Blog

  • Useful network posters you can download and print

    • General
    • by Jacob Riggs
    • 03-06-2020
    5.00 of 2 votes

    I decided to put together some minimalistic posters on network fundamentals that people can download and print for free. I hope these might help individuals, academic institutions, or maybe even companies with an IT function looking to decorate their office space with useful reference material. All posters are A3 (297mm x 420mm) in size. I therefore recommend that if you wish to print these, you do so in A3 format between 600 and 1200 dpi for optimal print quality. Download OSI + TCP/IP Common Ports Network Topologies If you like these posters or find them useful for your work, please consider sharing them with friends and colleagues.

  • In memory of my friend Craig

    4.25 of 4 votes

    My colleague and friend unexpectedly passed away last year and I wanted to share a few lasting words which I hope might venerate our friendship and pay tribute to his memory. Craig Allen Warden 16 December 1970  —  13 April 2019 I’ve considered writing something for a long time, but my personal blog is hardly a podium for obituaries and mournful proclamations. Finding the right words has been difficult. I met Craig whilst working at the Guardian newspaper. He was the Head of HR at the time and we met during the natural course of our employment. Working with Craig was always entertaining due to his eloquence. He was quick-witted, had a jovial personality, and always knew how to bring out the best in those he worked with. He would always greet me with his signature “Hello matey!” in a skewed Aberdonian accent (which took me a while to place). Our social relationship was never linear. More often than not we would end up in protracted conversations. Even impromptu corridor banter would at times overrun and command a fleeting wave or a witty one-liner adieu. I like to think this was testament to our discussion value, but looking back I think we just got along well. We always had to rush back to work to avoid being late, but every chat was refreshing and worthwhile. I think about Craig a lot, and often find myself revisiting the moments we shared. This short blog post does the salient volume of his life little justice, but I find solace in knowing it might resonate with the people that were lucky enough to have known him, and maybe serve as insight to those that never had the chance. See you in another life, matey.

  • How to torrent (on Windows)

    4.00 of 5 votes

    The purpose of this tutorial is to provide guidance on how to access and download torrents. Torrents are hosted on file-sharing websites, which act as a directory for finding desired data (such as movies, TV shows, OS images, or open-source software). File-sharing sites themselves do not host the desired data - they just host the torrent files that tell your torrent client where it can retrieve them from. Torrents Torrents are simply peer-to-peer pointers that work by providing a torrent client with an address book of seeds that possess and are actively uploading the desired data. Seeds Seeds (also known as peers) are those in possession of the full data with an open upstream connection that shares it.   Accessing file-sharing sites ISPs block a number of well-known file sharing sites such as ThePirateBay and KickassTorrents, usually via DNS filtering and blocking requests to blacklisted server IP addresses. If you cannot visit these or other file-sharing sites, it may be because your ISP is blocking access. There are a number of methods to circumvent these blocks (and one or more may need to be adopted), but I will focus on three of the most common. Windows: Change DNS Server Navigate to Control Panel > Network and Internet > Network and Sharing Center On the left hand panel, click Change adapter settings Right-click on the connection type (could be Ethernet or WiFi) and select Properties Scroll down the list of items to find Internet Protocol Version 4 (TCP/IPv4) Click on it once to select it and then click Properties Near the bottom of the box is Use the following DNS server addresses Select that option and type in 8.8.8.8 and 8.8.4.4 Now flush your DNS resolver cache by opening CMD and typing ipconfig /flushdns then press Enter Use a VPN You can use a VPN such as ProtonVPN. Using a VPN will mask the traffic to your ISP by tunnelling your connection through a VPN server. Use Tor You can use Tor (The Onion Router). Tor acts in a similar way to a VPN, but introduces a series of encrypted hops which bounce your communications between distributed relays before arriving at the desired destination.   How to torrent files Install a torrent client To torrent files you first need to install a torrent client. For this example I will be using uTorrent. Find the desired torrent Then you need to find which torrent you want from a file-sharing site. For this example I will be using ThePirateBay. Select the desired torrent To select the torrent, you need to copy the torrent URL. For this example, I right-click the magnet icon and select Copy link address This URL follows the magnet URI scheme and identifies a torrent using a SHA-1 or truncated SHA-256 hash (commonly termed the infohash). This is the same value that your torrent client will use to identify a particular torrent when communicating with other peers. Download the desired torrent You must instruct your torrent client to request that torrent. For this example, I open uTorrent and press Ctrl + U to open the Add Torrent from URL window. Then paste the copied torrent link and hit OK   How torrenting works When you click to download a particular torrent, your torrent client will request that the trackers included in the torrent URL search for any peers broadcasting the associated file hash. Trackers Trackers are address-book servers which help organise, manage, and connect active peers. If found, your torrent client will then check if those peers have an authorised open upstream connection. If these conditions are met, your torrent client will then mark them as seeds and begin downloading the desired data. During the download process, your torrent client will automatically verify the integrity of data received by hashing each piece in a Merkle tree format. This ensures any corrupt or incorrect data is dropped during the transfer process to maximise download speed, security, and efficiency. Additional notes File-sharing sites are natural breeding grounds for malware. Torrenting safely requires an appreciation for basic security practices. I recommend you avoid torrenting if you do not know what you are doing. Accessing file-sharing sites and torrenting is perfectly legal, but torrenting unsanctioned copyrighted material is not. Be kind – torrenting can throttle your network and may affect others that share it. You may need to check your torrent client settings to ensure bandwidth rate limiting is correctly optimised. If you are concerned about upload usage, you may need to adjust your torrent client settings to automatically stop seeding once a download has completed. I recommend avoiding peer blocker software such as PeerBlock. These are designed to prevent you from connecting to blacklisted peers, but are often unreliable, significantly reduce your download speeds, and serve little purpose if you’re already using a VPN or Tor.

  • Been hacked? What to do next

    • General
    • by Jacob Riggs
    • 12-05-2020
    4.17 of 6 votes

    Please note, the advice below is tailored for online accounts of a personal nature. Any online accounts with existing or potential access to work related data in the context of employment will usually need to follow a more refined internally sanctioned incident response process (likely in accordance with the NIST industry standard). In such circumstances, please refer to your company information security and data privacy guidelines. You’ve just realised one or more of your online accounts has been compromised. Panic sets in. Time is of the essence. You must reassert control. What do you do now? Steps to take Triage – If multiple accounts are involved, you need to quickly self-evaluate risk based on what existing and potential data each account has access to. Things like sensitive pictures and private messages need to be considered. This will enable you to triage according to each account risk profile and prioritise mitigation efforts in order of risk impact. Contain – Firstly, and perhaps most obviously, you want to isolate the attack. Your primary objective should be to cut off the attacker and prevent further unauthorised access or misuse. For this, simply follow the necessary steps to reset your account password. In most cases, successfully resetting your account password will immediately invalidate any actively logged-in sessions being used by the attacker. Once complete, enable soft-token 2FA (Two-Factor Authentication) where possible. Soft-token apps (such as Gauth or Authy) generate authentication codes locally on your mobile device and are preferable to SMS. Harvest – Where possible, harvest screenshots of any new account activities, such as posts, messages, or interactions (likes, follows, etc). Many prominent online websites (such as Twitter, Facebook, and Instagram) offer options to download your full account data in a structured format locally. This evidence will help you assess the full extent of damages and may prove helpful if you later decide to report the incident to the authorities or the web service itself. Discover – Now you want to look at your attack surface by finding any other accounts that may have also been compromised. Searching your email inbox for email subject lines matching keywords such as register, registering, registration will give you insight into many of the online services you have accounts with. For any additional accounts you identify as compromised along the way, repeat steps 2 – 3. Investigate – Now you want to perform some post-incident analysis. Any evidence you harvested in steps 3 – 4 may be helpful. How did this happen? If more than one account was compromised, what security properties did they have in common? Did those accounts share the same or similar passwords? Did you leave those accounts logged in on a missing or potentially compromised device? If you want to understand the attack in detail, building a timeline of events and account activities will help you understand the attack scope and objectives. Recover – Only once the above steps are complete should you assume it is safe to continue using your account normally again. Now you can clean up and delete any bad posts or account interactions. If your account exhibited any anomalous behaviour (abuse/misuse), you may wish to address the circumstances in a public statement. Your findings from step 5 should help you make an informed decision on how best to communicate this to your online following. Prevent – How can you prevent this happening again? Ensure any future passwords you use are long and complex enough. Where possible, enable 2FA. Consider using a password manager such as LastPass or KeePass. Password managers can also help you catalogue your online presence so that you better understand your attack surface in the future. If after following these steps you notice the same accounts are still being compromised, the attacker may have established what we call persistence. This is where an attacker maintains persistent control over a specific device, system, or network that you’re using to login to the affected online accounts. From here they may be able to monitor, intercept, and block your mitigation efforts. In such circumstances, I recommend temporarily moving over to a completely new network and using a clean device to revisit the steps above. I'll focus on how to deal with compromised networks and devices in another blog post. If you are the victim of cyber crime, you reserve the right to report the incident to your local authorities. Below I've included some references that direct to the online reporting forms for each respective country. UK EU US AU Please note, the open nature of the Internet means the law surrounding cyber crime can differ greatly between countries. Duties may be owed within both the presiding jurisdiction of the victim, and that of wherever the attack may have originated.

  • How to validate file integrity with checksums

    4.13 of 8 votes

    A checksum is a unique string derived from a block of digital data for the purpose of detecting any changes which may have been introduced during its transmission or storage. In short, checksums are a file integrity validation measure. If you download a file from an untrusted source, a checksum can help you validate that the file you have downloaded perfectly matches that which the file issuer intended. In practice, this helps identify any files which have been corrupted or maliciously altered in transit. Checksums are commonly seen on websites alongside downloadable software binaries, patches, hotfixes, and updates. Due to their low computational overhead, they are also useful in security operations for fingerprinting malware and can be added to anti-virus signature databases or stored as artifacts for future reference.   Windows: HashTab is a free shell extension for Windows which integrates itself within Windows Explorer as a property page for files with a context menu to generate and compare hashes. Once installed, HashTab can be accessed by right-clicking a target file and navigating to Properties and selecting the File Hashes tab. HashTab will then automatically attempt to hash the target file and report the relevant values. Alternatively, Windows comes with a pre-installed utility called CertUtil, which can be used to generate hashes. To generate a hash for a particular file using CertUtil, open CMD (Command Prompt) and type the following: CertUtil -hashfile [TARGET FILE LOCATION] [DESIRED HASH ALGORTHM] For example: This will generate a SHA256 hash string which can then be compared against the checksum provided by the file issuer to verify the file integrity.   Linux: Linux comes with a number of pre-installed checksum utilities. To generate a hash for a particular file using these, open terminal and type the following: [DESIRED HASH ALGORITHM]sum [TARGET FILE LOCATION] For example: This will generate a SHA256 hash string which can then be compared against the checksum provided by the file issuer to verify the file integrity.

  • How to generate PGP keys

    3.75 of 8 votes

    To receive PGP encrypted emails and sign your own messages, you will need to generate your own key pair. There are both easy and advanced (best practice) ways to go about doing this. Here I will try to guide you through the process. The easy method Use an online third party web service such as PGPKeyGen or Sela. This is simply an application layer representation of the advanced method below, where a third-party web server hosts the necessary libraries and backend functionality to generate PGP keys for you. The natural risk associated with this, however, is that relying on a third-party online web service offers no guarantee a copy of the keys you receive will not be stored, sold, or shared elsewhere. Some web-based services generate keys client-side by using specific JavaScript libraries (such as OpenPGP.js) within your browser. Whilst this mechanism is still not as secure as the best practice methods detailed below, it provides a good balance between PGP security and day-to-day usability. The advanced method (best practice)   Windows: To generate PGP keys on Windows we require the latest version of the GnuPG software package Gpg4win. This is a free implementation of the OpenPGP standard which enables local key generation, encryption, and signing operations. Once installed, run the Kleopatra application. Navigate to File > New Key Pair and then choose the key format you want to create. For this example we will be creating a personal OpenPGP key pair. Now we need to input our name and email address values. Then click Advanced Settings and ensure the following fields are completed as shown in the image below. Now we can click OK and check that our key configuration is correct. We can now click Create to generate the key pair. We are now presented with a prompt requiring we input our desired passphrase. We must input the secure passphrase we wish to use. This is the password we will need to use each time we wish to decrypt or sign a PGP message using these keys in the future. Our key pair has now successfully been generated.   Linux: To generate PGP keys on a Linux distribution we require the latest version of GPG (GnuPG). This is a free implementation of the OpenPGP standard which enables local key generation, encryption, and signing operations. To get started, we run the install command. sudo apt install gnupg Once installed, we can move on to generating our key pair. For this we use the --full-generate-key parameter. We will then be prompted to specify the type of key we want to create. We can press the Enter key to accept the default (RSA and RSA). We must then select our desired key size, which I recommend (at the time of this blog post) is at least 4096 bits to conform with best practice. We then have the option to choose how long the keys should be valid for. In practice, this means the amount of time someone intending to communicate with you via PGP should consider that particular key pair safe for use. For this example, we do not want our keys to expire, so we press Enter as that is already selected as the default. We will then be prompted to input specific identifier values which will reside within the core structure of the keys themselves. We must then input the secure passphrase we wish to use. This is the password we will need to use each time we wish to decrypt or sign a PGP message using these keys in the future. Depending on our hardware processing capabilities, we may then be prompted to generate entropy using the mouse or keyboard. Once this process is complete, the newly generated keys will be stored internally on our GnuPG keyring. This is a location within the filesystem where PGP keys generated locally using GnuPG naturally reside. If we want to view the public keys within our keyring, we can use the --list-keys parameter. If we want to view the private keys within our keyring, we can use the --list-secret-keys parameter. If we want to view the fingerprint of the public keys within our keyring, we can use the --fingerprint parameter. Existing PGP keys can be exported out of the keyring using the --export parameter. This will write our newly generated public key to a plaintext .key file which we can publish and share online. Other parties can then use this public key to encrypt messages and send them to us securely.