Blog

  •

    Useful network posters you can download and print

    • General
    • by Jacob Riggs
    • 03-06-2020
    4.93 of 97 votes

    I decided to put together some minimalistic posters on network fundamentals that people can download and print for free. I hope these might help individuals, academic institutions, or maybe even companies with an IT ops function looking to decorate their office space with useful reference material. Download OSI + TCP/IP Common Ports Network Topologies All posters are A3 (297mm x 420mm) in size. I therefore recommend that if you wish to print these, you do so in A3 format between 600 and 1200 dpi for optimal print quality.If you like these posters or find them useful for your work, please consider sharing them with friends and colleagues.

  •

    Been hacked? What to do next

    • General
    • by Jacob Riggs
    • 12-05-2020
    4.33 of 61 votes

    Please note, the advice below is tailored for online accounts of a personal nature. Any online accounts with existing or potential access to work related data in the context of employment will usually need to follow a more refined internally sanctioned incident response process (likely in accordance with the NIST industry standard). In such circumstances, please refer to your company information security and data privacy guidelines. You’ve just realised one or more of your online accounts has been compromised. Panic sets in. Time is of the essence. You must reassert control. What do you do now? Steps to take Triage – If multiple accounts are involved, you need to quickly self-evaluate risk based on what existing and potential data each account has access to. Things like sensitive pictures and private messages need to be considered. This will enable you to triage according to each account risk profile and prioritise mitigation efforts in order of risk impact. Contain – Firstly, and perhaps most obviously, you want to isolate the attack. Your primary objective should be to cut off the attacker and prevent further unauthorised access or misuse. For this, simply follow the necessary steps to reset your account password. In most cases, successfully resetting your account password will immediately invalidate any actively logged-in sessions being used by the attacker. Once complete, enable soft-token 2FA (Two-Factor Authentication) where possible. Soft-token apps (such as Gauth or Authy) generate authentication codes locally on your mobile device and are preferable to SMS. Harvest – Where possible, harvest screenshots of any new account activities, such as posts, messages, or interactions (likes, follows, etc). Many prominent online websites (such as Twitter, Facebook, and Instagram) offer options to download your full account data in a structured format locally. This evidence will help you assess the full extent of damages and may prove helpful if you later decide to report the incident to the authorities or the web service itself. Discover – Now you want to look at your attack surface by finding any other accounts that may have also been compromised. Searching your email inbox for email subject lines matching keywords such as register, registering, registration will give you insight into many of the online services you have accounts with. For any additional accounts you identify as compromised along the way, repeat steps 2 – 3. Investigate – Now you want to perform some post-incident analysis. Any evidence you harvested in steps 3 – 4 may be helpful. How did this happen? If more than one account was compromised, what security properties did they have in common? Did those accounts share the same or similar passwords? Did you leave those accounts logged in on a missing or potentially compromised device? If you want to understand the attack in detail, building a timeline of events and account activities will help you understand the attack scope and objectives. Recover – Only once the above steps are complete should you assume it is safe to continue using your account normally again. Now you can clean up and delete any bad posts or account interactions. If your account exhibited any anomalous behaviour (abuse/misuse), you may wish to address the circumstances in a public statement. Your findings from step 5 should help you make an informed decision on how best to communicate this to your online following. Prevent – How can you prevent this happening again? Ensure any future passwords you use are long and complex enough. Where possible, enable 2FA. Consider using a password manager such as LastPass or KeePass. Password managers can also help you catalogue your online presence so that you better understand your attack surface in the future. If after following these steps you notice the same accounts are still being compromised, the attacker may have established what we call persistence. This is where an attacker maintains persistent control over a specific device, system, or network that you’re using to login to the affected online accounts. From here they may be able to monitor, intercept, and block your mitigation efforts. In such circumstances, I recommend temporarily moving over to a completely new network and using a clean device to revisit the steps above. I'll focus on how to deal with compromised networks and devices in another blog post. If you are the victim of cyber crime, you reserve the right to report the incident to your local authorities. Below I've included some references that direct to the online reporting forms for each respective country. UK EU US AU Please note, the open nature of the Internet means the law surrounding cyber crime can differ greatly between countries. Duties may be owed within both the presiding jurisdiction of the victim, and that of wherever the attack may have originated.

  • Welcome to my new blog

    • General
    • by Jacob Riggs
    • 02-01-2020
    4.17 of 63 votes

    My journey as a security researcher over the past decade has taught me a lot, but I know there’s still so much more to learn. I thought it might be worth creating this blog to document and share some of my personal experiences, and hopefully give something back to the thriving security community I’ve grown to be a part of. The term ‘InfoSec’ encompasses a myriad of fields that make up quite a bizarre industry, but one I’ve come to thoroughly enjoy exploring over the years. I've met some amazing people, and we've built (and broken) some incredible (and peculiar) things together. I think that documenting some of these events will enable me to better measure my personal development and maybe encourage a wider sharing of knowledge. With a little steady effort, I hope to eventually turn this blog into a valuable resource that myself and others can come to rely on when looking to learn and understand new things moving forward.