Category Archives: Security

VPN Vulnerabilities

NSA Releases Advisory on Mitigating Recent VPN Vulnerabilities

The National Security Agency (NSA) has released an advisory on advanced persistent threat (APT) actors exploiting multiple vulnerabilities in Virtual Private Network (VPN) applications. A remote attacker could exploit these vulnerabilities to take control of an affected system.

The Cybersecurity and Infrastructure Security Agency (CISA) encourages administrators to review NSA’s Cybersecurity Advisory and CISA’s Current Activity on Vulnerabilities in Multiple VPN Applications for more information and apply the necessary updates or mitigations.


What are ATPs?

ATP are stealthy cyber attacks where a person or a group gains unauthorised access to a network and remains undetected.

In most cases, these attacks are conducted by nation-state, or criminal organisations (see article there). Their purposes are to extract information, intellectual property, financial data and can be used to steal cask when banks are attacked.

Google Chrome Security Advisory

As reported by CERT New Zealand, attackers might be able to attack and take control of your computer if you do not have the latest version of Chrome.
You need to check the version of Chrome used. Anything earlier than 72.0.3626.121 is vulnerable.

How do you check if you are at  risk?

The instructions from CERT are:

“If you are on a laptop or desktop computer, open Chrome and visit chrome://settings/help. If you are not up-to-date, visiting the page should automatically update your browser.

If you are on a mobile device, like a mobile phone or tablet, open Chrome and visit chrome://version. If you are not up-to-date, visit your app store and download the update.”

Don’t take a chance. Check if you need to update, or use the latest version of Firefox.

As a general advice, you always need to update promptly any software installed on any of you devices to minimize exposure. An attacker would try to identify what you are running, then exploit whatever unpatched vulnerability encountered, as in this example.



Guide to good passwords

Guide to good password by CERTNZ
Guide to good password by CERTNZ

Be smart with passwords

Ideally, you want to use long, strong and unique password for each of your on-line account. The issue is how to remember them all. For that, you can use a password manager that will remember all your credentials in one place. Such a piece of software should also encrypt your database (password repository) and should beable to generate long random passwords.

You can then afford to only remember one password. Make it long and complicated, and above all, don’t forget it.

Example of password repository are Keypass and Lastpass. 

If you are using any other, let us know which one and why you chose it.

Would you compromise your computer for one cent an hour?

An excellent article from Andrew Smith, from the OU. 
What do you think? Looking forward to a discussion on the topic

Would you compromise your computer for one cent an hour? This study says you might

Andrew Smith, The Open University

There are many tales in literature over millennia about people selling their soul to a malevolent deity for the right price. But at least it’s usually a good price. Recent research has discovered that we are willing to compromise our computer for no more than one cent in income.

The researchers from the Carnegie Mellon University CyLab who carried out this work, tempted users by into downloading and, in many cases, actually running a Windows application on their computer. After they had agreed to take part, they were told that it was for an academic study but were given very little other information about the application. The application pretended to run a series of computational tasks and paid those who installed it one cent for every hour it was left running.

Even though a participant’s machine would give them a pop up warning when they started the download to tell them that this application wanted higher level access to essential security services, 22% of them went ahead and downloaded. And when participants were offered $1 per hour, that figure rose to 43%.

With more than 1,700 downloads, the application was run about 960 times, meaning that just over half of participants fell for the ruse. Alarm bells should have rung, but they were apparently not heeded.

The fact is, this application could easily have contained malware. Participants knew little about what they were installing other than it would pay them for their processing power but they didn’t seem to mind.

The ethics of this research are certainly potentially dubious. Individuals were lured into downloading this application for a seemingly good cause and we know nothing of their financial circumstances. It’s a scenario that many of us can recognise in one way or another, though. We may not get a financial reward for downloading applications but how often to we click away warnings so we can get an app that offers us some other incentive, such as access to free music or movies?

Crooks will be pleased to learn from this study that it is apparently very easy to trick ordinary computer users into hosting your malware.

It is an old adage, but it is still very important to remember – if it looks too good to be true, it probably is. Do not install any application without checking if the source is reputable. Free is often good, but with free on the internet comes with many risks. This is particularly true for sites offering access to illegal movies or adult content.

Whenever you download an application from any source, trusted or otherwise, you should complete a simple mental checklist.

Did I scan for malware just before I clicked to install the application? Is my operating system warning me about the security risks with this application? Did I scan my system for malware after I installed the application? And finally, do I have up to date anti-malware software?

This all may seem tedious, but it pays to be cautious. Recent incidents have taught us that there are plenty of people out there who will take advantage of anyone who hasn’t protected themselves properly. Whether this research shows that we just can’t be bothered to read the pop up warnings our computers send us when we click and install or whether it shows that we are even more willing to compromise our security in the name of a quick buck, it should make us think twice about how blindly we click. Just as any character in literary history will tell you, selling your soul rarely turns out to be a good deal.

The Conversation

This article was originally published on The Conversation.
Read the original article.

The ConversationCreative commons logo

What is Cryptography?

Cryptography is both the practice and the study of hiding information. This is an extremely important concept in network security.
There is an interesting set of video by Art of the Problem on this topic on YouTube

Part 1



Major Operation Against Cybercrime in the UK

Alleged Cybercriminals arrested

The National CyberCrime Unit at NCA has recently launched a major operation against Cybercriminals in the UK.  The operation lasted one week, and seventeen people were arrested. These people are suspected of using software designed to steal data from other people’s computer. This is part of a worldwide operation that has taken place worldwide against the set of malware tools named Blackshades.
The most used tool in the suite is called Remote Access Tool, and allows the crooks to take a computer over remotely. Other capabilities of Blackshades include being able to control the video camera, microphone, and to record the keys being pressed on the keyboard, allowing for example to record an internet banking session, password included. It is estimated that more than 200,00 password have been stolen via Blackshades worldwide.

How are PCs infected?

Users get their PCs infected by following a link that can be located for example in a spam email, a twitter post or a Facebook post. The installation is invisible to the user.

How can you protect yourself?

Do not follow links in an email if you do not know the sender. Do not trust your Facebook friends when then publish a link: either their account might have been hacked, or if they might have shared with you a link that  has already infected their machine.


Freebie: Introduction To Cybersecurity

Introduction to Cybersecurity

The computer networking students at  Manukau Engineering in Auckland have access to free self-enrol courses. One of these courses is Introduction to Cybersecurity. This is a 20 hour course, which require preferably  basic routing and switching knowledge. Training a cybersecurity workforce is a national priority for many countries, and the demand for these skills has grown three times faster than any other ICT job role. The Introduction to Cybersecurity course covers trends in cybersecurity and provides examples of the need for specialise skills in various industries.  The course integrates recorded presentations with activities, videos, and assessments.


Computer Course

After completing this course, students will be able to:
•    Explain the global implications of cyber threats
•    Explain the ways in which networks are vulnerable to attack
•    Explain the impact of cyber-attacks on industries
•    Explain Cisco’s approach to threat detection and defense
•    Explain why cybersecurity is a growing profession
•    Explain the opportunities for pursuing network security certifications

The Constant Evolution of the Cybercrime Industry

Interesting analysis on BetaNews , based on a report from McAfee

The cybercrime industry is refining its techniques to steal data

The Next Level in Hacking

Hackers have been able to access cars by building a device costing less than $30. The purpose was to be able to tune the car, which cost a lot if done commercially. Since the device needs to be plugged into the car, this is not wireless hacking. However, the device could potentially be used for malicious purposes, such as applying the emergency brakes, turn the headlights on or off and change the power steering controls. Let’s hope they do not add a wireless module to it.


Hackers Can Take Over Your Car With This Simple $26 Device

Jalopnik, 11th February 2014