Yesterday it was reported that both TalkTalk and Post Office broadband customers have had their online access cut by an attack targeting certain types of internet routers. A spokeswoman for the Post Office told the BBC that the problem began on Sunday and had affected about 100,000 of its customers. Talk Talk also confirmed that some of its customers had been affected, and it was working on a fix. It is not yet known who is responsible for the attack. (It would also appear that local telco KCOM in Hull suffered similar problems last Saturday.)
In the light of these developments, Andy Green, a senior technical specialist at Varonis, comments: The lessons that should be learned from these ongoing Mirai attacks is just how vulnerable we were as a result of our own IT laziness. Sure, we can excuse harried consumers for treating their home routers and IoT gadgetry like toasters and other kitchen appliances – just plug it in and forget about it. So what excuse do professional IT types have for this rookie-level behaviour?
Not much! Unfortunately, default-itis still plagues large organisations. As long ago as 2014, the Verizon DBIR specifically noted that for POS-based attacks, the hackers typically scanned for public ports and then guessed for weak passwords on the PoS server or device – either ones that were never changed or were created for convenience, “admin1234”. This is exactly the technique used in the Mirai botnet attack against the IoT cameras.
Even if hackers use other methods to get inside a corporate network (phishing, most likely) they can still take advantage of internal enterprise software in which defaults accounts were never changed. For those organisations who think that the Mirai botnet incident has nothing to with them, or have to convince their board of this, here are two points to consider.
1. The lesson of the Mirai botnet attack is that the perimeter will always have leaks. For argument’s sake, even if you overlook phishing scenarios, there will continue to be vulnerabilities and holes in routers, network devices, and other core infrastructure that allow hackers to get inside.
2. Human nature tells us that IT will also continue to experience default-itis. Enterprise software is complicated. IT is often under pressure to quickly get apps and systems to work. As a result, default accounts and weak passwords that were set for reasons of convenience – thinking that users will change the passwords later – will always be an issue for organisations.
You have to plan for attackers breaching the first line of defences, and therefore have in place security controls to monitor and detect intruders. In a way, we should be thankful for the “script kiddies” who launched the Mirai botnet DDoS attack: it’s a great lesson for showing that companies should be looking inward, not at the perimeter, in planning their data security and risk mitigation programs.
Weird Tales Radio Show
Welcome to Episode 16 of the Weird Tales Radio Show. This is our our Friday the Thirteenth, All you ever wanted to know about Aleister Crowley but were afraid to ask, Get out your Hagstones to fight the Evil Eye, is it a Bird, is it a Plane, no it’s the Monster Owl Witch Show. The Big Interview is with Ashley Cowie and we talk about the myth surrounding Aleister Crowley: psychologist? Misunderstood trickster? The godfather of modern witchcraft and wicca? Music by Ozzy Osbourne.
Follow this link to access all episodes of the Weird Tales Radio Show podcasts. The page also contains links to all our platforms. Click the player button below to hear latest show.
New on the Grievous Angel
This is a stunning new piece of flash fiction, a masterclass in how to encapsulate a good story, characterisation and emotion in just 750 words by Andrew W. Mccullough. You can read it HERE free
This is Urban Fantasist
Curated by former barrister and Reuters correspondent turned writer, award-winning tech journalist, best-selling non-fiction author, sometime werewolf hunter, and internet radio host Charles Christian – Urban Fantasist is here to inform and entertain you with news and comment on weird tales, geek stuff, tech, urban myths, and folklore.
Also includes the Grievous Angel webzine for free-to-read, sci-fi and fantasy poetry and flash fiction.
And the Weird Tales Radio Show podcast archive. Click on any of the buttons below to access the shows.
Plus links to Charles Christian's books including fiction, nonfiction, and all the latest reviews.
"Charles Christian defiantly makes my world a brighter, funnier place."
"The legendary Charles Christian at his eclectic best... his insight and humour alone make this a must-read blog."
"Charles Christian is my inner spirit animal, thank you for making me laugh."
"the funny, wonderful and slightly cantankerous Charles Christian"
"His tech journalism is always witty. He has a talent for pricking the overblown claims of suppliers."
"Charles Christian does awesome!"
The Urban Fantasist website is now averaging over 4750 page views daily and 140,000 page views a month plus over 5500 unique visitors each week.
Over 194 weeks in Amazon's writing reference books bestsellers Top 20.
Can I copy content from this site?
Yes... providing you properly credit it. Here's the technical bit: Urban Fantasist content is licensed under a Creative Commons Attribution 3.0 Unported License which means it may be shared, remixed or used commercially as long as Urban Fantasist or Grievous Angel is cited as the source. If you have any questions, please email or use our contact form.
Green Tea Pot
Please drop a few PayPal coins into our Tip Jar to help us meet some of our running costs. Chocolate, green tea, flasks of wine, books of verse, the usual.
Copyright © Charles Christian
& WordsandVision Limited 2018
Grievous Angel ISSN 2059-6057
This site is fuelled entirely by green tea, dark chocolate and sarcasm.
Contact Address: Oak Lodge, Darrow Green Road, Denton, Harleston, Norfolk IP20 0AY, United Kingdom