Updating Windows Servers

You might think it is easy to update Windows servers, but apparently that is not always the case. It is easy to simply “check for updates” when you first install a server, and then forget about it.

Which is the wrong thing to do.

The first thing to do is to make sure you are installing updates automatically :-

It may be that your server will eventually become something important enough that it will be sanctioned for manual patching during monthly maintenance windows; even so you should start with automatic patching and switching to manual patching is part of making the server “live”.

You can also alter the maintenance window, but the default option is usually sensible (03:00 nightly).

The next step is to configure Windows Update to check for updates to other Microsoft products which seems to require an Internet connection suitable for web browsing. If you are running a server on a server network (and you should be), then this requires the proxy to be configured :-

The address for the proxy server is “wwwcache.port.ac.uk” on port 81 (obviously only if you’re on campus). Once that is configured, you can click on the “Find Out More” link on the Windows Update settings page (this is shown at the bottom). This opens up a web browser that allows you to click on a license acceptance page before changing your server’s settings (and if you’re not somewhat taken aback by a web page being able to change your server settings, you’re not thinking “security first”).

The final step is really a warning about what happens when adding a role and/or features to Windows; there are usually updates to apply after that has happened. Below is a screenshot of the result of running “check for updates” after adding a role to a server :-

Before the new role was added, the same screen showed that it was fully patched!

There is a great deal more to updating Windows servers than this, but this should be sufficient to get started in a less than totally insecure way.

Posted in Technical | Tagged , , | Comments Off on Updating Windows Servers

The Ukranian Ransomware (Petya, NotPetya, WannaCry2)

Those keeping aware of the security scene may well have become aware of the latest ransomware worm hitting around the world. Various names have been associated with this outbreak, and the most readily identifiable name (Petya) is technically incorrect.

This is a classic ransomware infection with the added bonus of the ability to cross-infect machines on the local network using both the vulnerability that WannaCry exploited (“ETERNALBLUE”) and another Windows vulnerability that allows an attacker (or a piece of malware) to execute code on a target computer using compromised account credentials.

Once infected, the ransomware stays hidden whilst it starts encrypting files. This example also forces a reboot after an hour at which point it displays an information page :-

At this point it is too late (especially as the address wowsmith123456@posteo.net has been shut down). Paying to decrypt your files is unlikely to be effective (and is unethical).

Now for the good news :-

  • It appears that this spreads through local networks and not via the Internet.
  • It is probable that the initial infection occurs through a compromised update to a piece of Ukrainian tax software.

So in all likelihood, we are relatively safe from this infection.

However ransomware is incredibly disruptive when it performs a cross-infection like this or WannaCry and it seems likely that this kind of incident will be repeated. So we have to expect to be targeted in the future.

Whilst we already have protection in place, and will be looking to increase those protections, there are no guarantees that a widespread ransomware infection will not strike us.

For further information there are numerous sources of information – the first in the list are relatively light in terms of technical content :-

Posted in Active Attacks, Malware | Tagged , | Comments Off on The Ukranian Ransomware (Petya, NotPetya, WannaCry2)

WannaCrypt or the NHS Worm

As many of you will be aware, the NHS suffered from a mass outbreak of a ransomware worm last Friday which has since spread to many other organisations around the world. For more general information please see The Register’s article which is a good summary and links to more detailed works.

For various technical reasons we may be somewhat better protected than some organisations but it is also possible we may also fall victim to this. To help IS it would be helpful if you were to :-

  1. Be especially wary of unexpected mail attachments. The attack was alleged to have started with an emailed attachment. Even if the attack did not start via email, being wary is still good advice.
  2. Be especially wary of offers of protection. Even if they are from “Microsoft” (they likely are not). Scammers will use this opportunity to drag more money out of their victims.
  3. If you happen to be running an un-managed Windows system, please make sure that it is properly patched as soon as possible. In particular MS17-010 should be installed.
    1. In a small number of cases, managed Windows workstations may still be vulnerable if they have not been turned on and/or rebooted since the patch was released. Such machines should be rebooted as soon as possible.

How It Works

The initial infection will either occur via a malware infected email (once it is read or in some cases previewed), or via a vulnerability in the Windows file-sharing network protocol. There is currently no evidence to show that it started with a malware infected email (which we would normally expect at this stage), but neither is there evidence to show that it did not.

Once infected, the malware will try to encrypt files on all reachable drives and try to infect neighbouring machines using the previously mentioned Windows file-sharing vulnerability.

In circumstances where this vulnerability is very widespread, an entire organisation can be brought down.

The “Kill Switch”

The original malware would not try to infect a host if it successfully made a connection to a certain website address. This was an attempt at making it harder to analyse, but in this case failed.

A security researcher registered the relevant DNS domain so that connections were successful in what turned out to be an attempt to slow down the rate of infection.

However it may very well be the case that later versions of the malware have been released without the “kill switch”.

Posted in Active Attacks | Comments Off on WannaCrypt or the NHS Worm

Keeping Your Account Safe

We are seeing an increase in the number of compromised accounts due to various forms of attack, and decided to highlight some core protections for your account. If your account is compromised, you may find yourself locked out of the account at an inconvenient time (Google does this automatically), find yourself sending huge quantities of spam, or more serious repercussions.

So it is well worthwhile sticking to at least some but preferably all of the following safety tips :-

  1. Use a long and strong password for your account.
  2. Do not share passwords – neither with other people nor with other sites. Your ebay account should have a different password to your University account.
  3. Avoid using your University username on other sites. If one of the other sites is compromised and the account details leaked, it can look like your University account is also compromised.
  4. Enable two-factor authentication.
  5. Be wary of entering your account credentials into a web-based form. You of course need to authenticate to use Google (for example), but you need to be sure it is actually Google asking for authentication.
  6. Don’t follow email links and enter your account credentials. In fact be very careful about following links in email full stop. And yes that applies to trusted correspondents too – once someone has their account compromised, one of the first things to occur is the attacker will use their account to email a form to everyone asking them to login.
Posted in Active Attacks, Passwords | Comments Off on Keeping Your Account Safe

‘Phishing’ Emails With Your Home Address

This article is currently being drafted, and will be added to over time. In the meantime, Sophos have an article that goes into some detail about what is going on here. Some key points :-

  1. Don’t click on the encrypted attachment (named something.dot).
  2. Don’t decrypt the attachment.
  3. To the best of our knowledge, the personal data contained within the email is from web site data leaks – which web sites is unknown.

The email in question can be identified because it :-

  1. Contains your residential address.
  2. Has a password-protected (and encrypted) attachment and the email lets you know what that password is … very poor security.
  3. The language of the email is odd.

The attachment itself contains Word macros which (when enabled) in turn pulls down some malware to infect your computer.

Posted in Active Attacks, Email | Tagged | Comments Off on ‘Phishing’ Emails With Your Home Address

Is IS Aware Of What Password You Have?

One of the more interesting questions that arose from the recent password audit is whether IS is aware of account passwords – i.e. do we know your password.

The short answer to that is: No, but with a caveat.

First of all, only one person in IS has any authorised access at all to any disclosed passwords. The password auditor (that’s me).

Secondly, only weak passwords are available. Strong passwords – those passwords that cannot be “cracked” within a reasonable time-frame – are not available.

Finally, I don’t want access to the passwords, so although I have theoretical access to the weak account passwords I make sure that the association between usernames and passwords is broken very quickly – I may know that “fred” has a weak password but not what password it is, and I may know that X is a widely used password, but I don’t know who uses that password.

Posted in Passwords | Comments Off on Is IS Aware Of What Password You Have?

How SHA-1 Is Broken

(This gets very esoteric very quickly)

Those of you paying attention may have realised that very recently (January this year), browsers started complaining about security when connecting to sites whose SSL certificates used the SHA-1 hashing algorithm within the certificate. This was due to a theoretical weakness in the algorithm known about as far back as 2005.

What has changed since then is that Google researchers have now demonstrated the attack, and whilst it is not practicable (with the possible exception of nation state attackers), it is now well past time that SHA-1 was gracefully retired. Especially when you consider that a methodology that is not sensibly practicable today may well be usable in 5-10 years.

SHA-1 is a cryptographic hashing algorithm whereby any individual lump of data can be uniquely expressed with a single hash and no other lump of data can share that hash value. Or more precisely it is difficult to generate a collision whereby two lumps of data hash to the same value. If you run a SHA-1 tool against a file, it should return a unique value unless the file is identical :-

The first command shows incorrect behaviour whereby two different files result in identical hash values; the second command shows the correct behaviour demonstrating that the files contain different contents.

In practice, an attacker would have to produce a lump of data that generates the same SHA-1 hash value as a the lump of data that she wanted to ‘impersonate’, which has not been demonstrated. Google’s researchers have simply generated two lumps of data which generate the same SHA-1 hash value … which is somewhat easier.

Cryptographic hash functions are used as a building block to build secure cryptography, and using a weak hashing algorithm will fundamentally result in less secure cryptography.

Posted in Technical | Tagged , , | Comments Off on How SHA-1 Is Broken

Phishing: What To Do In The Aftermath

In the event that you have given away your account details in response to a phishing attack, and either discovered yourself that your account is compromised or you have been told so by IS, then there are some steps to take in the aftermath :-

  1. Change your password to one that is long and strong.
  2. Turn on “two factor” authentication.
  3. Check the signature set for your account; phishers are known to have set inappropriate signatures to be attached to all outgoing emails. The quick check? Send a quick email to your personal email address and check what the signature says.
  4. Check the “rules” for incoming email messages to make sure nothing has been added. Phishers have been known to set up new rules to delete all incoming messages.


Posted in Email, Passwords | Comments Off on Phishing: What To Do In The Aftermath

Don’t Automatically Trust Email!

Email is a very easy to forge – so easy that if you try to impress a hacker by claiming to have forged email, they’ll fall about the floor laughing. So you should not automatically trust email – there are usually indicators showing the origin is suspicious …


This example is a bit obvious and not only because it has a big warning added by Google :-

  • Look at the email address (“Golan <jjulio@unifap.br>”) – why does the email address not match the name? The name at the end of the email is “Ella Golan” which is included as a comment to the email address, but bears no relation to the actual email address (“jjulio@unifap.br”). Now legitimate emails can have this signature, but it is a useful indicator.
  • The email contents mention Israel, so why is a Brazilian email address being used – the .br at the end of the domain name is a country-based domain using the ISO 3166-1 two letter country code.
  • The subject (“Hey”) is informal to an extreme degree (as well as an example of a poor subject), yet the contents of the email are formal. Suspicious?
  • The wording of the actual email itself are somewhat odd. Of course people don’t always write perfect English, but it is still a useful indicator.

The more dangerous emails tend to be ones that ask you to do something directly :-

Good Day

Please do check attached document
It is secure via Adobe file
Awaiting to read from you
Many thanks


Again the English is a little odd. But there are still some additional indicators here :-

  • Is it usual for an attachment to be included? And without mentioning anything about what is inside?
  • Secured by something written by Adobe? Well that is probably more a security insider’s joke. But do you commonly deal with attachments secured in this way?
  • If it is supposedly from someone within your organisation, why are they not using your organisation’s method of sharing files?

The key thing to grasp is that email itself cannot be trusted, but emails not worthy of trust often give themselves away in little ways. Learn to pick up on those untrustworthy little ways, and mark each email with a trustworthiness score … and if it comes out as a bit suspicious, try contacting the sender to confirm they really did send it.

You can of course always ask a colleague to check the email as well.

Posted in Email | Comments Off on Don’t Automatically Trust Email!

Analysis Of A Phishing Attack

The following is the analysis of a real phishing attack that we have seen, together with some indications of how a phishing attack can be detected. For the impatient, some of those indicators are listed below :-

  1. Are you expecting to receive a document from the person sending it? You may want to check back with them to be sure they really intended to send it.
  2. Don’t open suspicious attachments, but if you do, does it contain something sensible? Sending a PDF document containing a link to a shared cloud storage folder doesn’t actually make sense – the link could be contained within the original email.
  3. Are there inconsistencies in the words? For example does the message mention Google Drive, but the link say Dropbox?
  4. Don’t follow suspicious links contained within suspicious attachments, but if you do, and it takes you to a Google logon screen :-
    1. Are you already logged into Google? You shouldn’t need to re-authenticate that quickly.
    2. Does it actually look like the Google logon screen? It might look similar but are there differences?
    3. Does the location bar (where your browser shows the address of the current page) mention Google? If it doesn’t, back away from the page slowly.
    4. Does the location bar contain a green padlock? If it doesn’t, your login credentials won’t be encrypted which is very suspicious.

And onto the analysis …

A number of people received an email “from” someone at the University containing a PDF attachment together with a suggestion that it contained something worth reading. Opening the attachment from a previously unknown correspondent and with an oddly worded email was the first mistake.

If you do receive such attachments, it is worth checking with the sender to see if it is legitimate.

If you do make the mistake of opening it, the first odd thing to notice is that the attachment is named “Scan…” but contains content that obviously isn’t scanned :-


So if this is a google drive document, why isn’t it being shared in the normal way? Which looks more like :-


(I’ve erased the name of the sharer and the name of the document)

In addition, if you hover your mouse over the button you get a pop-up with the link address in :-


So the text says “Google Drive” and the link says “Dropbox”? Another suspicious indication.

If you download the link from Dropbox (in a controlled manner!), the “document” is actually a web page with a base64 encoded content (with a page title of “Zeuxhaxor” (if that doesn’t look suspicious to you, your suspiciousness needs tweaking)) that sends you onto another web page hosted at http://freecabin.net/.

If you visit the page, you end up faced with the following (without the hand-drawn lines) :-


This also has plenty of indications that something is wrong :-

  1. Aren’t you already logged into Google? Why do you need to login again?
  2. Look at the location bar (where the two black hand drawn lines are): Why is the address “freecabin.net”?
  3. Look at the location bar again: Where is the green padlock you would see on a secure page? Do you really want to send out your username and password insecurely?

Phishing attacks are intended to dupe you into leaking your username and password combination, and as such the attacker tries to make things look as authentic as possible. However there are usually many small signs that something is wrong – at least wrong enough to check with someone before you leak your account details.

Posted in Active Attacks, Email | Tagged , | Comments Off on Analysis Of A Phishing Attack