Tech Tip Thursday - Hawaii CyberCamps 2018

We have some opportunities to volunteer this Summer with CyberCamps. We are organizing 16+ CyberCamps across state and it would be great if you could find time to be an instructor at one of them. The slides and curriculum are provided. We really need someone to push slides and guide the students through foreign concepts like command line-fu or networking. Check out our CyberCamps Instructor survey and let us know if you'd be interested in helping us out.

https://goo.gl/forms/nAM86HK4axEKsENz2

If you have a Tech Tip you want to share, send them to info@cyberhui.org and we'll get them out next #TechTipTuesday.

Three Tickets to Shakacon X

We are giving away 3 tickets to Shakacon X at 4pm HST. Must be a Hawaii high school student to win.

All you have to do is send the secret message in this image to info@cyberhui.org https://drive.google.com/open?id=154zgeZdJ7QFRsUtHsCBTNsFnKQYtm2vH

Tech Tip Tuesday - Steganography

Steganography is the practice of concealing messages or information within other nonsecret text or data. Messages are commonly hidden in the “white space” of videos or pictures. Seemingly normal pictures could hold the key to winning things like tickets to Shakacon X. Super computers are not required to conceal your message. This website is one of many that can be used.

https://www.mobilefish.com/services/steganography/steganography.php

If you have a Tech Tip you want to share, send them to info@cyberhui.org and we'll get them out next #TechTipTuesday.

Tech Tip Thursday - Tax Fraud Prevention

It's the start of tax season which coincides with the IRS tax themed phishing emails. Credit Karma has some tips to keep your personal information safe.

https://www.creditkarma.com/article/tips-for-preventing-tax-fraud-31116

If you have a Tech Tip you want to share, send them to info@cyberhui.org and we'll get them out next #TechTipTuesday.

Tech Tip Thursday - Girls Go CyberStart

Girls Go CyberStart builds on the recent success of last summer's CyberStart. In Hawaii alone, 22 students received $1,500 scholarships from SANS. This round is just for high school girls. Registration is open between January 29 and February 16. Game play will be available from February 20-25. Good luck!

https://girlsgocyberstart.com/

If you have a Tech Tip you want to share, send them to info@cyberhui.org and we'll get them out next #TechTipTuesday.

Tech Tip Tuesday - Meltdown and Spectre The vulnerabilities of the year are here and it pretty much effects everything with a processor that was made in the last 20 years. Meltdown and Spectre were responsibly disclosed to manufacturers a few months ago and it is just now becoming public. Microsoft has issued out of cycle (not Patch Tuesday) update and other vendors are doing the same. Here are a couple of good talking points for each vulnerability. “Meltdown breaks the most fundamental isolation between user applications and the operating system. This attack allows a program to access the memory, and thus also the secrets, of other programs and the operating system.” “Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the safety checks of said best practices actually increase the attack surface and may make applications more susceptible to Spectre” https://meltdownattack.com/ If you have a Tech Tip you want to share, send them to info@cyberhui.org and we'll get them out next #TechTipTuesday.

Tech Tip Tuesday - 2017 SANS Holiday Hack Challenge

Are you home for the holidays with nothing to do? Why not take the SANS Holiday Hack and compete for the Grand Prize, a free SANS Online Training course (normally priced around $5,000). Answers must be submitted before January 10, 2018 but the content will remain available well after. If this is your first SANS Holiday Hack, I would recommend checking out past challenges first. There’s a lot of open source intelligence on the Internets.

https://www.holidayhackchallenge.com/2017/

If you have a Tech Tip you want to share, send them to info@cyberhui.org and we'll get them out next #TechTipTuesday.

Tech Tip Tuesday - Hour of Code

The Hour of Code is happening this week in conjunction with computer science education week. It gets bigger and better every year. This year they provide statistics to convey the impact they are having in the State of Hawaii. Are you one of the 2,219 registered teachers or one of the 91,561 registered students in Hawaii? #CSEdWeek #HourOfCode

https://code.org/advocacy/state-facts/HI.pdf

If you have a Tech Tip you want to share, send them to info@cyberhui.org and we'll get them out next #TechTipTuesday.

Tech Tip Tuesday - CTF Field Guide

If signed up, or are thinking about signing up, for the CampFIRE Cyber Security Challenge check out the Trail of Bits CTF Field Guide. In addition to finding other CTFs, it walks through the different types of challenges and provides training to ultimately help you win. How are you preparing for the CampFIRE?

https://trailofbits.github.io/ctf/

If you have a Tech Tip you want to share, send them to info@cyberhui.org and we'll get them out next #TechTipTuesday.

Tech Tip Tuesday - CampFIRE Cyber Security Challenge

CyberHawaii, University of Hawai‘i, and State of Hawai‘i is hosting a jeopardy-style, Capture the Flag (CTF) event. This half-day, on-site event is free for security professionals and college students. Participants can play in a team of two or individually. CampFIRE CTF is primarily focused around incident response and contains challenges that are based on real-life attacks or inspired by day-to-day security tasks. Upon completion of the event, participants will have learned about tools and techniques to deal with actual cyber security threats.

http://www.hawaii.edu/infosec/campfire/

If you have a Tech Tip you want to share, send them to info@cyberhui.org and we'll get them out next #TechTipTuesday.

Tech Tip Tuesday - Targeted Attack: The Game

Trend Micro has a “choose your own adventure” game that puts you in the Chief Information Officer’s (CIO’s) seat of a fictional company launching a new app. You are presented with multiple challenges and are responsible for the success or failure of the new endeavor. Not everyone aspires to be a CIO but understanding what problems look like at the C-level can help you communicate your challenges to leadership.

http://targetedattacks.trendmicro.com/

If you have a Tech Tip you want to share, send them to info@cyberhui.org and we'll get them out next #TechTipTuesday.

Tech Tip Tuesday - How to Protect Your Identity, Personal Data and Property

Our friends at Pacific Center for Advanced Technical Training (PCATT) shared this resource from Tom’s Guide a couple of days ago. The “What to Do If…” section covers some common issues like ransomware and identity theft. It also lists some tips for protecting yourself. It’s the perfect link to send someone asks, “Hey! You do computer stuff. What do you recommend?”

https://www.tomsguide.com/us/protect-yourself,review-4379.html

If you have a Tech Tip you want to share, send them to info@cyberhui.org and we'll get them out next #TechTipTuesday.

Tech Tip Thursday - Risk

Over the past few days I saw many vendors at #AFCEATechNet Asia-Pacific and I realized that every product and service they offer is built to address one thing. Risk. The generally accepted risk equation is “Risk = Threat x Vulnerability x Impact” and different products take on different factors. A vendor that provides “real time threat intelligence” is focused on threats. The “vulnerability assessment” tools focus on the vulns. Other focus on maintaining “uptime” with “resilient networks” to reduce impact. This SANS article identifies Risk as one of the “Five Tenets of Cyber Security” but for me it all comes down to risk.

https://securingthehuman.sans.org/blog/2017/10/05/the-five-tenets-of-cyber-security/

If you have a Tech Tip you want to share, send them to info@cyberhui.org and we'll get them out next #TechTipTuesday.

Tech Tip Tuesday - Password Reuse

Troy Hunt is the Pokemaster of collecting credentials from security breaches. He put together a database of 4,792,153,725 email accounts associated with both known and undiscovered breaches. These accounts have passwords associated with them and the major risk is password reuse. If you use your email address (e.g. Chunkylover53@aol.com) and super complex password to register for a site that has been compromised, you might have used the same credentials for another site (e.g. email, banking, Amazon). Once the bad guys get a hold of your credentials they start checking other sites for access. Have I been pwned is a quick way to check if your email address is associated with stolen credentials. The site does not provide the password associated with the email but it does say what breach it was associated with. Whether you are pwned or not, the 24th day of National Cyber Security Awareness Month is a good reason to change your password. #CyberAware #CSAM #HCSAM

https://haveibeenpwned.com/

If you have a Tech Tip you want to share, send them to info@cyberhui.org and we'll get them out next #TechTipTuesday.

Tech Tip Tuesday - KRACK Attack

The latest vulnerability to sport it’s own logo and website is key reinstallation attacks (KRACKs). The attack breaks the security of the WPA2 wireless security protocol. What does this mean? If you configured your home or work wireless connection with WPA2 to keep nosey neighbors off your network, you need to reconsider the safety or confidentiality of your network. Patches are available for some of the devices so be sure to update your wireless routers and access points. This attack does require someone to be close enough to your house to connect, so should be weary of people lingering outside your house with a laptop but that’s probably just good advice in general. #CyberAware

https://securingthehuman.sans.org/blog/2017/10/16/28748

If you have a Tech Tip you want to share, send them to info@cyberhui.org and we'll get them out next #TechTipTuesday.

Tech Tip Tuesday - Happy Cyber Security Awareness Month!

October is Cyber Security Awareness Month. The National Cyber Security Alliance has numerous resources available to keep you secure. Data breaches and supply chain attacks usually make their way into your news feeds but your home network security hits closer to home. The following link has a handful of suggestions. Can you think of other ways to secure your home network? #CyberAware

https://staysafeonline.org/stay-safe-online/securing-key-accounts-devices/securing-home-network/

If you have a Tech Tip you want to share, send them to info@cyberhui.org and we'll get them out next #TechTipTuesday.

Tech Tip Thursday - Linux Checklist

A common strategy of successful CyberPatriot teams is the use of checklists. Checklists should be living documents that are continuously updated. This ensures repeatable success and reinforces lessons learned. This Linux checklist was made by CyberPatriot competitors in 2016. Use it, merge it, replace it, incorporate it with your existing Tactics Techniques and Procedures (TTPs).

https://github.com/Forty-Bot/linux-checklist/blob/master/README.md

If you have a Tech Tip you want to share, send them to info@cyberhui.org and we'll get them out next #TechTipTuesday.

Tech Tip Thursday - CCleaner Malware

Supply chain attacks are in the news again after CCleaner version 5.33 infected with malware. The affected version (5.33) was released on August 15, 2017 and was available up to September 12, 2017. The scariest part was that the software wasn’t a bootleg copy. It was signed with a legitimate certificate. CCleaner has since updated the product but as of a couple of days ago, there were over 730,000 users still using the infected version. If you use CCleaner (which is still a good product) please update it.

http://blog.talosintelligence.com/2017/09/avast-distributes-malware.html

If you have a Tech Tip you want to share, send them to info@cyberhui.org and we'll get them out next #TechTipTuesday.

Tech Tip Thursday - Equifax Breach

If you haven’t heard yet, Equifax unwilling shared 143 million Americans personally identifiable information (PII) (e.g. names, social security numbers, birth dates, etc) with some unidentified actors. You should assume that your information has been compromised.

If you are not planning on applying for loan or new credit cards then you should consider freezing your credit with all four major credit bureaus. The fees are normally $5-10 to add the freeze and another $5-10 to remove the freeze. Currently Equifax is waiving its freeze fee until November 21st. Brian Krebs put together a great Q&A and the comments are always entertaining.

https://krebsonsecurity.com/2017/09/the-equifax-breach-what-you-should-know/

If you have a Tech Tip you want to share, send them to info@cyberhui.org and we'll get them out next #TechTipTuesday.

Tech Tip Tuesday - National Cyber League 2017 Fall Season

The National Cyber League Regular (NCL) Season runs from November 3-5, 2017. The Regular Season is the portion of the NCL where individuals compete on their own, without the assistance of others, to solve game challenges. The game challenges are aligned with preparatory exercises and allow participants to validate the knowledge and skills they are developing in the NCL Gymnasium.

https://www.nationalcyberleague.org/regular-seaso-fall

If you have a Tech Tip you want to share, send them to info@cyberhui.org and we'll get them out next #TechTipTuesday.