Operational Security Tips and Tricks

-

For my last blog of 2020, I wanted to share a short checklist for users and researchers to keep themselves secure on the internet. Many attackers cast a wide net and many of those that fail the basics get caught. Hopefully this guide will help those on the path to Operational Security (OPSEC):

Social Media:

  • Set social media accounts (e.g. Twitter, Facebook, Instagram, Tiktok) to private.
  • Avoid using your real name when creating accounts.
  • Avoid using identifiable personal pictures for profile pictures and cover pictures.
  • Leave bio details blank and avoid sharing identifiable information.
  • Do not check-in to locations or share your location for social media posts.
  • Have a vetted list of friends/contacts that you permit to view your social media content. 
  • Finally, personnel who work in cleared positions may often ask family members not to share pictures of you and prevent tagging. 

Personal Security (PERSEC):

  • Use more than one email account - ideally one for critical services like finances, online shopping etc, and one for social media and other non-essential platforms.
  • Setup Multi-factor Authentication (OTP SMS text or Auth App). [1]
  • Check the enabled permissions of mobile apps so that you do not unwittingly share your contact details, SMS log, notifications, and other sensitive information with marketing companies, adware, and malware. 
  • Only download applications from official sources, such as the Google Play Store for Android.
  • Check if a URL is malicious using these three services: Browserling, URLscan and VirusTotal. [2, 3, 4]
  • Have I been Pwned - VERY useful service to check if your email address has appeared in any breaches and where you may need to update your passwords, as well as notifying you if your email address is present in a new breach when it is uploaded to the platform. [5]
  • Password managers - one of the most useful programmes to organise accounts in an encrypted database that can only be accessed locally with one master password. [6]
  • Alway backup data for a plethora of reasons, potentially in multiple ways such as removable media, and cloud services that will do it for free such as Google Drive, OneDrive, or iCloud.

The goal of these tips are to become harder to track down and targeted by threat actors. The more time it takes them to attack you, the more likely it is they will give up and move on. 


Along with the above, those who are public facing personalities may not get the luxury to conceal their real names from the world. For this group of people they are forced to up their OPSEC game due to the increased threat level and the higher number of attacks. These are also recommended for any type of user that takes security seriously:

  • Firstly, if you require a proper security review, it will be worth it to ask a professional to check your OPSEC using OSINT and other other types of audits.
  • Credit monitoring to check for fraudulent transactions.
  • Setting up alert emails to check if you are mentioned on Twitter or in news articles can be done via Google Alerts or Warble Alerts. [7, 8]
  • Secure email services such as ProtonMail can be used to send encrypted email addresses to others with similar ‘@protonmail.com’ accounts. [9]
  • Any applications, software or services should be reviewed before use with their privacy policies reviewed.
  • Before you interact with someone online whether you know them or not, they should be vetted via a quick background research. 
  • Virtual Private Network (VPN) appliances are recommended for when surfing the web and in public WiFi to encrypt your traffic on networks you do not own and from websites. [10]
  • It may also be worth investigating the use of a Virtual Machine (VM) to run a Linux or Windows operating system (OS) inside your primary OS. [11]
  • End-to-end encrypted (E2EE) chatting applications for mobile and desktop are recommended such as Keybase, Telegram, or Signal for secure communications and file sharing. [12, 13, 14] 
  • A final interesting tool that many security engineers use are known as CanaryTokens - these are laid like traps that set off an alert if an intruder triggers them. [15]

Links:

Popular posts from this blog

Raspberry Robin: A global USB malware campaign providing access to ransomware operators

-
Image
Logo credit: RedCanary Ever since it first appeared in late 2021, the Raspberry Robin malware campaign has been propagating globally. A number of threat intelligence reports by vendors such as RedCanary (who named it) and Microsoft (who track it as DEV-0856/Storm-0856) have covered the malware campaign in great detail.  In fact, the list of blogs I do recommend to read to catch up on this threat are as follows: https://redcanary.com/blog/raspberry-robin https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity https://blog.sekoia.io/raspberry-robins-botnet-second-life/ https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/ https://research.checkpoint.com/2023/raspberry-robin-anti-evasion-how-to-exploit-analysis/ https://securityintelligence.com/posts/raspberry-robin-worm-dridex-malware/ https://blogs.cisco.com/security/raspberry-robin-highly-evasive-worm-sprea...
Read more

Lessons from the iSOON Leaks

-
Image
  Introduction A Chinese Ministry of Public Security (MPS) contractor called  iSOON (also known as Anxun Information) that  specializes in network penetration research and related services has had its data leaked to GitHub. Based on the level of detail, leaked chat logs, amount of data, and corroboration from overlaps indicators of compromise (IOCs), there is a high level of confidence it is legit. Preliminary findings from less than one week since the leak revealed that it contains unprecedented insights into how the Chinese MPS operates by using Chinese commercial surveillance vendors and what their technical capabilities are. The Chinese MPS is China’s internal security service that primarily focuses on  internal and border security, counter-terrorism, surveillance. The MPS is comparable to the  Russian FSB, the US DHS or the UK’s MI5. The most interesting findings have come from iSOON’s product whitepapers and confidential slide deck presentations given to t...
Read more

The Ransomware Tool Matrix

-
Image
Introduction Ransomware attacks are becoming increasingly damaging, but one thing remains consistent: the tools these cybercriminals rely on. The Ransomware Tool Matrix is a comprehensive resource that sheds light on the tactics, techniques, and procedures (TTPs) commonly used by ransomware and extortionist gangs. This repository provides defenders with actionable intelligence on the tools frequently leveraged by adversaries, thanks to the insights shared publicly by the US Cybersecurity and Infrastructure Security Agency (CISA)'s #StopRansomware advisories and The DFIR Report's publications, among others. This repository offers straightforward insights from compiled open source intelligence (OSINT) research that can be directly applied to threat hunting, detection engineering, and incident response operations. Project Background As defenders, we can turn the tables by exploiting a crucial flaw committed by ransomware gangs: tool reuse. Many ransomware gangs repeatedly rely on ...
Read more