Archives

Photo by Mauro Sbicego on Unsplash I was due to be going away this weekend so I had planned to delay publishing this until Monday; however due to a new national lockdown in the UK, I am no longer able to travel. The bright side is I have time to publish this at the weekend, small mercies. Google’s Project Zero discloses a vulnerability in the Windows Kernel October felt like a busy month for anyone dealing with Windows on their network; and was certainly a reminder of the value of a Defence in Depth strategy is key. To round off the month Google Disclosed a zero-day vulnerability in the kernel Cryptographic Driver that was being exploited in the wild. ...

Photo by marcos mayer on Unsplash IT moves to a zero-trust, decentralised model (Saturday) Looks like Google were on the right track with BeyondCorp as Coronavirus has very succinctly put the “impenetrable border” approach to IT Security on notice. With millions of knowledge workers able to be productive from home, but failing to get access to resources as VPNs and Identity and Access Managements solutions struggle. Threat automation, decentralized architecture among emerging post-COVID cyber trends | SC Media Checkpoint followed up a few days later with a series on videos on how their products could secure a remote workforce: ...

Photo by David von Diemar on Unsplash Cyber-villains Targeting Office 365 and G-Suite users (Monday) Given the impacts of COVID-19 and Working from Home a necessity for many in the industry; cyber attacks this week have leveraged vulnerabilities in well known brands including the RAC. The article has good advice for Security and Operations teams to configure their mail-filters appropriately: Breaking News: Massive Cyberattack Propagating via Redirector Domains and Subsidiary Domains |… Tesla AutoPilot can be tricked with subliminal messages (Monday) A couple of frames in a hacked video billboard video can trick a Tesla into taking inappropriate action: ...

Photo by Dmitry Ratushny on Unsplash I spotted an article on the SANS InfoSec Handlers Diary Blog where the author described a tool for Security Operations Engineers named Sooty: TheresAFewConors/Sooty It’s a command line tool predominantly seeking to put the day to day tasks of analysing attacks and enterprise defence at the fingertips of the analyst. As a tool it is very task oriented, when you run it you are presented with a list of options: ...

Photo by Sergiu Nista on Unsplash National Security vs. Privacy: Round 3 (Monday) T he battle between national security and privacy continues as the “Five Eyes”, plus India and Japan, reach out to technology firms pleading for ways to protect public safety. In the face of end-to-end encryption and other technologies nation states increasingly hitting brick walls when criminals use these services putting public safety at risk. This is an ongoing debate, and personally I tend to sit on the side of privacy and the personal protections it affords; however I think everyone recognises the need for public safety to some degree — I doubt this will get resolved any time soon. ...

Blue Screen of Death from Wikipedia Many IT administrators, DevOps, TechOps and SecOps in the UK woke up this morning, to a particularly nasty looking Patch Tuesday. Top of the chat is CVE-2020–16898 which has been dubbed Bad Neighbour by McAfee and Ping of Death by Sophos. Reality Check It’s worth realising that this particular CVE has no known exploits, however best case scenario a threat actor could craft a ICMPv6 packet to exploit the RDNSS component of the IPv6 stack built in tcp.sys; the net result a threat actor could cause a Blue Screen of Death (BSOD). There is a worst case scenario of course in that a threat actor could craft a packet that didn’t cause a BSOD, but did allow the actor to execute code against the target system, known as Remote Code Execution (RCE). In reality the worst case scenario is unlikely to happen anytime soon, or even ever as it requires a failure of many lines of defence. ...

Photo by Tadas Sar on Unsplash The first step is identifying the versions of the OpenSSH components we want to install, for this guide we will only be installing the SSH Agent, not the server. All of the following will need to be executed from a Elevated PowerShell Prompt. Get-WindowsCapability -Online | ? Name -like 'OpenSSH*' This will spit out two capabilities, we want the client: Name : OpenSSH.Client~~~~0.0.1.0 State : NotPresent Name : OpenSSH.Server~~~~0.0.1.0 State : NotPresent Which we can install with the following command: ...

Disclosure: This page contains Amazon Affiliate links; as an Amazon Associate I earn from qualifying purchases. Further information can be found in my disclaimer and privacy policy. Photo by Carl Cerstrand on Unsplash Apologies for the click-bait title, I do stand by my statement though. There is no such thing a NoOps, or DevOps, Production Engineering or DevSecOps for that matter! They are all words that describe our aspirations, passions and desire to innovate and identify as part of a tribe. The problem with all these “words” is they mean different things to different people; it’s a sad truism that: ...

Disclosure: This page contains Amazon Affiliate links; as an Amazon Associate I earn from qualifying purchases. Further information can be found in my disclaimer and privacy policy. Photo by Jonathan Daniels on Unsplash I took and passed my Google Certified Professional Cloud Architect exam in September; this was an achievement for me, not because I have not held these types of certifications before, but because I have next to no Google Cloud experience. The majority of my career has been based within the Azure Cloud with a little bit of AWS here and there, so starting my move into Google by taking an exam was not the path of least resistance. ...

Disclosure: This page contains Amazon Affiliate links; as an Amazon Associate I earn from qualifying purchases. Further information can be found in my disclaimer and privacy policy. Blogging has become a way of life for many, developers use blogs to record their learnings, journalists to cover news stories in a free form and personal style. However, my personal bug-bear with blogging has always been maintaining a hosting platform which is typically is cumbersome and awkward. Updates come thick and fast, and even when we keep up to date with all of the patches at some point, we get hacked and have to unravel the hack or start over. ...