- 1 New & Tools
- 1.1 DNS Hijacking
- 1.2 New SpeakUp Backdoor Infects Linux and macOS with Miners (BleepingComputer.com)
- 1.3 NoMoreRansom.org
- 1.4 ATtention Spanned: Comprehensive Vulnerability Analysis of AT Commands Within the Android Ecosystem (https://atcommands.org/)
- 1.5 Mobile Spyware Maker mSpy Leaks Millions of Sensitive Records
- 2 QuickTime must be uninstalled from all Microsoft Windows systems
- 3 Better Focus and Efficient Studying When Not Multitasking / Multi-Focusing
- 4 Panopticlick
- 5 How would you know a network has been compromised?
- 6 Segment Your Network / Isolate Guests & IoT devices from your main segment
- 7 Cisco IOS and Router Command Reference
- 8 TCP/UPD
- 9 Data Encapsulation
- 10 Deprecated / Deprecation
- 11 Wireless Network Security
- 12 Virtual Private Network (VPN)
- 13 Autonomous System (AS)
- 14 Microsoft OneNote
- 15 Cisco Learning Network
- 16 Synchronizing Using Allway Sync
- 17 Subnetting Tutorial & Reference Page
- 18 Read / Do
- 19 Do
New & Tools
- Social media fraud: The influencers promoting criminal scams
- Skeletons in the IT Closet: Seven Common Microsoft Active Directory Misconfigurations that Adversaries Abuse
- Google: Better patching could have prevented 1 in 4 zero’days last year: Vendors should fix the root cause of a vulnerability, rather than block just one path to triggering it, says Google
- Identity theft spikes amid pandemic: The US Federal Trade Commission received 1.4 million reports of identity theft last year, double the number from 2019
- University attacked by its own vending machines, smart light bulbs & 5,000 IoT devices
- A university was attacked by its lightbulbs, vending machines and lamp posts
- Data Breach Digest: Studies in Cyber Crime by Verizon
- Healing the Earth | John D. Liu
DNS hijacking is a type of malicious attack in which an individual redirects queries to a domain name server via overriding a computer’s transmission control protocol/internet protocol (TCP/IP) settings – generally by modifying a DNS server’s settings.
- Attackers can set record values for the domain name systems
- They can obtain valid encryption certificates for an organization’s domain names; this allows browsers to establish a connection without any certificate errors as the certificate can be trusted.
- That valid certificate then enables the redirected traffic to be decrypted and exposes any user-submitted data.
- U.S. Gov Issues Urgent Warning of DNS Hijacking Attacks (Threatpost.com)
- Global DNS Hijacking Campaign: DNS Record Manipulation at Scale (FireEye.com)
- Crooks Continue to Exploit GoDaddy Hole (KrebsOnSecurity.com)
New SpeakUp Backdoor Infects Linux and macOS with Miners (BleepingComputer.com)
- The “No More Ransom” website is an initiative by the National High Tech Crime Unit of the Netherlands’ police, Europol’s European Cybercrime Centre and McAfee with the goal to help victims of ransomware retrieve their encrypted data without having to pay the criminals.
- Since it is much easier to avoid the threat than to fight against it once the system is affected, the project also aims to educate users about how ransomware works and what countermeasures can be taken to effectively prevent infection.
ATtention Spanned: Comprehensive Vulnerability Analysis of AT Commands Within the Android Ecosystem (https://atcommands.org/)
- AT commands, originally designed in the early 80s for controlling modems, are still in use in most modern smartphones to support telephony functions.
- The role of AT commands in these devices has vastly expanded through vendor-specific customizations, yet the extent of their functionality is unclear and poorly documented.
- Functionality exposed, including the ability to rewrite device firmware, bypass Android security mechanisms, exfiltrate sensitive device information, perform screen unlocks, and inject touch events solely through the use of AT commands.
Enable Microsoft Office Protected View
- Applies To: Excel 2016 Word 2016 PowerPoint 2016 Excel 2013 Word 2013 More… Files from the Internet and from other potentially unsafe locations can contain viruses, worms, or other kinds of malware that can harm your computer. To help protect your computer, files from these potentially unsafe locations are opened as read only or in Protected View. By using Protected View, you can read a file and see its contents and enable editing while reducing the risks.
Mobile Spyware Maker mSpy Leaks Millions of Sensitive Records
mSpy, the makers of a software-as-a-service product that claims to help more than a million paying customers spy on the mobile devices of their kids and partners, has leaked millions of sensitive records online, including passwords, call logs, text messages (WhatsApp, Facebook Messenger), contacts, notes and location data secretly collected from phones running the stealthy spyware.
QuickTime must be uninstalled from all Microsoft Windows systems
- Apple no longer issues security updates to QuickTime on the Windows Platform and recommend users uninstall it.
- Zero Day Initiative has released two advisories ZDI-16-241 and ZDI-16-242 detailing two, critical vulnerabilities affecting QuickTime for Windows. These vulnerabilities will not be patched by Apple.
- New versions of Windows since 2009 have included support for the key media formats, such as H.264 and AAC, that QuickTime 7 enabled.
- VLC Media Player will handle any media formats that Windows does not natively support.
Better Focus and Efficient Studying When Not Multitasking / Multi-Focusing
The Electronic Frontier Foundation (EFF) has online tracker-testing in its Panopticlick, helping you analyze the privacy protections in your Web browser.
Web Browser Plugins
How would you know a network has been compromised?
Network Analyzer/Packet Sniffer
- NetWorx : Bandwidth monitoring and usage reporting
- Wireshark : Network Analyzer/Packet Sniffer
- tcpdump is a data-network packet analyzer computer program that runs under a command line interface. It allows the user to display TCP/IP and other packets being transmitted or received over an attached network.
Segment Your Network / Isolate Guests & IoT devices from your main segment
- Use a router like the Ubiquity EdgeRouter X to segment your LAN.
- For example, having a Guest network, Private network, IoT (Internet of Things) network, all in the one device.
Cisco IOS and Router Command Reference
- Also accessible from the Technology > Networking menu
Connection-oriented service vs Connectionless service
- Connection-Oriented Service
- In a connection-oriented service:
- A connection is first established between the sender and the receiver.
- Data is transferred.
- At the end, the connection is released.
- TCP and SCTP are connection-oriented protocols.
- In a connection-oriented service:
- Connectionless Service
- In a connectionless service, the packets are sent from one party to another with no need for connection establishment or connection release.
- The packets are not numbered; they may be delayed or lost or may arrive out of sequence.
- There is no acknowledgment of the packet arrived at its destination
- UDP is connectionless.
- Reliable vs Unreliable
- The transport layer service can be reliable or unreliable
- If the application layer program needs reliability, we use a reliable transport layer protocol by implementing flow and error control at the transport layer.
- On the Internet, there are three common transport layer protocols.
- User Datagram Protocol (UDP) is connectionless and unreliable
- Transmission Control Protocol (TCP) and Stream Control Transmission Protocol (SCTP) are connection-oriented and reliable.
- Data encapsulation is a process whereby information is added to the frame from each layer of the OSI model. This is also called packet creation. Each layer communicates only with its peer layer on the receiving device.
OSI Reference Model [re-post]
- Study the: OSI Model Quick Reference (pdf)
- TCP/IP and the OSI Model Explained by Blanchae
- The OSI Model Demystified by Eli the Computer Guy
- Understanding the OSI Reference Model: Cisco Router Training 101 by SoundTraining.net
Deprecated / Deprecation
- In several fields, deprecation is the discouragement of use of some terminology, feature, design, or practice; typically, because it has been superseded or is no longer considered efficient or safe – but without completely removing it or prohibiting its use.
- Deprecation may indicate that the feature will be removed in the future.
- Features are deprecated—rather than immediately removed—in order to provide backward compatibility, and give programmers who have used the feature time to bring their code into compliance with the new standard.
Wireless Network Security
- WEP (Wired Equivalent Privacy)
- Due to known security issues with WEP encryption, it is recommended that you do not use WEP. WEP can easily be cracked in a few minutes.
- Wi-Fi Protected Access (WPA, WPA2, WPA3)
- When using WPA2, use AES encryption only, instead of TKIP+AES
- SecurityNow! Episode 170 discusses the TKIP (Temporal Key Integrity Protocol) hack
- Using Wi-Fi Protected Access (WPA) encryption offers individual user isolation, preventing the attacker from decrypting any cookies sent over the network even if they have logged into the network using the same passphrase.
- WPA2 security flaw puts almost every Wi-Fi device at risk of hijack, eavesdropping
- When using WPA2, use AES encryption only, instead of TKIP+AES
- Wi-Fi Protected Setup
- A flaw in a feature added to Wi-Fi, called Wi-Fi Protected Setup, allows WPA and WPA2 security to be bypassed and effectively broken in many situations. WPA and WPA2 security implemented without using the Wi-Fi Protected Setup feature are unaffected by the security vulnerability.
- Widget Jacking (session hijacking (sidejacking/widgetjacking) attacks)
PMKID Vulnerability that bypasses WPA/WPA2 4-way Handshake
- PMKID Vulnerability FAQ – WPA/WPA2-PSK and 802.11r by (documentation.meraki.com)
- New attack on WPA/WPA2 using PMKID Proof of Concept by Adam Toscher (Medium.com)
- Wi-Fi Alliance introduces Wi-Fi Certified WPA3 security (wi-fi.org)
- With WPA3, Wi-Fi security is about to get a lot tougher (ZDNet.com)
Virtual Private Network (VPN)
A virtual private network (VPN) enables users to send and receive data while remaining anonymous and secure online.
In the simplest terms, a VPN is used to create a secure, encrypted connection between your computer and a server operated by the VPN service.
- How to Choose the Best VPN Service for Your Needs (HowToGeek.com)
- That One Privacy Guy’s ? Guide to Choosing the Best VPN (for you) (ThatOnePrivacySite.net)
- The Best VPN Services Directory (CNET.com)
- The Best VPN Services (PCMag.com)
Autonomous System (AS)
- A group of networks and routers under a common administrative control.
- Routing inside and autonomous system is referred to as intradomain routing.
- Routing between autonomous systems is referred to as interdomain routing.
Cisco Learning Network
- Get access to the Packet Tracer router simulator
- Free learning resources
- Cisco certification exam topics
- CCNA, CCNP study groups
- Sample CCENT, CCNA, CCNP study questions
- Career resources
- IT learning games
- Community manager support
- Social learning with IT experts
- Cisco Exam Preparation – Studying for Results
Synchronizing Using Allway Sync
- What is Allway Sync?
- Free for moderate personal use.
- True folder/directory synchronization.
- Sync data between your desktop PCs, laptops, tablets and more.
Subnetting Tutorial & Reference Page
Read / Do
CCNA Certification Study Guide, Volume 2
- Read Chapter 3: Easy Subnetting
- Do the Written Labs
- Answer the Review Questions
- Do not submit your answers for this chapter. The answers are in the Appendix
Make sure to always have access to a calculator which has an Exponent function (^key) ( xy ) for every class.
- If you don’t already have a stand-alone calculator, you can pick-up any of the following, or similar, from Staples or Office Depot for $10.
- Casio FX-260 Solar Scientific Calculator (Staples)
- Casio FX-260 Solar Scientific Calculator (Office Depot)
- Texas Instruments TI-30Xa Scientific Calculator (Staples)
Sign up for a free Cisco Learning Network account
- [A paid membership is not necessary to access a lot of the material]
- Download, install, and test the current version of Cisco Packet Tracer.