligns with your security needs, commit to using a strong master password, and consider adding multi-factor authentication to protect yourself from potential threats.

Password managers offer valuable peace of mind, but like any tool, they’re only as effective as the security practices you employ around them.
November 13, 2024
New Zero-day Windows NTLM Vulnerability
Summary

A newly identified 0-day vulnerability impacts Windows clients from Windows 7 to Windows 11, allowing attackers to capture NTLM authentication hashes through a variant of previous Windows themes spoofing vulnerabilities. Researchers at ACROS Security discovered this flaw while developing a patch for an earlier vulnerability (CVE-2024-38030). This vulnerability lets attackers coerce vulnerable devices into sharing NTLM hashes via malicious theme files, which can be accessed through shared files or network paths.

Dark Reading Article: https://www.darkreading.com/vulnerabilities-threats/recurring-windows-flaw-could-expose-user-credentials

Disabling NTLM and Security Implications

ACROS recommends disabling NTLM where possible, as it reduces exposure to these coercion attacks. However, doing so can affect systems dependent on NTLM for network connections or legacy applications. Organizations should also use firewalls to block malicious requests from reaching external servers.

Microsoft is investigating this issue, though no patch is available yet. Meanwhile, proactive NTLM management is crucial for mitigating potential attack vectors.

So, can you turn off NTLM? Probably…

What is NTLM?

NTLM (NT LAN Manager) is an older authentication protocol used to validate Windows logins and network access. Designed for early Windows networks, NTLM is still present in Windows systems, though it has been largely replaced by Kerberos in more secure environments. NTLM authenticates users in situations where modern protocols aren’t available, especially in legacy applications and systems.

Windows Versions Using NTLM

NTLM remains compatible with various versions of Windows, especially for backward compatibility in:
- Windows NT and Windows 2000
- Windows XP and Vista
- Windows 7, 8, and 10
- Some configurations in Windows Server environments
While NTLM is enabled by default for compatibility, more recent Windows installations emphasize Kerberos for higher security.

How to Disable NTLM

To disable NTLM, administrators can configure Group Policies in Windows:
1. Open the Group Policy Management Console (GPMC).
2. Navigate to Security Settings > Local Policies > Security Options.
3. Modify Network Security: Restrict NTLM to control NTLM usage, limiting where NTLM can authenticate users.
Disabling NTLM can enhance security, especially against credential-forwarding attacks, though it may affect applications dependent on NTLM authentication.

Systems Dependent on NTLM

While NTLM is increasingly phased out, some legacy applications, network protocols, and services still require it. File sharing in older Windows domains, older SQL Server connections, and some remote access solutions rely on NTLM for authentication. Before disabling NTLM, ensure that critical applications and dependencies are compatible with Kerberos or other protocols to avoid disruptions.

In summary, while NTLM offers compatibility benefits, it can expose credentials, particularly in environments susceptible to pass-the-hash attacks. Organizations should consider limiting NTLM usage or monitoring its activity through logging, reducing exposure to potential vulnerabilities.
October 30, 2024
Why Antivirus Alone Isn’t Enough
As business leaders navigating today’s complex digital landscape, we all understand the importance of safeguarding our organizations against cyber threats. Yet, despite the awareness of these threats, many companies continue to rely solely on traditional antivirus software as their primary defense against cyber attacks. Recent developments, such as the emergence of tools like the AVNeutralizer—being sold by the notorious FIN7 hacking group—highlight the urgent need for a more comprehensive approach to cybersecurity.

Understanding the Modern Threat Landscape

In the ever-evolving world of cybersecurity, threats have become more sophisticated and targeted. Hackers, like those in the FIN7 group, are constantly devising new tools and techniques to bypass traditional defenses. The AVNeutralizer tool is just one example. This tool is specifically designed to disable antivirus software, rendering it ineffective and leaving organizations vulnerable to further attacks.

If a single piece of malware can neutralize your antivirus, what does that mean for your overall security posture? It underscores a critical point: antivirus software, while still an important component of cybersecurity, cannot be the only line of defense.

The Need for a Layered Security Approach

To adequately protect your business, you need to implement a layered defense strategy. Think of your cybersecurity like an onion, with multiple layers of security measures designed to protect your sensitive data and infrastructure. Here’s how you can start building that robust defense:
1. Endpoint Protection Beyond Antivirus: Modern endpoint protection tools offer more than just antivirus capabilities. They include features such as behavioral analysis, which can detect suspicious activity that might otherwise go unnoticed by traditional antivirus software. By monitoring the behavior of applications and processes, these tools can identify threats in real-time, even those that have never been seen before.
2. Network Segmentation and Firewalls: By segmenting your network, you can limit the movement of a hacker who has gained access to one part of your system. Firewalls and intrusion detection systems (IDS) add additional layers of defense by monitoring and controlling incoming and outgoing network traffic.
3. Regular Software Updates and Patch Management: Cyber attackers often exploit vulnerabilities in outdated software. Ensuring that all systems and applications are up-to-date with the latest patches can close these gaps and prevent attacks.
4. Employee Training and Awareness: Many cyber attacks begin with a simple phishing email. Training your employees to recognize these threats can be one of your most effective lines of defense. Regularly updated training programs ensure that your team is aware of the latest tactics being used by hackers.
5. Multi-Factor Authentication (MFA) and Strong Password Policies: Simple passwords are easy targets for hackers. MFA adds an extra layer of security by requiring a second form of verification, making unauthorized access more difficult.
6. Backup and Disaster Recovery Planning: Even with the best defenses in place, breaches can happen. Having a solid backup and disaster recovery plan ensures that your business can quickly recover from an attack without significant data loss or operational downtime.
Moving Forward with a Proactive Mindset

In today’s cybersecurity landscape, adopting a proactive mindset is crucial. Rather than waiting for an attack to happen and then reacting, a layered defense strategy anticipates potential threats and puts safeguards in place to address them. This approach not only minimizes the damage from a possible breach but also enhances your organization’s overall resilience.

In summary, while antivirus software remains a vital component of your cybersecurity toolkit, it should be viewed as part of a larger, more comprehensive strategy. By implementing a layered defense, you can better protect your organization from the sophisticated threats that are becoming increasingly common. As business leaders, we have a responsibility to stay informed and take the necessary steps to safeguard our companies and stakeholders in this ever-changing digital world.

Remember, cybersecurity is not a one-time effort but an ongoing process. Stay vigilant, stay informed, and invest in a layered defense strategy that keeps your organization secure.

Read more about FIN7: https://www.blackhatethicalhacking.com/news/fin7-hacking-group-selling-avneutralizer-tool-to-other-hackers/
September 3, 2024
Enhancing Security with MFA and Password Managers
In today’s digital landscape, securing remote access to company resources is more critical than ever. While Virtual Private Networks (VPNs) provide encrypted tunnels for secure remote access, their widespread use and internet accessibility make them prime targets for cyberattacks. Misconfigurations, such as insufficient monitoring of user accounts, often exacerbate these vulnerabilities.

The Value of MFA

Multifactor Authentication (MFA) is essential for fortifying VPN security. Enabling MFA on VPN accounts significantly reduces the risk of unauthorized access. In our compromise recovery engagements, we found that nearly half of VPN accounts lacked adequate MFA, highlighting a major security gap. By requiring multiple forms of verification, MFA adds an extra layer of defense, making it much harder for attackers to compromise accounts, even if passwords are stolen.

Why MFA and Password Managers Matter

Despite the risks, MFA remains an effective security measure. Implementing MFA and using password managers can provide robust security against various cyber threats. Here’s why these measures are crucial:
1. Unique Passwords: Always use a unique password for each account. This minimizes the risk of multiple accounts being compromised if one password is stolen.
2. Enable MFA: Secure all devices and accounts with MFA. This extra step can thwart many types of cyberattacks.
3. Implement Conditional Access and Monitoring: Integrate conditional access policies and continuous monitoring to detect and respond to potential abuses swiftly.
4. Security Automation: Use automated tools to enhance detection and response capabilities, ensuring swift action if suspicious activity is detected.
Guidelines to Enhance Your Security with MFA
1. Use Authenticator Apps: Opt for authenticator apps like Microsoft Authenticator instead of relying solely on text message codes, which can be intercepted.
2. Keep Security Codes Private: Never share your security codes with anyone to prevent unauthorized access.
3. Strong Passwords: Create strong and unique passwords using password generators and store them securely in a password manager.
4. Avoid Password Reuse: Using the same password across multiple accounts increases the risk of a security breach.
5. Educate on Social Engineering: Learn about and train employees to recognize common social engineering tactics, such as interactions with OTP bots, to avoid falling victim to these schemes.
Additional Measures for VPN Security
- Conditional Access: Implement conditional access to enforce user and device compliance before granting access.
- Continuous Monitoring: Regularly monitor user accounts and device activities to identify and mitigate potential threats.
- Security Automation: Use security automation tools to promptly detect and respond to account abuse or suspicious activities.
Recommended MFA Solutions
- Microsoft Authenticator: Provides strong authentication via push notifications, one-time passwords (OTPs), and biometric verification. Microsoft Authenticator
- Google Authenticator A simple and widely used app that generates time-based OTPs for various accounts. Google Authenticator
- Authy Offers multi-device synchronization, secure cloud backups, and supports multiple accounts. Authy
- Duo Security Provides two-factor authentication with push notifications, OTPs, and integrations with various applications. Duo Security
- YubiKey A hardware-based authentication solution that supports OTP, FIDO2, and smart card functionalities. YubiKey
- Okta Verify A mobile app that generates OTPs and supports push notifications for secure access. Okta Verify
In Summary

Securing remote access through VPNs requires a comprehensive strategy that includes MFA and the use of password managers. These measures are vital for protecting sensitive company resources and mitigating risks associated with password reuse and misconfigurations. By adopting these best practices, organizations can significantly enhance their security posture in the digital age.
August 30, 2024
New Play Ransomware Variant Targets Linux: What Businesses Need to Know
In a significant shift, the Play ransomware group has developed a Linux variant targeting VMware ESXi environments. Traditionally, Linux systems are considered safer than Windows, making this pivot particularly concerning. This variant verifies it is running on an ESXi environment before executing, focusing on businesses that use virtual machines for critical operations.

Key Highlights:
- Targeted Systems: VMware ESXi, widely used for hosting virtual machines.
- Infection Method: Uses ESXi-specific commands to disable virtual machines before encryption.
- Significance: Linux systems, traditionally viewed as more secure, are now in the crosshairs of sophisticated ransomware attacks.
Why This Matters

Linux operating systems have long been perceived as a safer alternative to Windows due to their robust security features and lower incidence of malware attacks. However, the Play ransomware’s shift to targeting Linux underscores a growing trend where cybercriminals are diversifying their targets, exploiting perceived security complacency. This development highlights the necessity for businesses to reassess their security strategies across all platforms, ensuring that even traditionally secure systems like Linux are adequately protected.

Protective Measures:
- Regular Updates: Ensure all systems are up-to-date with the latest security patches.
- Comprehensive Backup: Maintain frequent, secure backups to mitigate the impact of potential ransomware attacks.
- Enhanced Monitoring: Implement advanced threat detection and response systems to identify and neutralize threats quickly.
In Summary

The Play ransomware’s new Linux variant marks a significant evolution in cyber threats, challenging the long-held belief that Linux systems are inherently safer. Businesses must stay vigilant, updating their security protocols to protect against this expanding threat landscape.

For a detailed analysis, read the full article on Trend Micro.
July 31, 2024
Unlocking the Power of Windows Quick Assist
In the rapidly evolving world of remote work and digital collaboration, tools that facilitate seamless support and troubleshooting have become indispensable. Windows Quick Assist stands out as a valuable application that allows users to receive or provide remote assistance effortlessly. In this blog post, we’ll explore the usefulness of Windows Quick Assist, potential security concerns, and steps to ensure a secure experience while using this powerful tool.

The Usefulness of Windows Quick Assist

For my entire career, I’ve been supporting people with PC problems. I have great stories of the good old days when “Insert the floppy disk and close the door” needed to be explained. The industry has changed a lot but the need for support never went away. Fortunately, the tools have gotten better! Windows Quick Assist is a built-in feature in Windows 10 and later versions, designed to make remote assistance straightforward and accessible. It’s also easy to access with a simple: Ctrl + Windows + Q.

Here are some key benefits:
1. Ease of Use: With Quick Assist, both the helper and the person needing help can connect easily by sharing a code. This simplicity reduces the barrier to entry for users who may not be tech-savvy.
2. Real-Time Support: Quick Assist allows real-time screen sharing and control, enabling the helper to diagnose and fix issues directly on the user’s machine. This immediacy is particularly useful for troubleshooting complex problems that are difficult to describe over the phone or via email.
3. Built-In Tool: As a native Windows application, Quick Assist does not require any additional downloads or installations. This integration ensures that it is readily available on any Windows 10 or later PC, promoting accessibility.
4. Educational Use: Beyond troubleshooting, Quick Assist can be an excellent tool for remote learning and demonstrations. Educators and trainers can use it to guide students or trainees through software applications or processes in real-time.
Potential Security Concerns

While Windows Quick Assist is a powerful tool, it is essential to be aware of potential security concerns:
1. Unauthorized Access: One of the primary risks is the possibility of unauthorized access. If the Quick Assist code falls into the wrong hands, an unauthorized person could gain control of the user’s computer.
2. Sensitive Data Exposure: During a remote session, the helper can see everything on the user’s screen. If sensitive information is not properly managed, there is a risk of exposing confidential data.
3. Malware and Phishing Attacks: Cybercriminals might exploit Quick Assist to conduct phishing attacks, tricking users into downloading things or granting access to their systems under the guise of legitimate help.
Steps to Ensure Security

To mitigate these risks and use Windows Quick Assist securely, consider the following best practices:
1. You originate the conversation: You should ALWAYS be the starting point for support. This means that connection requests should come as a response to you asking for help, not the other way around. Never listen to someone that contacts you with a message like, “We’ve noticed something you should be aware of…”.
2. Verify the Helper’s Identity: Always verify the identity of the person providing assistance. This can be done through a trusted communication channel, such as a phone call or a verified email address, before starting a Quick Assist session.
3. Limit Access: It is possible to simply share your screen. Often the support tech only needs to see what you are looking at. If the support can be done without giving full access, don’t give full access.
4. Be aware of what is going on: This is a hard one but related to access above. Even if the tech asks you to type a command in, try to be aware of what it is doing. I get it, you’re not the expert, but if it doesn’t feel right, you may want to reconsider typing it in.
5. Monitor the Session: Keep an eye on the session at all times. Do not leave your computer unattended while someone has remote access. This vigilance helps ensure that no unauthorized actions are taken.
6. End the Session Promptly: Once the issue is resolved, end the Quick Assist session immediately. This action ensures that the helper no longer has access to your system.
7. Use Up-to-Date Security Software: Ensure that your computer has updated antivirus and anti-malware software. This software can help protect against any malicious activity that might occur during a remote session.
8. Regularly Update Windows: Keep your Windows operating system updated with the latest security patches and updates. These updates often include important security enhancements that can protect against new threats.
Conclusion

Windows Quick Assist is an incredibly useful tool for remote assistance, offering real-time support and ease of use. However, it is essential to be mindful of potential security concerns and take appropriate steps to safeguard your data and system. By verifying identities, monitoring sessions, and maintaining robust security practices, you can harness the full potential of Windows Quick Assist while ensuring a secure and productive experience.
July 17, 2024