New & Tools
- Skeletons in the IT Closet: Seven Common Microsoft Active Directory Misconfigurations that Adversaries Abuse
- Google: Better patching could have prevented 1 in 4 zero’days last year: Vendors should fix the root cause of a vulnerability, rather than block just one path to triggering it, says Google
- Identity theft spikes amid pandemic: The US Federal Trade Commission received 1.4 million reports of identity theft last year, double the number from 2019
- University attacked by its own vending machines, smart light bulbs & 5,000 IoT devices
DNS hijacking is a type of malicious attack in which an individual redirects queries to a domain name server via overriding a computer’s transmission control protocol/internet protocol (TCP/IP) settings – generally by modifying a DNS server’s settings.
- Attackers can set record values for the domain name systems
- They can obtain valid encryption certificates for an organization’s domain names; this allows browsers to establish a connection without any certificate errors as the certificate can be trusted.
- That valid certificate then enables the redirected traffic to be decrypted and exposes any user-submitted data.
- U.S. Gov Issues Urgent Warning of DNS Hijacking Attacks (Threatpost.com)
- Global DNS Hijacking Campaign: DNS Record Manipulation at Scale (FireEye.com)
- Crooks Continue to Exploit GoDaddy Hole (KrebsOnSecurity.com)
New SpeakUp Backdoor Infects Linux and macOS with Miners (BleepingComputer.com)
- The “No More Ransom” website is an initiative by the National High Tech Crime Unit of the Netherlands’ police, Europol’s European Cybercrime Centre and McAfee with the goal to help victims of ransomware retrieve their encrypted data without having to pay the criminals.
- Since it is much easier to avoid the threat than to fight against it once the system is affected, the project also aims to educate users about how ransomware works and what countermeasures can be taken to effectively prevent infection.
ATtention Spanned: Comprehensive Vulnerability Analysis of AT Commands Within the Android Ecosystem (https://atcommands.org/)
- AT commands, originally designed in the early 80s for controlling modems, are still in use in most modern smartphones to support telephony functions.
- The role of AT commands in these devices has vastly expanded through vendor-specific customizations, yet the extent of their functionality is unclear and poorly documented.
- Functionality exposed, including the ability to rewrite device firmware, bypass Android security mechanisms, exfiltrate sensitive device information, perform screen unlocks, and inject touch events solely through the use of AT commands.
- Applies To: Excel 2016 Word 2016 PowerPoint 2016 Excel 2013 Word 2013 More… Files from the Internet and from other potentially unsafe locations can contain viruses, worms, or other kinds of malware that can harm your computer. To help protect your computer, files from these potentially unsafe locations are opened as read only or in Protected View. By using Protected View, you can read a file and see its contents and enable editing while reducing the risks.
mSpy, the makers of a software-as-a-service product that claims to help more than a million paying customers spy on the mobile devices of their kids and partners, has leaked millions of sensitive records online, including passwords, call logs, text messages (WhatsApp, Facebook Messenger), contacts, notes and location data secretly collected from phones running the stealthy spyware.
QuickTime must be uninstalled from all Microsoft Windows systems
- Apple no longer be issuing security updates to QuickTime for the product on the Windows Platform and recommend users uninstall it.
- Zero Day Initiative has released two advisories ZDI-16-241 and ZDI-16-242 detailing two, critical vulnerabilities affecting QuickTime for Windows. These vulnerabilities will not be patched by Apple.
US-CERT: Alert (TA16-105A): Apple Ends Support for QuickTime for Windows; New Vulnerabilities Announced
Urgent Call to Action: Uninstall QuickTime for Windows Today
QuickTime 7 for Windows is no longer supported by Apple.
- New versions of Windows since 2009 have included support for the key media formats, such as H.264 and AAC, that QuickTime 7 enabled.
- VLC Media Player will handle any media formats that Windows does not natively support.
The Electronic Frontier Foundation (EFF) has online tracker-testing in its Panopticlick, helping you analyze the privacy protections in your Web browser.
Web Browser Plugins
- uBlock Origin
How would you know that a network has been compromised?
Network Analyzer/Packet Sniffer
- NetWorx : Bandwidth monitoring and usage reporting
- Wireshark : Network Analyzer/Packet Sniffer
- tcpdump is a data-network packet analyzer computer program that runs under a command line interface. It allows the user to display TCP/IP and other packets being transmitted or received over an attached network.
Segment Your Network / Isolate Guests & IoT devices from your main segment
- Use a router like the EdgeRouter X to segment your LAN. e.g. Guest network, Private network, IoT (Internet of Things) network.
- Each port is a separate network segment.
- Make sure to immediately update the firmware/EdgeOS
- Home-Network Implementation: Using the Ubiquiti EdgeRouter X and Ubiquiti AP-AC-LR Access Point by Mike Potts
- Available from Amazon.com
- Connection-Oriented Service
- In a connection-oriented service:
- A connection is first established between the sender and the receiver.
- Data is transferred.
- At the end, the connection is released.
- TCP and SCTP are connection-oriented protocols.
- In a connection-oriented service:
- Connectionless Service
- In a connectionless service, the packets are sent from one party to another with no need for connection establishment or connection release.
- The packets are not numbered; they may be delayed or lost or may arrive out of sequence.
- There is no acknowledgment of the packet arrived at its destination
- UDP is connectionless.
- Reliable vs Unreliable
- The transport layer service can be reliable or unreliable
- If the application layer program needs reliability, we use a reliable transport layer protocol by implementing flow and error control at the transport layer.
- On the Internet, there are three common transport layer protocols.
- Data encapsulation is a process whereby information is added to the frame from each layer of the OSI model. This is also called packet creation. Each layer communicates only with its peer layer on the receiving device.
- In several fields, deprecation is the discouragement of use of some terminology, feature, design, or practice; typically, because it has been superseded or is no longer considered efficient or safe – but without completely removing it or prohibiting its use.
- Deprecation may indicate that the feature will be removed in the future.
- Features are deprecated—rather than immediately removed—in order to provide backward compatibility, and give programmers who have used the feature time to bring their code into compliance with the new standard.
Wireless Network Security
- WEP (Wired Equivalent Privacy)
- Due to known security issues with WEP encryption, it is recommended that you do not use WEP. WEP can easily be cracked in a few minutes.
- Wi-Fi Protected Access (WPA, WPA2, WPA3)
- When using WPA2, use AES encryption only, instead of TKIP+AES
- SecurityNow! Episode 170 discusses the TKIP (Temporal Key Integrity Protocol) hack
- Using Wi-Fi Protected Access (WPA) encryption offers individual user isolation, preventing the attacker from decrypting any cookies sent over the network even if they have logged into the network using the same passphrase.
- WPA2 security flaw puts almost every Wi-Fi device at risk of hijack, eavesdropping
- When using WPA2, use AES encryption only, instead of TKIP+AES
- Wi-Fi Protected Setup
- Widget Jacking (session hijacking (sidejacking/widgetjacking) attacks)
PMKID Vulnerability that bypasses WPA/WPA2 4-way Handshake
- PMKID Vulnerability FAQ – WPA/WPA2-PSK and 802.11r by (documentation.meraki.com)
- New attack on WPA/WPA2 using PMKID Proof of Concept by Adam Toscher (Medium.com)
- Wi-Fi Alliance introduces Wi-Fi Certified WPA3 security (wi-fi.org)
- With WPA3, Wi-Fi security is about to get a lot tougher (ZDNet.com)
Virtual Private Network (VPN)
A virtual private network (VPN) enables users to send and receive data while remaining anonymous and secure online.
In the simplest terms, a VPN is used to create a secure, encrypted connection between your computer and a server operated by the VPN service.
- How to Choose the Best VPN Service for Your Needs (HowToGeek.com)
- That One Privacy Guy’s ? Guide to Choosing the Best VPN (for you) (ThatOnePrivacySite.net)
- The Best VPN Services Directory (CNET.com)
- The Best VPN Services (PCMag.com)
Types of Ethernet cabling
Straight-through cables are used to connect unlike devices.
- e.g. Host to Switch, Router to Switch
- On a host: Pins 1 & 2 are transmit, and 3 & 6 are receive.
Crossover cables are used to connect like devices.
- e.g. Switch to switch, Router to host, Router to Router
- It is possible to connect switches using a straight-through cable because many switches have auto configuring ports. Usually referred to as Auto-MDIX. a.k.a. Auto Uplink.
Roll-over cables are used to connect a hosts’ RS-232 / EIA-TIA-232 serial interface to a routers console port.
- The default COM port settings for Cisco routers & switches are:
- Bits per Second: 9600, Data bits: 8, Parity: None, Stop Bits: 1, Flow Control: None
- A group of networks and routers under a common administrative control.
- Routing inside and autonomous system is referred to as intradomain routing.
- Routing between autonomous systems is referred to as interdomain routing.
- Core layer or Backbone
- Distribution layer
- Access layer
- Get access to the Packet Tracer router simulator
- Free learning resources
- Cisco certification exam topics
- CCNA, CCNP study groups
- Sample CCENT, CCNA, CCNP study questions
- Career resources
- IT learning games
- Community manager support
- Social learning with IT experts
- Cisco Exam Preparation – Studying for Results
Hands-On Lab: Synchronizing Using Allway Sync
- What is Allway Sync?
- Free for moderate personal use.
- True folder/directory synchronization.
- Sync data between your desktop PCs, laptops, tablets and more.
Read / Do
- Read Chapter 3: Easy Subnetting
- Do the Written Labs
- Answer the Review Questions
- Do not submit your answers for this chapter. The answers are in the Appendix
Make sure to always have access to a calculator which has an Exponent function (^key) ( xy ) for every class.
- If you don’t already have a stand-alone calculator, you can pick-up any of the following, or similar, from Staples or Office Depot for $10.
Sign up for a free Cisco Learning Network account
- [A paid membership is not necessary to access a lot of the material]
- Download, install, and test the current version of Cisco Packet Tracer.