The Anti-Phishing “Gold Star”

Recently a query to a UK HE security list came with a link to which gives us a classification of “Security rockstar” for anti-phishing security measures :-

(The “DKIM” green flag only shows up if you upload an appropriate DKIM key).

Whilst it might be a bit of an exaggeration, we do compare quite favourably with the rest of the UK HE sector – only 11 organisations have a green shield under “DMARC”, but there is room for improvement as we have yet to implement DNSSEC.

The Phishing score card is published by “Dmarcian” who are behind the creation of “DMARC”. All three (DMARC, DKIM, and SPF) are a combination of technologies built on top of the basic email standard to make it harder for email addresses to be forged.

DNSSEC is slightly different in that it secures the DNS making it harder to forge DMARC, DKIM and SPF records within the DNS.

Posted in Email | Comments Off on The Anti-Phishing “Gold Star”

Keeping Secret Google Meetings Secret

It is possible that some people are unaware (certainly I wasn’t; at least not this week) that it is possible that information about meetings can be seen not by looking at someone’s shared diary but looking at the room booked.

Specifically you can see the subject and the agenda of meetings (if it was included) if you can view a room’s “diary”.

If you happen to set up meetings that involve sensitive information, you may want to be aware and either do not include any sensitive information in the meeting subject/agenda (the one within the Google calendar). Or …

Whilst setting up a meeting, you can change the visibility of the meeting from “Default visibility” to “Private” and the details of your meeting will not show up. See :-

The relevant drop-down appears alongside “Busy”.

Just for the record, I’ve never booked a meeting with a location specified as vaguely as “Somewhere with a bar”.

Posted in General | Tagged , , | Comments Off on Keeping Secret Google Meetings Secret

Careful With That Link Eugene

Over the last few weeks, I have noticed an increasing number of very suspicious looking links blocked by our “DNS firewall” – links like “”.

The suspicion is that people are being sent emails with links within and they are clicking on the links for further information rather than checking the link first and refusing to follow the link because the destination looks suspicious.

Check the link you are about to click on! And if it looks suspicious, don’t click on it.

When your mouse “hovers” over a link, the status bar at the bottom of your browser (Firefox and Chrome at least) will show the address it will take you too :-

It is not as conveniently obvious as a pop-up display of the link you are about to click on, but it does make it possible to check links in (for example) emails.

As to what makes a web address suspicious, that’s more of an art than a science but some indications :-

  1. If it includes nonsense strings of letters (such as “xwhdg”).
  2. Anything embedded within the string of labels which tries to hurry you up (“click-now”) or encourage you (“read-this-hot-stuff”).
  3. Any domain that ends with a word (“.today”) rather than the old country specific domains (“”) or organisation types (“.com”, “.org”, or “.net”) probably gets a ½ point towards suspicious.
Posted in Email, Firewall | Comments Off on Careful With That Link Eugene

‘Shoulder Surfing’ or Is Your Screen Showing Others Information It Shouldn’t?

Every time I travel by train during working hours, I get reminded of the old “shoulder surfing” attack; a surprising number of people are working away on their laptops seeming unaware that anyone peaking over their shoulders has a good chance of catching what they are doing.

Which is all very well if it is something innocuous, but what if the work involves sensitive information?

It may seem unlikely that any serious compromise could take place in such a way, but it has been known to happen. Besides it’s a good excuse to put away the laptop and get on with something more fun.

Posted in General | Tagged | Comments Off on ‘Shoulder Surfing’ or Is Your Screen Showing Others Information It Shouldn’t?

Imaging PCs for Offline Analysis

This is going to be a technical post with requirements for access rights that most people do not have, so it can be ignored. The intention is to file this information in a place that can be widely seen for the benefit of others needing this information.

In some circumstances, it can be helpful to “clone” a hard disk to a file image that can be used independently of the machine itself. This list of actions indicates how it can be done in the UoP environment :-

  1. Make some firmware changes :-
    1. Turn off ‘Secure Boot’
    2. Enable ‘Network Booting’ (not sure why it’s ever disabled)
    3. Enable “Legacy booting” (as many ipxe recipes require it)
  2. Turn off BitLocker encryption (an encrypted blob is tricky to analyse) :-
    1. Start → Control Panel → System and Security → BitLocker Drive Encryption
    2. Select drive, and “Turn Off BitLocker” (presumably needs admin)
    3. One turned off, the laptop becomes toxic and must remain on site in a physically secure environment.
  3. Perform the imaging :-
    1. Boot off the network (PXE)
    2. Continue to the iPXE menu and (currently) the testing menu.
    3. Select “Ghost for Linux” (either 1 or 2)
    4. Go through the wordage and select backup to a local filesystem – turn
      off compression (the default of “lzo” is rather useless and the usual destination performs compression transparently).
    5. Start an sshfs (sshfs username@
    6. Create an image name – YYYYMMDD-description.img
    7. Start the backup
    8. Restore firmware settings.
  4. Turn BitLocker encryption back on.

Posted in Technical | Tagged | Comments Off on Imaging PCs for Offline Analysis

Zoom Desktop Vulnerability for macOS

Update: Apple is now silently pushing out an update to remove the Zoom “hidden feature” so you will be please to know that the geeky removal is no longer necessary. Just make sure you have opted in to all recent updates from Apple, and let it “phone home” for malware updates.

Update 2: It turns out (not entirely unexpectedly) that the little web server that Zoom installs is not only a vulnerability in itself, but it is also vulnerable to exploitation allowing an attacker to do just about everything with your computer that you can.

Update 3: In addition to Zoom, it seems that Bluejeans and Ring Central for Meetings may be licensed copies of Zoom and also install a little “helper” web server. It should be assumed that they are similarly vulnerable.

According to the security researcher who found the vulnerability (warning it gets quite technical quite quickly), when you install Zoom – usually at the last minute before a conference call where it is suggested that you install Zoom to show presentation slides – you open yourself to a vulnerability that allows a rogue web site to open your webcam without notification.

Indeed the vulnerability is still present after the Zoom client is removed in the ordinary way. Zoom apparently in addition to the actual client software also installs a web server to make re-installing the client software easier. On the down side, a malicious web site can redirect requests via that web server.

Not good news!

The current Zoom response amounts to “make sure your web cam is turned off” when inside the Zoom client (‘go into the Zoom settings window and enable the “Turn off my video when joining a meeting” setting.’)

Which doesn’t seem quite adequate.

The currently known fix for removing that hidden web server is unfortunately limited to terminal commands :-

$ sudo lsof -i :19421
{Look for the "PID" of the process listed - which may be nothing}
$ sudo kill PID
{meaning enter the number you used previously}
$ rm -rf ~/.zoomus
{if you want to be ultra cautious you could rename it instead: mv ~/.zoomus ~/that-dodgy-zoom-thing}

In addition you will want to remove the Zoom desktop client in the normal way (drag from the Applications folder to the trash icon).

Whilst this is being actively exploited, the current damage seems to be limited to suddenly finding yourself attached to a conference call with a bunch of random strangers all looking rather startled. Whilst this might sound amusing, this is probably the least of what might result.

Posted in Active Attacks, Technical | Tagged | Comments Off on Zoom Desktop Vulnerability for macOS

DNS Firewalls: What They Are, and What They’re Not

This posting is really a description of so-called “DNS Firewalls” intended for those who have to deal with security vendors regularly. Having said that, there are DNS firewalls for home users (I cannot make any specific recommendations), so it may be of wider interest.

Calling them “DNS Firewalls” is a bit deceptive (and it is even possible to persuade a security vendor’s salesperson to admit that it’s a bad name for them). Firewalls control network traffic whereas “DNS firewalls” allow you to apply a policy to DNS lookups.

To be fair, the implementation for the most common DNS server is called “Response Policy Zones” (RPZ) which is a little bit on the geeky side. But to be summed up, it allows you to specify a policy when looking up names in the DNS.

What Does It Do?

When you look up names in the DNS – which happens in the background whenever you make a network connection – the DNS server performs that lookup on your behalf. If a “DNS Firewall” is turned on, it can do one of two things :-

  • Return a value indicating that the name doesn’t exist (a web browser will show an error page saying something similar to “’s server IP address could not be found.”)
  • Return an answer to a query that is not the correct answer. Or in other words lie. This can be used to provide an alternate service, or to present a web page explaining why the page is being blocked.

Of course high-end commercial “DNS firewalls” offer to do quite a bit more, but the chief cost is really the threat information feeds that gets turned into a policy. Catching phishing attacks automatically and rapidly.

Posted in Firewall, General | Tagged | Comments Off on DNS Firewalls: What They Are, and What They’re Not

The Future of Windows 7

As you may be aware, Microsoft have expectations that everyone running Windows 7 will upgrade to Windows 10 (and some refuseniks are so upset that they are ditching Windows for Linux!). As part of that, Microsoft will no longer be supporting Windows 7 from January 2020 which is approximately half a year away.

As such, there will be significant security issues with running a Windows 7 machine on any network (both wired and wireless).

University Build Machines

University build machines that login using Active Directory credentials (i.e. the standard network login username/password) will cease working from the 1st August 2019. There are currently warning banners appearing on logins.

Extensions to this deadline are being granted in exceptional circumstances where the justification is sufficient.

Non-standard Machines

Machines running Windows 7 that do not connect to Active Directory (or specifically pick up a group policy) will not be troubled by the 1st August deadline. However they are very much subject to the January 2020 deadline; after that date Windows 7 machines may very well be removed from the network simply for running Windows 7.

Those still running Windows 7 need to be aware of this, and start making plans for a migration. There are numerous possibilities that include (but are not necessarily limited to) :-

  1. Contacting the vendor of the machine querying about an upgrade path. Many specialised manufacturers will already have upgrade plans in place.
  2. Remove the machine from the network; if the network connection is merely required for convenience, it may be easiest to remove the network connection and rely on USB memory sticks.
  3. Migration to the “legacy” network with severe network restrictions in place; this is a separate network with only permitted traffic allowed through the firewall. Required network traffic will have to be requested, approved and allowed for any network connections to succeed.

Posted in Uncategorized | Comments Off on The Future of Windows 7

The Big RDP Vulnerability (CVE-2019-0708)

Microsoft have released a whole bunch of patches to fix security vulnerabilities this Tuesday (which is quite normal of course), but one unusual aspect was the release of a patch for older versions of Windows that do not normally get patches.

Which is a bit of an indication that this vulnerability has the potential of being a bit more serious than the usual – Microsoft does not release patches for mostly unsupported operating systems simply when that operating system is vulnerable, but when there is the potential for mass outbreaks potentially causing network-wide disruption.

On the other hand, when the more excitable members of the security community start jumping up and down shouting “It’s Armageddon”, we do have to take their assessment with a pinch of salt.

It is potentially very serious and worth prioritising mitigation measures, but there is no obvious indications that any active exploits are out there in the wild. As yet.

The Links

The Vulnerable Operating Systems

If you are running one of the following operating systems, you should not only install the patch but also make immediate plans to upgrade – nobody is issuing patches to protect you; patches are release to protect the Internet from you!

  1. Windows XP
  2. Windows Server 2003

(And yes, some people do still run such operating systems; in fact I do myself although they are on isolated networks for penetration testing purposes)

If you are running one of the following operating systems, you should install the patch and make plans to upgrade soon.

  1. Windows 7
  2. Windows Server 2008
  3. Windows Server 2008R2

What Is Vulnerable?

RDP (Remote Desktop Protocol). Which is a means of connecting to a Windows machine remotely – very frequently used for server management. Which you may very well think that it doesn’t effect Windows desktop installations, but it can be turned on (and sometimes is).

If it is vulnerable, an attacker can run their own code remotely as the user SYSTEM (which is even more privileged than the Administrator user). But more specifically :-

  • RDP without Network Level Authentication (which is not on by default): An attacker can run their code without credentials.
  • RDP with NLA: It has been reported that this is only vulnerable if the attacker has valid credentials. That does not mean it should not be fixed urgently however!
  • RDP gateway: Some organisations run a single exposed RDP gateway through which people can proxy RDP connections to machines on the inside. I’m not aware of any clear statements whether these are vulnerable or not.

Balancing the probability of exploits being attempted, the probability of the RDP gateway product being exploitable, the impact of a compromise, and the impact of withdrawing the service, IS has blocked access to our RDP gateway – it is only used by a handful of special case users and the VPN is a viable alternative.

Is It Being Exploited?

Probably not. At least not just yet.

The graph above (which came out a bit smaller than expected) is the number of RDP probes against my home network. The faint line is the count of probes; the darker line is a trend line (exponential moving average which might not be the right one to use as my statistical neurons are very rusty and make a horrible grinding sound when I crank them into life).

Although there is an increase over the last couple of days, it isn’t dramatic enough to indicate anything other than either random variability or an increase in scanning for open RDP ports by security researchers (whitehats, greyhats, and blackhats).

The analysis of the University firewall logs shows much the same kind of activity except for a particularly aggressive scan for about an hour (which itself isn’t indicative of an active attack). However the analysis wasn’t as pretty.

The absence of signs indicating some active attack may well lead some to believe this was a bit of a false alarm, but it is too soon to say that for sure. Example code to exploit the vulnerability is supposedly out there.

It is also worth pointing out that WannaCry (a huge ransomware attack in 2017) made use of a vulnerability that was released into the public domain months before the attack, and the vulnerability was patched by Microsoft a month before the attack. So attacks could come tonight, next week, or next month.

Posted in Active Attacks, Technical | Tagged , , , | Comments Off on The Big RDP Vulnerability (CVE-2019-0708)

University Passes Cybersecurity Re-assessment

After a great deal of work from a number of people, the University has successfully renewed our CyberEssentials Plus certification. This means :-

  • We are assured that we have met a level of IT security. Not that it means we can relax and not do more, but that we are headed in the right direction.
  • We can now compete for contracts that require CyberEssentials accreditation and stay in compliance with contracts that require CyberEssentials; a significant amount of money (at least £1 million) comes to the University every year due to such contracts.

The independent audits who assessed our compliance were somewhat more rigorous this year than last year; we can expect more rigour next year.

Posted in General, News | Tagged | Comments Off on University Passes Cybersecurity Re-assessment