We have found a possible IED (bomb) left suitcase, let’s move it around and open it!

Details

Category: Cyber Security (Personal)

Whenever I am walking around subconsciously I spot security flaws or mistakes, be it physical or information technology wise. Yesterday while coming up the escalator of a prominent zone one station I spotted a British Transport Police officer (not a community support officer) following two Transport for London staff into the control room. The officer was fully uniformed and the two TFL staff next to him seemed to be station supervisors or similar.

One of the three men were wheeling in a suitcase to the ticket hall control room, then the TFL staff member pointed at it, the officer examined it from the outside and then started to unzip it. What has just happened? In my view the station staff have found an unattended suitcase, they moved it manually to the control room and then called a BTP officer to help... who looks at it and starts to open it.

Hello!!! This could have been a real IED (improvised explosive device) or bomb in old fashioned English thus moving it around and opening it is not a good idea.

eDéjà Vu: Mossack Fonseca (Panama Leaks) and sudden switch to Incapsula

Details

Category: Blog

In July last year Ashley Madison was breached (somehow) and they switched to CloudFlare shortly afterwards - see: https://www.datasecurityexpert.co.uk/2-blog/276-ashley-madison-hack-and-cloud-flare-it-is-too-late-to-beef-up-your-security.html



Mossack Fonseca has done exactly the same among reports their website was to blame for the intrusion and leak.

CloudFlare and Incapsula (rivals) are cloud WAF (web application firewall) service providers.

Pulling apart a mass market personalised malware debt invoice email

Details

Category: Cyber Security (Personal)

Every few days myself and everyone else on the planet (apart from Kim Jong-un land) receives phishing and malware emails. The good thing is they are often not personalised so we get used to them. Over the last few years’ malware and spam writers have clocked on to this fact.

Today I received a decent attempt at personalising a malware email which would likely convince most people though not me of course! Think about it if the below would convince the average business or IT user then spear phishing would have nearly a 100% chance of working if planned and executed correctly.


Good it maybe, there are some giveaways: from a "prize company" not a debt collection agency, subject is my name which could say debt for Graeme Batsman, GBP not £, Danish URL for a British debt, my post code could be on a new line and no full stop on the final line.

Read more …