Cyber Software

[cyb3rs0ft-blog]

Cyber Security Blunder List

"We're living in the beginning of an era of mass targeted attacks, things are bad and they're going to get worse." Nate Fick, CEO of security firm Endgame.  

Wanted to make a list of the biggest and most damaging cyber attacks that were compiled in recent years. This is a “hall of shame” list of corporations, that handle sensitive data for all individuals, and most if not all of these breaches, were preventable. 

1) The worst: Equifax Hack, that affected multiple millions of people worldwide, however many believe that the true numbers haven’t yet been calculated. I don’t even know why this corporation even exists still. An organization dealing with people’s very sensitive info worldwide, and they haven’t got the first clue how to keep their data secure. Try calling their call centers and see if you manage to get anywhere. They still ask questions they’re not supposed to, like SIN numbers, major credit card, and everything under the sun. But when they pick up the phone, they supposedly have to “lie” about their names. I’m not making this up, I recorded it. Shame on Equifax that it took them two months to reveal the hack, the fact that information security pros warned them of what was to come, and they chose to sit dormant about it, the fact that they still utilize employees that don’t understand proper English and leave their records to be handled by TATA, who is a famously corrupt organization. It is evident by now, that data brokers should not exist.

2) The WannaCry ransomware (actually a successor of the HeartBleed virus) , that used leaked NSA hacking tools. Affected more than 150 countries and is still being reported throughout the world. In may of 2017, 300000 computers were affected from various diverse industries. There was actual human loss with this one: Hospitals that had their computers locked down, were forced to close temporarily. In an interview with CNN, a patient’s testimony was that his emergency cancer surgery was delayed as a result. 

3) Uber’s app became compromised in 2016 and as a result, attackers stole credentials from 57 million customers. What’s more insulting, is that the company paid them $100,000 to cover it up. Uber is now under scrutiny by lawmakers. Senators introduced a bill that would make executives face jail time for covering up data breaches of any kind. Attorneys in LA and Chicago and the Washington state attorney general, are suing Uber over the breach. Congratulations to the new Uber CEO, Dara Khosrowshahi, for letting the public finally know of this breach this past November of 2017. 

4) Verizon announced in October of 2017, that the reported 1 billion Yahoo accounts breached in 2013, were the wrong estimate. In reality, the findings were that ALL 3 billion Yahoo accounts were hacked. CEO said they didn’t even notice the breach until 2016.

5) In February of 2015, a triad of social engineers, hacked into the employee account of Antonio Marino, a Rogers installation technician. From there, they accessed and locked down several business and corporate customer accounts. Rogers denied to comply with their demand of 70 bitcoin in order to release the information back to them, and didn’t even alert the customers affected.

The Hall of Shame is actually never ending. We seem to be trusting our information to people who aren’t worth our trust. All of this, is only the beginning. 2017 may have seemed like a bed year for data breaches, but we’ve only hit the tip of the iceberg. Things will keep getting worse as time progresses.

[cyb3rs0ft-blog]

[cyb3rs0ft-blog]

Textbooks: Desperately Seeking Human Editors

A few years ago, I bought my first textbook on network security and ethical hacking. Will not disclose the name of the book or who wrote it, but will just say that the author is someone I respect very much, an amazing teacher with decades of experience in his field and a great sense of humor. Never before have I picked up an educational book, that made me laugh and giggle through almost every single page. He would always open each chapter with witty comments and would add a hilarious opinion on real-world technology blunders and news. Publishing company was McGraw-Hill, so we’re talking about a very reputable publisher, that has been around for many decades. The book came with the addition of a CD, that carried the book’s material and a very large section of practice exams so you could feel well prepared when going in to give the lengthy and complicated test for the ECC.

As the book’s author is an Information Security pro, he, of course, knows the given material better than any student out there. Although it was well written, it also carried many mistakes, much to my dismay. An example I can give here would be mathematics, physics or other textbooks that carry formulas or very specific instructions on how a task is supposed to be carried out. If one of those formulas has a typo or the wrong word is accidentally inserted into the instructional document, then the student may come across these important issues:

Complete a given task the wrong way, because steps needed to complete the project, weren’t properly explained to them or were just the wrong steps to take. There have been many times where I started to read instructions on how to use a specific tool, but couldn’t make sense of what I was reading due to grammar and spelling mistakes. There were even cases where I followed instructions perfectly, as I could understand the written directions very well, yet nothing worked the way it was supposed to, and eventually found out, directions were false. 

Memorize the wrong formula from start, which leads them to inaccuracies and the production of miscalculations. Also, it’s fairly common that the way we learn something the first time can become a temporary habit until we retrain our brain on the specific subject. Something like this is especially harmful and can bring chaos when it involves personal and corporate finances, but also when scientific research is being done.  Simple example: (real textbook typo) The Quadratic Equation ->  ax2 + bx + c = 0  presented as  ax2 + bx + cx = 0 in a textbook that I won’t mention here. 

How about forcibly responding to a test question with an inaccurate answer? If the solution to a query says we must mark two or more from the list of answers, otherwise the returning statement will be wrong, yet the screen output on the exam computer, is giving the choice to only pick one, then you’re unwillingly forced to give the wrong answer. Thankfully, you can alert the helpful proctor in this case. If he is there and if the rules allow it of course....> We have learned to rely on automation so much, even with editing nowadays. What used to be an editor, for any kind of book, is now a tech-editor or at the very least, some sort of software. And don’t get me wrong, as much as I love technology, automation, and innovation, humans are still needed for things such as editing. Grammar is also very important. It helps us understand each other and communicate in ways math cannot. And because software is based on computer logic, which in essence means math logic, an editor like Grammarly, can only help so much (don’t get me wrong, I use it too, but still have to proofread and make sure things are written in a way, where a human will understand flawlessly). That’s because an automated editor doesn’t know that when we communicate, as an example, we don’t use adjectives when they’re not needed, simply because they are implied, and therefore unnecessary sometimes. A few lines above, I wrote “And because software is based” but the program notes that phrase as a mistake in grammar, telling me I should be writing “And because_ the_ software is based”. This is because it doesn’t recognize that inserting the adjective, in this case, isn’t necessary. In real life, day to day conversations, that extra adjective (”the”) is implied and therefore not needed.

This is why we should always combine and rely on the human element just as much as our incredible technological advancements. We should bring humans and technology together in all projects we create. Because we can complement each other...human plus machine is better than just machine alone. Especially when it comes to things that require sentient reasoning.

[cyb3rs0ft-blog]

IMEI: Security Breaches Made Easy

IMEI stands for International Mobile Equipment Identity. This unique serial number, is used for identification of each cell phone, tablet and mobile accessory in the market. It can be twelve to sixteen digits long, and in the physical world, it would resemble the VIN (Vehicle Identification Number) of a car or truck. Companies used to place it in easy to see and find places, like for example the back of your phone, or on the box that the product came in, but now most companies have it embedded within each device, still easy to find, but only for the actual holder of the prospective device. They did this as a security feature, yet I see people on YouTube offering up their IMEIs, together with their names and countries, to (not even smart) social engineers, and online for everyone to see. This I can't understand. A little education can go a long way, when it comes to these things.

When an attacker gets a hold of your phone's IMEI, there are several things that can be used by that person, to leverage that information to their advantage. A SIM card number is completely separate from a device's IMEI, but sometimes consumers confuse the two. A SIM number can be changed at will, if you wish to change your number for example, but the IMEI is permanent and cannot be changed. When we connect our devices to an ISP's network, the provider captures both numbers, in order to enable their services on each device. The Subscriber Identity Module or SIM number, is the identifying number of your subscriber with the ISP, and the IMEI distinguishes the device. Much like IP and MAC address spoofing, IMEI spoofing is just as easy to do with the right software. While this practice may be illegal, it does happen for the purposes of hiding the attackers true address, or simply because it offers the ability to hide a person's activity, pretending to be another. Especially Black Hats and thieves with very little technical knowledge, will try to take non-blacklisted numbers and apply them to devices they stole, so they can use the "hot" device without consequence.

Another objective to fill, when people are asking for our IMEIs, is phone cloning, which comes in three flavors:

CDMA Cloning: Code Division Multiple Access (CDMA) cloning of mobiles, is achieved by gaining entry to the target device's file system, Node Version Manager (NVM) and Network Upgrade Manager (NUM) directories, by use of specifically tailored programs. Then the attacker can modify the target device Electronically Erasable Programmable Read-Only Memory (EEPROM), authorizing the Electronic Serial Number (ESN) and Mobile Equipment Identifier (MEID) of the mobile phone to be changed. The ESN or MEID is typically broadcasted to the Cellular Service Provider's Mobile Switching Center (MSC) in order to authenticate a device onto the mobile network. Editing these, can facilitate fraudulent calls, as the target cell phone becomes a clone.

GSM Cloning: Global System for Mobile communications or GSM, is a digital mobile telephony system that is widely used through the globe. This system utilizes a variation of Time Division Multiple Access (TDMA), providing a way for shared networks to access a medium. By partitioning the signals into separate slots, it allows several users to share the same frequency. The users transmit signals in fast succession, each using its own time slot.

AMPS Cloning: Advanced Mobile Phone System (AMPS) is one of the oldest of cellular technologies, and used Frequency Division Multiple Access (FDMA) to divide channels, for each conversation. As a result, substantial bandwidth to facilitate large amounts of traffic from users. AMPS was generally similar to the older Zero Generation (0G) Mobile Telephone Service, but used considerably more computing power in order to select frequencies, hand off conversations to Public Switched Telephone Network lines (PSTN), and handle billing and call setup. Analogue mobile telephones were notorious for their lack of security, as eavesdroppers could listen in at will.

Please remember that giving up your IMEI to unauthorized people, can also pose a privacy risk, besides the obvious security issues it raises. You are giving up your location for everyone to see. From there, your identity can be exposed, and so much more can happen.

With all our exceptional advancements and leaps in technology, it seems consumers feel safeguarded from all these threats, but they are all very real and much easier to achieve today, as attackers need little technical knowledge to compile these attacks and exploits. We all know from school that "sound travels", and this doesn't just stand for phone conversations, but keyboard strokes as well. Your keystrokes send a "message" of inputs to the screen, by the use of echo. Same as your telephone knows which line to call, because each digit you press, has it's own sound (have you heard of "phreakers"?). People used to tell me that "Big Brother is listening in".....if it was "Big Brother", I'd feel perfectly safe. It's malicious attackers I'm concerned about.....

[cyb3rs0ft-blog]

Spooky Spoofing

Spoofing means pretending to be someone or something you're not, whether in the virtual or physical world, but at this time, it's mostly done through electronic means, using software and other techniques, such as human based social engineering. It is broadly used by BlackHat hackers and Script Kiddies, in order to conceal their own identities an pass responsibility onto unknowing victims. The combination of spoofing and popular usage of VPNs (Virtual Private Networks), creates a difficult environment in capturing the true identification of malicious attackers. However, they are not impossible to discover, given proper defenses and knowledge are implemented within all generations of our population. Companies from diverse sectors have made fortunes from vulnerabilities that where easily foreseeable, and therefore prevented. I personally witnessed so many consumers in various commercial electronics shops, being anywhere from sadly misinformed (due to lack of knowledge personnel just can't or won't admit to), or being deliberately deceived, just for the purposes of making a sale. Deplorable actions, towards unknowing consumers, but that’s only my humble opinion.

There are many kinds of spoofing, but the most common types are the following:

IP Spoofing or IP Address Spoofing: Internet Protocol Address spoofing, is the formulation of Internet Protocol packets and is done for the purpose of concealing the true address of an attacker, by impersonating the identity and address of another computer system. In the physical world, it would be the equivalent of a person purposely using the wrong address or a P.O. box, in order to carry out a scam, without being easily detected.

MAC Spoofing: No, MAC here, doesn't mean an Apple product. MAC is the Media Access Control address for a Network Interface Card (NIC) or Networked device, which is factory assigned. It can be compared to the VIN number a car manufacturer assigns to a vehicle. The practice of disguising a MAC address for another, is known as MAC spoofing. Fundamentally, MAC spoofing entails changing a computer's identity, for any (usually nefarious) reason, and it is relatively easy to do, with proper software. Altering an assigned MAC address, can allow bypassing of ACLs (Access Control Lists) on servers or routers, by either obscuring a system, or allowing it to mimic another network interface device. MAC spoofing is done for legitimate and illicit purposes alike.

Website Spoofing: Spoofed websites, usually adopt the design of the target website by copying the source code, and most often use URL spoofing, in order to have a similar address as the target site. Website spoofing is basically the creation of a fake website, intending to mislead audiences that the site was designed by an authoritative entity. Unsuspected users, will give up their credentials, thinking they are visiting a legitimate site. Oftentimes, the end user will find that the "Login" button, leads them in an empty page.  

URL Spoofing or URL Redirect: The Uniform Resource Locator redirection, is a commonly used technique. It is a more sophisticated attack, that results in an attacker creating a "shadow copy" of the World Wide Web on a target machine, and having all of the victim's traffic go through the attacker's system, allowing the hacker to obtain the victim's sensitive information. By using domain forwarding, or inserting control characters, the URL can appear to be genuine while concealing the address of the actual website. Website and URL spoofing are most often used together.

Certificate Spoofing: Computer, Server and Domain Certificates are essential to the security of any system. Unfortunately, most end users are completely unaware of them and their significance, and usually ignore warnings that may come from browsers, servers or anti spyware programs. Certificates are used for authentication and non-repudiation. Falsification of certificates are commonly used to prevent the victim's plausible denial with a transaction or event, especially of financial nature.

DNS Spoofing or DNS Cache Poisoning: Type of security hacking, in which false Domain Name System info is brought into the DNS resolver, making the name server restore false IP addresses. This concludes in traffic being directed to the attacker's system (or any system). In addition to Website and URL spoofing, to perform a cache poisoning attack, the attacker exploits flaws in the Domain Name System server software. Servers, should accurately validate DNS responses, to ensure that they are from a reliable source, otherwise the server could end up recording incorrect data entries and serve them to other users that make the same request. This attack can be utilized to divert users from a legitimate site to a malicious one.

Caller ID Spoofing: The practice of causing the telephone network to indicate falsely to the receiver of a call, that the originating caller is placing the call from a location that is different from than the true originating station. For instance, a Caller ID, might display a phone number different from that of the telephone from which the call was actually placed. This is commonly used in situations where the motivation is considered malicious, either for the purpose of fraud, or simply giving false impressions to the receiver. Telephone networks provide Caller ID information, which may include the caller's name and number, with each call. However, some technologies, especially VoIP (Voice over IP) networks, as well as certain applications and sites, allow callers to falsify Caller ID information with fake names and numbers. In addition to Caller Spoofing, there is phone number replication, that makes it feasible for an attacker to see and respond to text messaging and calls belonging to another. Famous scam happening right now with this method is Customer Support Call Centers, like Microsoft and Apple, not to mention credit card companies and consumer agencies.

Email Spoofing: The creation or editing and sending email messages, using a real or forged sender address. If the address is real, it means the person owning that email account has been compromised, and attackers are using that email address as their own, unknowing to the victim. If the address is forged, it means the real sender is concealing his identity behind a legitimate source. The sending address can be similar, because the core email protocols do not have any mechanism for authentication. It is very common for spam and phishing emails to use such methods, in order to mislead the recipient about the origin of the message.

Spoofing of any kind is largely used by hackers to compile attacks, without being discovered quickly and easily. However, it is also used by Information Security professionals and Penetration Testers, in order to find and patch any holes that may be present in sectors that collect and keep sensitive data. In your next visit to my writings, we will be discussing the types of hackers and how they are not all bad...it is largely a misconception. Even police have to use the same methods as criminals do, in order to catch the bad guys.

[cyb3rs0ft-blog]

Cyber Crimes

HACKING: Making a system (any system) perform in a way which it wasn't intended to operate..

CYBER CRIMES: Internet Fraud and Financial Crimes

A variety of internet scams, many based on phishing and social engineering efforts, targeting consumers and businesses.  

These can be defined as: "Offences that are committed against individuals or groups of individuals with a criminal motive to intentionally harm the reputation of the victim or cause physical or mental harm, or loss, to the victim directly or indirectly, using modern telecommunication networks such as Internet (networks including but not limited to: Chat rooms, emails, notice boards and groups and mobile devices: cell phones, laptops, tablets, Bluetooth" (source: wikipedia). Cyber crimes may threaten a person or a nation's defenses and financial security. Identity and Data Theft, Spoofing of IP and MAC addresses, Computer Certificate falsification and Data Alteration are only some of the common methods used to achieve these crimes, also making it feasible to falsely fabricate a victim's involvement with a transaction or event. The vast majority of internet scams are based on social engineering efforts, which can be computer or human based.

SOCIAL ENGINEERING ATTACKS >>

A violent social engineering effort is called a "rubber hose" attack. As hilarious as the name sounds, it is responsible for an estimated 91% of data breaches worldwide (ref: https://www.darkreading.com/endpoint/91--of-cyberattacks-start-with-a-phishing-email/d/d-id/1327704? and https://blog.securityinnovation.com/blog/2015/11/protect-organization-against-91-percent-data-breaches.html). Most peculiar to me, although this "trick" has been around since before the birth of the internet, only a small handful of people seem to know how to identify it. I call it a gimmick, because that’s it’s logical classification. It is based on taking advantage of certain personality traits and deceiving someone into giving up information or tricking a person into doing something they're not supposed to do. Who hasn't let a person through a lobby door first, because they're carrying bags or look older? Who wouldn't give their credentials to the "trusted" security guard? If you don't hold that door open or deny giving that guard your accreditation, you may be considered "rude" or "antisocial". However, the people that react this way to these every day circumstances, are those who just know better. It is human nature to be kind and considerate, to give information when we feel there is an urgency to provide it...and the desire to be helpful and liked by others, is also absolutely human. And all of these traits, are exactly what attackers pray upon. Computer based social engineering is accomplished mostly through phishing and human based social engineering is done through the phone or in person, as the name suggests. One of the best movies depicting a social engineer at work is "Catch Me If You Can". If you haven't seen it, do. It's long, but you won't be disappointed.

PHISHING ATTACKS >>

Phishing is the pursuit of accessing privileged information such as usernames, passwords, social security numbers, bank account details and more, often for nefarious reasons, under the pretext of a trustworthy entity, usually in electronic forms of communication. However phishing can also be "human based". Information can be extracted through the phone or even in person, through a seemingly innocent line of questions and answers. It is widely used to establish social engineering intrusions.

Computer fraud is any counterfeit data display, executed with the intent of letting another do, or refrain from doing, something which can cause loss of funds or data. Fraud can result in securing an advantage for profit by:

a) Tampering with data in an illegitimate way. This common form of theft, is executed by employees or insider affiliates of a prospective company, and requires no technical expertise. This is accomplished by modifying data before entry in the system, or by entering unauthorized instructions or using unapproved processes; these employees may be disgruntled or simply under the influence of greed.

b) The alteration or deletion of stored data, which is extremely difficult to identify. Editing, sabotaging, concealing, or information embezzlement, most often to cover up illegitimate transactions, are only some of the ways used to carry out cyber crimes, without detection. This requires technical knowledge to achieve.

Have data breaches come to an end? Are we finally safe from "crackers"? Will the end of "net neutrality" bring a new era for web users, privacy and security? What difference will it make if our fundamental right to access information, becomes censored and tailored to whatever "ethical" stance each ISP stands behind? Or have we just hit the tip of CyberWars iceberg? Many believe, (and I share this opinion), that this is only the beginning, given the evidence at hand. 

[cyb3rs0ft-blog]

How to pick a proper password

[cyb3rs0ft-blog]

Who is Trinity?

Cyb3rS0ft is a project that aims to bridge the gap that stands in the middle of sentient beings and artificial intelligence.

Cyb3rS0fts' goal is to facilitate a unique relationship between humans and technology, Trinity is my creative robot - a program in it's testing faze - that I designed to resemble an authentic online personality, in every way imaginable. Only one thing can not be done with this fembot, and that is physical interaction - she is after all, a program. I chose the name Trinity, as an idea extracted from the CIA Triangle, which stands for Confidentiality, Integrity and Availability (did you think the names were inspired by "The Matrix", "Central Intelligence Agency” or religious beliefs, maybe?).

Did you know that each application, is actually a robot presented in it's simplest form (without all the mechanical adages you see in the movies)? All hardware needs to collaborate with a set of logical mathematical information, in order to function favorably for the end user (the resulting output of this cumulative info, is referred to as software, programs, apps, etc), which are originally compiled by IT experts from differing fields.

Any kind of communication or interaction between  humans and  machines, requires the use of software. Little programs, that are there to make our relationship with hardware tangible. These programs are essentially AIs, each assigned it's own task in the ever expanding world of cyberspace.

The creation of this experiment, was done in the hopes that it would help bridge a new relationship between technology and users, by building a network of trust and bringing you the best service possible. Trinity can help with anything:

Create dynamic content for your site, blog or forum

Manage your social media accounts

Do research and analysis vital to your project or endeavour

Perform competitive intelligence research

Market your services and promote your product

Provide expert insight and implement Information Security

Have an IT specialist repair your system or mobile device (mostly in house service or remote assist, depending on the issue)

Implement Social Engineering* and Reverse Social Engineering

Penetration Testing and Back-Track Investigations*

Contact Trinity to assist with any of your needs.  Quality is guaranteed. Project completion and estimates depend on complexity and ongoing demand. Rates are very fair and reasonable and depend on several factors, so please contact us for details, outlining the project and your specifications [such as what the required work is about, needed time of completion, length of project (how many words in a document for example), and other particulars].

NOTE: Q&A and constructive comments, are more than welcomed on this blog. Your questions will be answered personally and as fast as computationally possible by Trinity. Negative comments are also welcome, as long as they are not of abusive or aggressive in nature. Please remember, EVERYONE is in titled to their own opinion.

* Social Engineering is done only for the purposes of testing security and to assist in BackTrack investigations.

* BackTrack investigations can include anything from finding missing persons to who victimized you electronically. If it involves illegal activity of any kind (for example, tracking a person for the purpose of stalking), we regretfully decline to offer our services.

All services are offered under specifically tailored, mutual trust contracts, and communications are encrypted. Your information will never be kept in any database  and communications will always be confidential. All projects, results and relevant info will be eradicated completely, right after delivery.

[cyb3rs0ft-blog]

Passwords: The Keys To Security

Let's take on the subject of passwords (also known as key words, keys, secret words, secret passes, ID phrases, passphrases and others). They are the cornerstone of security for every person out there. Despite the myriad of sites on the net giving advice and warnings on the do's and don'ts of key word crafting, statistics show that too many users are still utilizing weak passwords to guard their data. Although some of the advice in this article has been written many times before, I hope that some parts will provide you with original output. Let's start with what you shouldn't do when choosing a password:

You should stay away from using easily recognizable or personal information about you, your family, friends, colleagues or your loving pet. You might be surprised how easily info such as name, birthday, phone numbers, family members and other details can be accessed. Because this info is easily attainable, it makes your identification phrase very simple to guess.

Do not use any one single word in a dictionary or a number written in letter form. Many password cracking software systems, use dictionary based attacks to solve your passwords. A dictionary attack is based on trying all the strings in a pre-arranged order, typically derived from a list of words, such as in a dictionary. One example of these programs, is called ophcrack*.

There are multiple sites with lists of some the most common passphrases utilized today, like passwordrandom*(/most-popular-passwords/). Do a Google search, and try to find sites that have more than 25 examples to display. Don't adopt commonly used key words...don't be that person.

Do not store your secret codes in your browser, computer, phone, tablet (any data storing device). As convenient as it is, it is also very easy for the wrong person to take control over that file. Secret passes should be stored in hard copy or a separate, secure device, like an encrypted USB or hard drive. However, you should still take caution not to write these clearly. Write them in a way that only makes sense to you.

Do not use the same secret code for more than one site and avoid using your network SSID as your passphrase. A site administrator with ill intent, may try to use your password against other sites you visit, to see if they can get access. And your SSID (Service Set Identifier) is visible by all devices in range.

Do not leave default user names (example: "administrator" or "admin1") and pass phrases (example: "password" or "passwd") on any device, that comes with these predetermined. In fact, make sure to change these parameters as soon as you start utilizing the system. One site with lists of default device username and passwords, is urtech*.

Below is some (hopefully original!) advice for creating strong passwords that are easy to remember, yet difficult for others to crack. Keep in mind, that all methods below are known to crackers, but exposure can be avoided, by not having a distinguishable pattern (for example, if you like using book or movie titles, consider changing around the word order, but don't make a habit of using titles for every account, especially not if they happen to be your favorite ones):

Many mishaps have surprisingly shown that, ThisIsMyPasswordYouWhiners! is actually harder to crack than PT56%@w3. Reason being that longer passcodes are more difficult for software to solve than shorter complicated ones. Whatever it is, make sure it can only be ciphered by you (make it hard to guess).

Favorable key word format is a combination of letters (small and capital), numbers and symbols. But as complicated as this sounds, it is actually fairly easy to implement. Example: HeyWhatsUpDock? can be H3yWhat$UpD0ck? (E=3, S=$, O=0, A=4 etc)...just use your imagination, but be aware that word - letter substitution, is very common.

You can replace part of the secret word with a numerical value, as displayed on a phone dial. Example: HeyWhatsUpDock? can change to HeyWhatsUp3625?

You can take a phrase and switch the words around so that it makes no logical sense. Example: UpWhatsDockHey?

You can use a combination of the above examples to create complex, and hard to crack, but easy to remember passcodes: Example: What$Hey3625Up?

Recently, a lady was interviewed who I felt, had a wonderful idea; she used short term goals as her passwords. As soon as she reached one goal, she created a new one. She ended up saving enough money to take the cruise of her dreams (ref: http://www.metronews.ca/life/health/2017/10/10/reminders-to-be-grateful-using-passwords-to-unlock-happiness.html). Your passphrase doesn't have to contain goals necessarily. It can be anything. You can get very creative with this method.

You can prioritize the complexity of passwords depending on how important privacy is for each account. Example: Email and money exchange accounts, like Amazon, PayPal or the email account you use to communicate with business partners, should be more complicated than a forum membership key.

It used to be advisable for users to change their password or pin every year, then it became six months and now it's advisable to do so every three months. For businesses or sites engaging in financial transactions, it is recommended to do this update once every month at this time.

Try to avoid using sites that test the strength of your key phrases. They are simply  unreliable (ref: https://nakedsecurity.sophos.com/2015/03/02/why-you-cant-trust-password-strength-meters/). You can consider using a password manager, but try to keep it outside of your system, on an encrypted USB, hard drive etc. Make sure to create the most complex passcode possible for that manager, if you choose to use one.

Really hope I didn't bore you with a popularly repeated subject. Much like anyone else in this industry writing about this, I am trying to help bring awareness to people and help contain weaknesses in security. Remember, the weakest link isn't the machine....it is the person behind it.

[cyb3rs0ft-blog]

Bitcoin Futures

Since it surfaced back in 2009, bitcoin is constantly gaining popularity and points in the stock market. At the time, research results showed growing popularity for the currency, but after analysis, I estimated it would only last a couple of years. This conclusion came after considering the following (keep in mind, I am not a finance wiz):

As a currency, it has no physical asset to back it up - its distribution numbers and value can keep rising indefinitely.

There are myths pertaining to who invented it - how much validity can a meme actually carry?

It circulates in a highly volatile market - as if financial exchanges of this nature aren't temperamental to begin with.

It is unregulated and serves as a means to hide and launder monetary funds - government approved!

It leaves the end user vulnerable to fraud, theft and hacking attacks - police and other agencies won't help you much, if you actually took part in a cryptocurrency transaction.

It is the main means of exchange on the dark net, which means it is used for illegal activity of all kinds - just making certain black market items available with the click of a mouse, isn't enough...we should also make these transactions completely untraceable...

My estimation was wrong (shocking!). Here we are, almost nine years later, and it's still out there. Bitcoin is making the headlines almost as much as President Trump. It has reached a soaring value of almost $20000 a piece in the stock market today, and despite all mishaps and warnings to the contrary, people are still putting funds towards purchasing it. This past October, a 39 year old Dutchman sold every single one of his assets for bitcoin, including his kids toys apparently, and this past November a woman lost $12000 in the latest Canada Revenue scam, with her story being one out of countless others.

There are multiple sites and applications, that offer up satoshis for seemingly simple tasks or playing games (not sure how many satoshis make up one bitcoin). Yet I have only found a handful of these sites to be secure. They are simply http sites, not https, which means they are vulnerable to anything under the sky and information should not be trusted with any of them. Play a fun game or watch a video and gain a little bit of a currency that is literally soaring. Does it sound too good to be true? Unfortunately, much like anything else, it is.

At the same time, the number of businesses suggesting bitcoin as a choice of payment, continues to grow, despite clear indications that the exact opposite should be happening. Why would a legitimate business be accepting a currency that carries the word "crypto" within it, is beyond me. Then again, as I explained in the very first paragraph, I'm no financial genius. Maybe others are more capable of finding something valuable in this risky investment. It probably won't be long before governments all over the world start cracking down on digital coin, or at least I hope it won't be. If money is the root of all evil, cryptocurrency must be the seed.

[cyb3rs0ft-blog]

Privacy Disasters

These past few years, Cyber Wars has become a true nightmare for many. As the demand for software increased, because of mobility and the need for productivity, so did malicious attackers. Somewhere along our quest for accessibility and convenience, the importance of privacy and security was dreadfully overlooked.

Most, if not all, of these applications, where created by well meaning people, with the end user in mind. Are they really beneficial though? How favorable can these programs really be, if confidentiality and trust are absent?

Google embeds tracking code in every program they own and create. Recording your keystrokes, location, site visits and anything under the moon...with their Pixel phone and Google Home, we need not write our own diary any longer. Just have Google play back to us where we were and what we did in days past.

Facebook app records our voices and the site caches our keystrokes. Samsung has facial recognition embedded in their products, RBC bank was using OCR (Optical Character Recognition) software so customers could take a picture of a cheque for deposit, HP (accidentally??) unleashed a key logger in newly released laptop...the examples are just too many to count. All this on top of voice replicators, phone number spoofing and wiretapping, to name just a few.

I understand the need for security software, as many of these apps are, and all of it would have been fine if these corporations and agencies could keep the collected data and resources guarded from mishaps and the human effect. But this is not the case unfortunately. Would be nice if they stopped providing the wrong side with bigger and better toys to play with.

[cyb3rs0ft-blog]

Research your research

Once upon a time....during my very first worm removal from a system, and being non the wiser, I came across an issue with MSC firewall snap in: Error code 0x6D9, that I had never before seen and could not understand in depth, the result of lacking relevant experience at the time. So I reached out to my fellow and "seasoned" InfoSec pros on the net. My quest returned copious articles and an overflow of contrasting opinions on the subject: anything from "the blue screen of death (will soon arrive)" to "your system is going to self destruct" (not in those precise words, but I'm sure you get the gist).

Along with these "definitive" hypothesis, came a plethora of suggestions on how to deal with this type of conundrum. Restore system back to "OOBE", reinstall OS, make use of the terminal to delete or restore certain hypothetical, but plausible, past actions and/or software, take existing machine to recycle yard and purchase another....and many more recommendations. Most of these solutions felt very drastic to me, but I am certain the authors were likely speaking from personal experience, and aimed to be nothing but helpful by dispersing this advice to the public, just as I try to be.

All relevant posts that I studied, resulted in trying to figure it out on my own (because I'm just stubborn that way). It was after all a firewall...anything at all could have been conflicting. The solution to the problem was discovered in about two days...the only action I had to restore on that system, was to switch the network adapter back to the "ON" position, a process that takes at best, three seconds to complete. Don't wish to sound completely morose, so I will justify the timeframe this took: two days includes my daily routine (work, exercise, personal time, etc), plus the time it took to analyze directives on the net as well as backtrack my own actions.

This experience is not to say "when in question, do not research". It is to say "investigate further". I am myself a researcher, and absolutely love gaining information and further analyzing it for accuracy. What I am trying to convey is "exhaust the sources of information as much as possible". Double, triple, quadruple check the data, instructions, tips, advice, whichever category the material you are evaluating falls under, just...scrutinize it. And don't forget to trust your logic and intuition. Does the extracted information make sense? Have other people attempted the proposed solution and succeeded? Are reviews, advice or statistics about a product or service, accurate and from valid sources?

Often, during our interactions with any device linked to the IoT, we will come across a problem or two to deal with. Although every system in the world will one day fail, the multitude of obstacles are simple to solve, given fitting insight exists and accurate steps are taken. But there are also many times where you will find the answer right under your fingertips. 

[cyb3rs0ft-blog]

Cyber-warfare and APTs