Category: Uncategorized

What is Phishing?

Posted on by Griz

Phishing is a type of cyber attack in which an attacker tries to trick a victim into giving away sensitive information such as usernames, passwords, credit card numbers, or other personal data. Phishing attacks typically occur through fraudulent emails, text messages, or websites that appear to be legitimate but are actually designed to deceive the victim.

The attackers often use social engineering techniques to make the message or website seem convincing, such as creating a sense of urgency or fear, or impersonating a trusted entity like a bank, a government agency, or a popular online service. They may also use fake links or attachments to download malware onto the victim’s device.

Once the victim is tricked into providing their sensitive information, the attackers can use it for identity theft, financial fraud, or other malicious purposes.

To protect yourself from phishing attacks, it’s important to be vigilant and skeptical of unsolicited messages or websites that ask for your personal information. Always verify the legitimacy of the message or website by checking the sender’s email address, the website URL, or contacting the organization directly through a trusted channel. Additionally, enabling two-factor authentication and using anti-phishing software can add an extra layer of protection to your online accounts.

What are red flags when it comes to phishing?

Posted on by Griz
There are several red flags that can help you identify a phishing email. Here are some common ones:
  1. Sender’s email address: Check the sender’s email address carefully. Scammers often use fake or spoofed email addresses that may look similar to a legitimate email address but contain spelling mistakes or extra characters. Also, be cautious of emails that appear to be sent from well-known organizations but are sent from free email services such as Gmail or Yahoo.
  2. Urgent or threatening language: Phishing emails often use urgent or threatening language to create a sense of panic or fear in the recipient. They may claim that your account is at risk or that there has been suspicious activity and ask you to take immediate action.
  3. Suspicious links or attachments: Be cautious of links or attachments in emails, especially if they are from unknown or suspicious sources. Hover over the link to see the URL it is directing you to, and check for misspellings or unusual characters. Do not click on any links or download any attachments that seem suspicious or unfamiliar.
  4. Request for personal information: Phishing emails often ask for personal information such as passwords, credit card numbers, or social security numbers. Legitimate organizations usually do not ask for this information via email, so be cautious of any requests for personal information.
  5. Poor spelling and grammar: Phishing emails may contain poor spelling and grammar, as scammers often operate from non-English speaking countries.
If you notice any of these red flags in an email, it’s best to delete the email and not click on any links or provide any personal information. It’s always better to err on the side of caution when it comes to suspicious emails.

What is Malware?

Posted on by Griz

Malware, short for malicious software, is any type of software designed to harm, disrupt, or damage computer systems, networks, or devices. Malware can be created for a variety of purposes, such as stealing sensitive information, gaining unauthorized access to systems, or damaging or destroying data.

Some common types of malware include viruses, worms, Trojan horses, ransomware, spyware, and adware. Each type of malware has its own specific characteristics and methods of infection.

Viruses are programs that infect other files on a computer and can spread to other computers via networks, email attachments, or infected websites. Worms are similar to viruses but can spread independently, without the need for a host file.

Trojan horses are programs that appear to be legitimate but contain hidden malicious code. Ransomware is a type of malware that encrypts the victim’s files and demands a ransom in exchange for the decryption key.

Spyware is a type of malware that is designed to spy on the victim’s activities, such as monitoring their keystrokes or stealing sensitive information. Adware is a type of malware that displays unwanted advertisements on the victim’s computer.

To protect yourself from malware, it’s important to use antivirus software, keep your software and operating system up to date, and be cautious when downloading or installing software from the internet. Additionally, avoid clicking on suspicious links or opening suspicious attachments in emails or messages.

Password Security

Posted on by Griz
As I pondered how to best discuss password security, I wondered if I could find a nice history of when passwords came into use and how badly they have been handled over time. Little did I know, we have been quite bad with them since their inception. The resource I found for the subject did such a wonderful job that I am opting instead to wrap his original work into this post. Major credit and props to Troy Hunt for his wonderfully crafted article, https://stealthbits.com/blog/a-history-of-passwords/. I do hope that you will give it a full read and perhaps click on an ad while you are there to show appreciation of his work. I have also been a fan of another piece of his work; https://haveibeenpwned.com/ which is a site that I have used many times. This is a site that will tell you if your email address has been discovered in one of the many multitudes of email/pswd caches out there. If you find your email address is listed there, just reset your password and move on. There is no cause for alarm unless you have that email address tied to something like… your back account. Now if you are one who abuses password by reusing the same one all over, then you may have an issue. If that is the case, then it is time that you start changing up those passwords so that one compromise doesn’t hand over the keys to your email kingdom. Oh I can hear you know… but I don’t have anything worthwhile in my email box, nothing that anyone would find interesting. Sound familiar. think of all of the places that you give your email address to in order to log in or perhaps to verify your existence. How many accounts do you think a black hat hacker could gain control of just by being able to lo into a web mail utility somewhere posing as you with your oh so clever password (yeah Password1)? Really read Troy’s article, drink it in as it will help you understand why passwords are a bigger deal than you may think. If you want to discuss the topic more, please, drop a comment below. If you liked this article, please come back for more and feel free to mash an ad on your way in or out to help the cause.

OSINT and leveraging the internet to your favor

Posted on by Griz

More than likely even if you do not know the term OSINT, you have used it. If you have dated modern women, it has likely been used against you.

OSINT is open source intelligence. Have you ever “Googled” someone or yourself? Then you have used OSINT. Open source intelligence is using any publicly available information to gather information about a person or organization.

The reason for your search will determine what tools are best for you. Sometimes it is any number of search engines like Google, Dogpile, Bing, Duckduckgo, etc.

When my daughter started dating, she cautioned at least some of the guys that they would be background checked. Now some parents may pay for these name check sites, but my wife and I have learned to use OSINT and do the digging for free. I was able to find stuff that one of the guys did not even know existed (or wouldn’t fess too as he was a crap fest). Once you have gathered your notes form the basic web searches, you can start in with the local civil and criminal courts. I am in Washington State where we have some good searchable resources open to us. Check your area to see what you have access to. Use your own name to see what can be found (without being in law enforcement). You can piece together a fair idea of their character. Are they a felon? perhaps a sex offender, or just a ton of civil cases for not paying bills etc. You could find bankruptcies, evictions, or simple disputes. Some of these results will require a trip to the court house to get more details that are all in the public record. Leaving home may not be technically OSINT as you may have to pay for access to the data.

As you start your adventure into OSINT, I hope that you bookmark the best sites that you find. As you practice, you will go back to those favorite sites and become better with your search patterns. Before you know it, you will be a world class information excavator. (see also, the skills of a suspicious wife/girlfriend)

Remote Access Scams

Posted on by Griz

It always takes me by surprise when I hear of friends and acquaintances who have permitted email contacts of phone callers to have remote access to their systems.

We spend a great deal of effort to safeguard our networks and systems. We protect against hackers, malware, etc. but then pay bad actors to log into our systems and give them a master key. Why?!?

The premise is often “Microsoft” or some other well known name has detected an issue with your system. One of the reasons that I have had hopeful scammers use on me was that there was a DNS issue on my computer that they needed to fix. They only wanted $320 (or something close to that) to log in and repair the damages. With the experience that I have, I give them a fun run around. I was surprised to learn that my wife was doing the same thing when they would call her. The best part is that she would play the dumb wife card while doing it. I wish I could do that… We would run them all over the place as they tried to walk us to where we would allow remote access only to have my wife or I tell them that we were not running Windows. My wife would claim we run CentOS, or I would pick an obscure OS of the day. Sometimes it was FORTH, other days it might be FORTRAN, perhaps it was Pascal. I would call them back and burn as much time as I could so that they could not hound on someone less skilled. I have been told that I was no longer allowed to call them. That was fun.

Bottom line, these people are trying to take multiple swings at you. The first swing is to get you to pay them for their “service” then later they would access your system and get whatever information that they could to attempt access to your bank, or other services. They could also install any number of malware packages to your machine to make it a willing slave to their needs at any time of the day.

Do not…. ever grant remote access to your machine unless you are the one initiating it, or if you are working with a known entity such as your employer’s helpdesk.

Are your smart devices listening to you?

Posted on by Griz

Let’s start our posts off in a fun way. A way that you can play along at home.

I am sure that you have heard that websites use your browsing history to spy on where you browse, and what you search for. You likely know that your smart devices use GPS to track every move that you make while you carry them.

Did you know that they are actively listening to you also? Yes, they are like a little surveillance team that you willingly share some of your deepest secrets with. You know, the ones that you only tell your dog, cat, or maybe your plants as you water them? On the surface, we all must know that they listen. How else would Alexa hear your playlist request? Cortana and Siri are the same way, they are constantly sucking up the nuggets of voice and recording it.

If you want to prove that what you verbalize is being sold off for advertisers’ consumption, it is not too hard. This is where you get to play along at home. If you want, draft a partner to be your co-cyber-sleuth.

To maintain the integrity of this experiment, I am not going to suggest the subject of your test.

Here is the lab experiment:

Lab Requirements

  1. A smart device; Alexa, Siri, smart phone, or any other internet connected device with a microphone.
  2. Pen and paper
  3. If you are using a lab partner (or perhaps a group) you will need to communicate with the pen and paper to decide upon a product on the market that you have not searched for. This is going to be your target. Do not discuss it verbally at all while you decide.

Now it is time to conduct your experiment. Whether you are alone, as a pair, or team it is time to have a three to five minute discussion in the presence of your smart device about your subject. You might discuss brand names, qualities about the product, and possible vendors of the object.

Wait for thirty minutes to an hour, then open Facebook and scroll through your feed and watch the ads content. Did the test subject appear? If it did not, please drop a comment below letting me know of what your test subject was, and what device you were testing. If your test subject DID appear, please consider clicking on one or two of the ads on this page.

Does that sound fair? I look forward to hearing your results.

Topics For Us to Cover Over Time

Posted on by Griz
In the cyber security realm, there is always something to learn, share, and teach. We have to learn on a daily basis what the criminals have gotten into. It isn’t enough to know what they did, but HOW they did it is the important so that we can find methods to prevent them form doing it again. As users, we get tired of update after update coming along and making us reboot. Those updates are often critical. They make your operating system more secure. The reboot not only makes them take effect, but also may break the connection so that the crook cannot get back in when you reconnect to the internet. With that in mind, let’s build a list of topics that we should discuss as we progress down the path of cyber education. If you have any that you would like to cover, or cover sooner than later, please let me know in a comment. If you have a topic that is not on the list, I will add it.
  • Phishing – Starts here: https://cyber.pissedoffpirate.com/phishing-emails/red-flags/
  • Vishing
  • Smishing
  • Malware
  • Ransomware
  • Identity Theft
  • Information Protection
  • DoS/DDoS
  • Online Predators
  • Online Harassment

Password Reuse and You

Posted on by Griz
We could talk about password strength and safety first, but it is likely that you have heard that time and time again so I will slide that one down the priority list a bit. There are storehouses of passwords that belong to compromised email addresses. You may have gotten a phishing email that claimed to have your password. One that I have seen provided a somewhat censored version of one of my old passwords.This typically comes with a ransom demand. The way that these situations happen is the result of human nature. It is all too easy to use the same password on all of your online accounts. They keep increasing the password complexity and there are so many to keep track of. When a website that you use gets hacked and the username/password database gets stolen that data gets sold off. The majority of Americans bank at one of five major financial institutions. If the criminals have control of your email address (or as we say in the industry, pwns) they can get passwords reset. If they get as far as getting your bank password, where does that leave you? It doesn’t take much imagination to see how bad that can be. If you have a list of usernames/passwords it is like having a ring of keys. You can do some poking of common email providers and other services to see if those usernames and passwords open the door allowing criminals inside. Has your email password ever been compromised? Maybe you had to change your email password because you started getting weird email bounceback messages. Would you like to see if your email address has been discovered on a list for sale, or just out for public consumption? Try this link. (I have a few email addresses that have been blown, so don’t feel badly about being listed.) https://haveibeenpwned.com/Passwords Where do you go from here? Regardless of being compromised in the past or not, you can help protect yourself from this moment forward by starting to use different passwords for each account. This is where a tool to track your passwords in a secure manner is important. There are many password storage tools out there. Some are subscription based, some are free. This is not an endorsement, but I can say that I have had good experience with Password Safe. Some of the important aspect to consider is that the tool stores your usernames and passwords using encryption, and that the tool is easy for you to use. If it is not easy, you won’t use it. Please feel free to share your experiences in the comments. Maybe you have a password storage tool that you feel is wonderful, share it with the group. I am always happy to look over new products. Perhaps your input will give the rest of us a better tool to help us in staying safer. Enjoy the day, and be good to those around you.