Is your e-mail invading your privacy

   Is your e-mail invading your privacy, some e-mails contain items that take details from your computer and record them for future use.
    What the how you cry well.

 A small image the size of a pixel can be placed inside the email this could be just a white dot, that can not be seen by the naked eye. These are known as  web beacon or web bug,  When the e-mail is opened a request is sent to the server  that is hosting the image. The IP address of the requesting PC is then recorded in a database against the image name. A history of your activity is then built up.

Image Name	You Computer address	Date \time	Browser    type
mail email.gif	\\your pc  address	01/01/2018	IE
Spammail.gif	\\your pc  address	02/01/2018	IE
another.jpg	\\another of your pcs	02/01/2018	Chrome

So what does this tell me

1. You have two PC that you open mail on.
2. The address of those machines.
1. your isp.
2. your general location.
3. You do open spam mail. so we can send more as it is an indicator that you have read the mail.
4. What browser you are using.
1. Custom Trojan's can be sent for that version of web browser.
5. The operating system you are using may also be recorded.
1. Will show computer type 
1. Windows Pc
2. Apple
3. Android

So now we know you e-mail may be invading your privacy. This is why programs like Outlook block by default the downloading of images from the internet and have to be manual requested.

Cyber Attack Crypto locking

  Early one morning this week I sat at my desk and  did CTR ALT DEL to log on to my own machine and Oh locked out who has been trying to get into my PC. I RDP  in to the domain controller  off another machine  and reset my account back to the PC, Locked out!.Back to the domain controller unlock it and back to the PC locked out! Now enough is enough I opened security log on the DC and there it was some thing was trying to access my account. Rather than mess about I quickly deleted my user account and recreated it with new credentials, JOB DONE. After a look around it was found that the RDP port was being used to try and access the system using my username, All RDP ports were closed and that was that.

We then notice that the router\firewall had over 6000 sessions open to one machine, more ports closed web server reboot and job done.

Next morning with crypto lock running around my head I checked the security logs, on the DC there it was Logon failure after logon failure. Usernames in Alphabetical order trying 6 or 7 times every minute then a new logon name and around we go. Now this is an old 2003 server so had now up to date AV or Patches everything we tried could not stop this, Somewhere on the machine was a Trojan trying to find a way in or is it out.
No new AV would go on the machine because of the age of the operating system no amount of looking could find this thing, Well what to do, take a spare or slightly used machine  promote it to a DC and turn the other off and disconnect it from the world. Reboot all the domain machines to pick up the new DNS and DCHP Job done two days of HELL.

WHY US

1.       Old unpatched operating system.
2.       No Anti virus because non available for old machine.
3.       Lack of Firewall security, got one not configured properly.
4.       Lack of security full stop.

The moral of this

Listen to the experts we should have had up to date operating systems full patched. The best AV and only approved web sites be allowed. Having watched the usernames that where being used to try to access the system tougher usernames need to be used ie joe.bloggs not just joeb.

You must be able to sell the security of your servers and data to the person that hold the purse strings because without them you are not patched and naked,

We got away with it this time and there will not be a next time.

 

Exchange Stops Sending Mail

A Funny thing happened the other day our mail server stopped sending and receiving Mail, ok not so funny.
       After trying all the exchange thing we started to look elsewhere, and that is where the problem was found. In GFI Mail Essentials. It turns out that an update to Viper Anti virus, part of the GFI security program decided that all mail was bad and blocked it all. Switching off the Antivirus within GFI Fixed the problem.

Just goes to show that just because things point in one direction they might be else ware.