If only there was a certifiable technical security standard like there is for home door locks and handles

Details

Category: Cyber Security (Personal)

The virtual cyber world and the physical security of your home front door are barely linked… if you don’t have IoT or any connected door locks that is! Before buying my first property I knew nothing about security options for front doors. A random topic you may think but read on and you will see my point. The front door on your home is often UPVC and has many components, for now let’s focus just on the Euro Cylinder lock and the door handle. The Euro Cylinder, everyone argues, is the weakest part of the door since it is the most exposed item and you can try to: drill it, bump it, screw it, pick it or snap it.

Euro Cylinders range from £10-£60 and come in standard, high and maximum security. High is 1* and maximum is 3*, these are British kitemarked and often come with Secure by Design as well. Door handles are either rated 2* or have no rating. You can either buy a 1* lock and 2* door handle to achieve the maximum 3* rating for your door security or just buy a 3* lock. If you have spent hundreds of thousands on a home (London of course), surely you can afford tens of pounds on a good lock and/or handle? The Kitemark or Secure by Design means it has been physically inspected for build quality and an assortment of physical attack tests have been run against the product before it gets a stamp.

Read more …

NHS ransomware: If 60+ hospital trusts can be taken down by mass market untargeted malware then what else has and can get through?

Details

Category: Cyber Security (Personal)

Let’s start off with this quote from government officials “And, we are not aware of any evidence that patient data has been compromised”. Derh! A malicious email (or new evidence, malicious comms over SMB) got through your defences, an exploit ran, malware was downloaded and the malware then went out over the internet to get a public key and then start encrypting. Focus on “malware then went out over the internet to get a public key”. If the malware reached out over the internet to get a public key it could have easily planted a RAT (remote access trojan) or uploaded files back to the CnC (command and control) server.

Back in October last year I published “Help we are under attack! Let’s create a hundred-page defence plan not actually roll out the big guns” on my website and with the major NHS ransomware incident in May 2017 I think I have proved myself right.

Read more …

Pulling apart a Trickbot banking trojan email

Details

Category: Cyber Security (Personal)

Rarely do I get emails with malicious attachments in or emails with malicious links embedded and when I do I love to see what is going on.

This afternoon (Tuesday) I received the below. It is fairly standard and partly believable however this is slightly different. Normally when you hover over the link it reveals some random domain which is made up of numbers & letters or just one which is hijacked.



The link shown was: https://companieshousewebfilling.co.uk/CaseC***********.zip.

Read more …