Steve's Security Blog | @northvein

"Sheilds Up!" I last wrote about honeypots back in October last year when I published the results of a WordPress honeypot that I'd been running for almost 100 days. That was my first and since then I've always had a handful on the go. I don't usually use any sort of honeypot distro, rather I prefer to 'bake my own' or in some cases re-purpose or replace some and services within a network to make a sort of patchwork, distributed honeypot. One practice which seems to have become almost a habit now is to install Splunk somewhere and use that to correlate (in the loosest sense of the term) the events observed. In the absence of a SIEM (an lets face it, a lot of companies just aren't there yet) it's a great way to convert those logs into intelligence and provide reporting as well as providing a user friendly interface for analysts and consumers to explore the data with.

This isn't a security post per se... in fact, it isn't even close. I'm sharing this purely because it still makes me laugh a year after it started. I could labor to make some point about facial recognition or authentication factors but ultimately this is what happens when two security guys prank each other and one of them beats the other hands down. At some point in the not so distant past, I started a *game* with my good friend Andy where we would set our Facebook profile pictures to one of each other and rename our accounts to match. As you can imagine, this got confusing for everyone who knew us both and hilarity prevailed. After a while I started to 'shop the profile pics to look more like me (above). It was fun for a while, but in the end Andy called time on it and I thought I had won.  Time passed, and about a year ago to this day, I sat down for dinner with him and around twenty friends after an afternoon touring the bars of Leeds for my bi...

Time flies when you're having fun, or so the old adage goes. It also flies when you're busy which I certainly have been since Christmas. I'm taking the opportunity to write this summary update as I head out to an industry summit ( ILTA LegalSec ) being hosted in Baltimore. So what's been keeping me so busy? Primarily, I've been busy since starting a new job. In December I joined the security function at DLA Piper supporting the Global business in both a technical and compliance capacity.  With any new job comes new challenges and the world's largest law firm certainly comes with its fair share. Anyone whose known me for any length of time can vouch for my appetite for a challenge and the legal industry seems to have a lot to offer. The role is a good fit for me and it seems like I've joined the firm at just the right time. In addition to a raft of technical and operational projects I'm getting the opportunity to adorn my compliance ha...

2014 was an interesting year to be working in security. The bad guys showed us that they were still capable of capturing the headlines and that even technocentric companies, presumably with ranks full of security savvy employees and managers weren't safe (if they can't stay secure, who can?). Their links to organised (and more traditional) crime were highlighted through a series of enormous breaches, typically designed to steal credit cards and PII. These attacks found success with huge retailers and restaurant chains, and even banks. We became aware of 'regin', a form of advanced and presumably state sponsored malware which could exist within the registry of an infected host, sort of like a 'cyber ghost'. It may have been been doing the rounds (undetected) for almost a decade according to one vendor. The internet continued to move into the home and closer to the heart through the rise of home automation and a general increase in the number of 'smart...

Apart from being a source of all too frequent and embarrassing typos, Splunk is a big data platform which allows you to interrogate data and present results is a variety of contexts and visualisations. I've been using it for a little over 12 months, self teaching or Googleing as I go, predominantly to sift through the terabytes of logs from various applications and appliances that get generated in my 9-5 every day.  You can use Splunk to build dashboards which are typically better than the ones that come with the product ( full size )  I've started to pull together all the searches, notes and bits of code into a sort of security cheat sheet which I thought would be a good thing to share as well as providing some real world examples of how you might use Splunk in a security context.  Cheat Sheet I'm actively working back through my notes and adding to this all the time so it might be a good thing to reference via the URL or re-visit from time to time. I'll t...

Like so many others I'm seeing an influx of booby-trapped Microsoft Word documents being sent in as email attachments with the end goal of infecting our endpoints with the Feodo/Cridex/Bugat trojan.  I'm relatively new to the whole malware analysis game, but what stands out to me more than the payload is the evidence of a strategy being played out. If you step back and look at the big picture, its clear that this is the work of an adversary that knows what they want, knows how they might achieve that and, most importantly, understands their target and their defenses. If our enemies are our greatest teachers then we, as security professionals, tasked with detecting and responding to threats can learn a lot from them. Not only can we use what we learn to shore up and improve our defenses but we can also use it to highlight, quantify and demystify our enemies to those we are charged with protecting. That last bit is perhaps most important because it is them, the stakehold...

I don't think I'd had chance to get my seat warm on Monday when I was approached by our service support function who were getting inundated with details about a 'virus' doing the rounds at via email which, when opened, forwarded itself to everyone in the user's address book. I don't normally get involved with desktop issues but I'm always happy to help and eager to understand risks both technically and from a wider business perspective. It seemed our endpoint anti-virus 'solution' had a 0% first-time detection success rate and by this time it had already managed to sneak past our 3rd party email security gateway. I set about acquiring a copy of the offending payload and decided that it would make a good candidate for a 'blind taste test' to run past a few online sandboxes. If you're not familiar with the concept, sandboxes are controlled environments within which you can run un-trusted programs and capture details about how they behave....