Black October - Cyber Security, how it affects PNWFF, and how you can protect yaself

[Evan B]

Some of you may have seen the “Black October” cybersecurity stuff making the rounds the last few days. The short version is that there are some legitimate issues being disclosed, but it’s not one giant coordinated attack that suddenly broke the internet.

“Black October” is basically a nickname that got attached to a bunch of major security problems that became public around the same time. Some are newly discovered vulnerabilities, some involve compromised software or services, and some are older breaches that are only now coming to light.

One of the bigger concerns involves PHP, which is part of the plumbing behind a huge percentage of websites. A couple of serious vulnerabilities were recently disclosed that, under the right circumstances, could allow an attacker to run code on a web server without having an account. There have also been compromised software packages, exposed credentials and API keys, and plenty of other problems mixed into the pile.

AI is adding another wrinkle to all of this. It’s becoming much better at finding obscure weaknesses in old code. That’s helpful for the people trying to fix things, but obviously those same tools can also be used by people looking for ways in.

For the average person, the best protection is still pretty basic:

• Don’t reuse passwords. Your PNWFF password should not also be your email, bank, Facebook, etc. password.
• Turn on two-factor authentication, especially for your email account. Your email is basically the key to resetting everything else.
• Use a password manager if you aren’t already. Let it generate unique passwords so you don’t have to remember them.
• Keep your phone, computer and browser updated.
• Be suspicious of password-reset and security emails or DMs. Instead of clicking a link in the message, go directly to the website yourself.
• If you’ve been using the same password all over the internet for years, now would be a very good time to change that habit.

As far as PNWFF goes, I’m doing what I normally do behind the scenes, just with a little more attention lately: keeping the server, forum software and supporting software updated, removing unnecessary exposure, and continuing to harden the back end as new vulnerabilities become known.

That doesn’t mean PNWFF, or any website for that matter, can be made completely invulnerable. It just means I’m paying attention and trying to make sure we aren’t leaving obvious doors open.

So, no need to panic. Just take basic account security seriously. A unique password and 2FA will protect you from a very large percentage of the problems that are most likely to affect the average person.

 

[Evan B]

Since I mentioned password managers in the other post, it’s probably worth expanding on that a little.

If you’re still using the same handful of passwords everywhere, a password manager is probably the single easiest security upgrade you can make.

The basic idea is simple: instead of coming up with a password you can remember, let the password manager generate something completely ridiculous and unique for every site.

Something like:

xG7!qP2#vL9@kR4$zN8

You don’t know it. You don’t need to know it. The password manager does.

Then if Random Fly Tying Supply Website gets hacked and its password database ends up on the internet, the bad guys get a password that works nowhere else.

A few options I’d recommend (I actually use a combination of a few of these)

Vaultwarden - Probably my favorite overall, and what I’d lean toward if you're technically inclined. It's essentially a lightweight, self-hosted alternative server that works with the Bitwarden apps. The big advantage is that you control where your vault lives. The downside is also that you control where your vault lives. If terms like Docker, reverse proxy, SSL certificates and backups make your eyes glaze over, don't start here.

Bitwarden - Probably what I'd recommend to most people. Open source, works on pretty much everything, has a very good free version, and doesn't require you to become a server administrator.

1Password - Very polished and easy to use. It costs more, but if getting the spouse/kids/etc. to actually USE the thing is the biggest hurdle, it's a very solid option.

Proton Pass - Another good one, particularly if you're already using Proton Mail/VPN/etc. Their free version is also pretty capable.

There are others, but you don't need to spend three days comparing password managers. Pick a reputable one and start using it.

The important part is unique passwords for every account and one very strong master password protecting the vault. Then put 2FA on the password manager itself.

And for the love of God, don't make your master password Fishing123.

 

[Billy]

I know what imma do when we go dark

 

[Buzzy]

Some of you may have seen the “Black October” cybersecurity stuff making the rounds the last few days. The short version is that there are some legitimate issues being disclosed, but it’s not one giant coordinated attack that suddenly broke the internet.

“Black October” is basically a nickname that got attached to a bunch of major security problems that became public around the same time. Some are newly discovered vulnerabilities, some involve compromised software or services, and some are older breaches that are only now coming to light.

One of the bigger concerns involves PHP, which is part of the plumbing behind a huge percentage of websites. A couple of serious vulnerabilities were recently disclosed that, under the right circumstances, could allow an attacker to run code on a web server without having an account. There have also been compromised software packages, exposed credentials and API keys, and plenty of other problems mixed into the pile.

AI is adding another wrinkle to all of this. It’s becoming much better at finding obscure weaknesses in old code. That’s helpful for the people trying to fix things, but obviously those same tools can also be used by people looking for ways in.

For the average person, the best protection is still pretty basic:

• Don’t reuse passwords. Your PNWFF password should not also be your email, bank, Facebook, etc. password.
• Turn on two-factor authentication, especially for your email account. Your email is basically the key to resetting everything else.
• Use a password manager if you aren’t already. Let it generate unique passwords so you don’t have to remember them.
• Keep your phone, computer and browser updated.
• Be suspicious of password-reset and security emails or DMs. Instead of clicking a link in the message, go directly to the website yourself.
• If you’ve been using the same password all over the internet for years, now would be a very good time to change that habit.

As far as PNWFF goes, I’m doing what I normally do behind the scenes, just with a little more attention lately: keeping the server, forum software and supporting software updated, removing unnecessary exposure, and continuing to harden the back end as new vulnerabilities become known.

That doesn’t mean PNWFF, or any website for that matter, can be made completely invulnerable. It just means I’m paying attention and trying to make sure we aren’t leaving obvious doors open.

So, no need to panic. Just take basic account security seriously. A unique password and 2FA will protect you from a very large percentage of the problems that are most likely to affect the average person.

I get lost with all of these letters (PHP, 2FA - which you used in the follow-up message). PHP - don't think I need to know but what have I missed with 2FA?

And Evan; thanks for your alerts to us./Pat

 

[Mossback]

2 factor authentication...

Often means sending an email or a text with a numeric code for you to then enter.

I use it for most of my e-commerce sites.

 

[Zak]

Google manages a lot for me. I find Google's Password Manager easy to use--it generates strong passwords, remembers them, and auto fills then when they are needed. I'm sure it's not as good as having my own vault of strong passwords, but easy is good.

 

[RCF]

2 factor authentication...

Often means sending an email or a text with a numeric code for you to then enter.

I use it for most of my e-commerce sites.

I use it whenever it is available including financial institutions and healthcare/insurance.

 

[Salmo_g]

Hah! Who uses Fishing123 for a password? Until they made me use letters, upper and lower case, and numbers, and special characters, I used 1,2,3,4. Except for my credit union and retirement accounts; for those I use complex passwords. For everything else, I don't understand why security matters. If someone wants to read all my emails, perhaps they should consider getting an actual life.

My iphone updated 3 days ago. It wants me to use my thumb print for access or to set a password. I don't use a password on my phone because I don't use my phone for banking on online ordering or any internet use other than google maps and a couple apps. If a hacker or AI gets into my phone they're gonna' be bored sh!tless. For whatever reason, apple or iphone isn't letting me decline to set a password this time. I press the "decline" button and it just goes back to the "set password" function. So the update message setting stays lit up, and I can't turn it off. I don't want a phone password because I don't store anything worth stealing on it.

Because passwords are required at pretty much every website I use, I have a 2-page list of passwords. Most of them are as simple as the site allows, usually 8-digit, often requiring a mix of character types. Do I really need complex passwords and a password manager for things like: hotmail, amazon, ebay, wa license express, pnwflyfishing, wdfw wild ID (and the other states I buy fishing licenses from), papa murphys, onyx, garmin, etc.?

 

[Evan B]

I get lost with all of these letters (PHP, 2FA - which you used in the follow-up message). PHP - don't think I need to know but what have I missed with 2FA?

And Evan; thanks for your alerts to us./Pat

No problem, Pat. And you're right, PHP is definitely one of those things you don't need to know anything about unless you're the poor sap maintaining the forum.

2FA just means two-factor authentication.

Basically, your password is one step, and then there's a second step to prove it's really you. Usually that's a code from an authenticator app, a prompt on your phone, or sometimes a text message.

The benefit is pretty simple:

Password only: Somebody gets your password, they're in.

Password + 2FA: Somebody gets your password, they still need that second step.

It's one of the easiest things you can turn on that makes a pretty big difference. Authenticator apps are generally better than text messages, but either is better than nothing.

And thanks. I try to keep an eye on this stuff so the rest of you don't have to know what PHP is.

Google manages a lot for me. I find Google's Password Manager easy to use--it generates strong passwords, remembers them, and auto fills then when they are needed. I'm sure it's not as good as having my own vault of strong passwords, but easy is good.

Honestly, Google's password manager is fine these days. If you're using it to generate unique passwords for every site and letting it autofill them, you're already doing the important part.

The biggest reason I'd lean toward something like Bitwarden, Proton Pass, 1Password, etc. is just that I prefer having my password vault separate from my Google account. Google has a way of taking over ones entire internet presence, and I try to spread myself out a bit more.

But I definitely wouldn't tell somebody who's actively using Google Password Manager that they need to swap to something else. A password manager you actually use is a whole lot better than the "three passwords I rotate through for everything" system most people default to.

 

[Evan B]

Hah! Who uses Fishing123 for a password? Until they made me use letters, upper and lower case, and numbers, and special characters, I used 1,2,3,4. Except for my credit union and retirement accounts; for those I use complex passwords. For everything else, I don't understand why security matters. If someone wants to read all my emails, perhaps they should consider getting an actual life.

My iphone updated 3 days ago. It wants me to use my thumb print for access or to set a password. I don't use a password on my phone because I don't use my phone for banking on online ordering or any internet use other than google maps and a couple apps. If a hacker or AI gets into my phone they're gonna' be bored sh!tless. For whatever reason, apple or iphone isn't letting me decline to set a password this time. I press the "decline" button and it just goes back to the "set password" function. So the update message setting stays lit up, and I can't turn it off. I don't want a phone password because I don't store anything worth stealing on it.

Because passwords are required at pretty much every website I use, I have a 2-page list of passwords. Most of them are as simple as the site allows, usually 8-digit, often requiring a mix of character types. Do I really need complex passwords and a password manager for things like: hotmail, amazon, ebay, wa license express, pnwflyfishing, wdfw wild ID (and the other states I buy fishing licenses from), papa murphys, onyx, garmin, etc.?

The part I’d push back on a little is the idea that someone getting into your email would just mean they get to read your emails.

Your email account is basically the master key to most of your other accounts.

Think about how many websites have a “Forgot password?” button that sends the reset link to your email. If somebody controls your email, they can potentially start resetting passwords for Amazon, eBay, Garmin, banking, government, forums, social media, and a whole bunch of other stuff.

They can also search your mailbox to figure out what services you use, find receipts and account information, impersonate you to people you know, intercept security alerts, and delete the emails telling you that your passwords were changed.

So the concern isn’t really that some hacker gets bored reading your correspondence. It’s that your email can be used as the starting point for taking over everything else.

That’s why, if I were only going to really lock down ONE account, it would probably be my primary email account. Strong unique password and 2FA at minimum.

And honestly, your two-page password list is exactly the problem a password manager solves. You only have to remember one good password. It remembers all the stupid ones for you.

 

[RCF]

Something one should consider...

We have all received those emails stating their company got hacked and will provide free credit monitoring.

Do not save your credit card info on other sites. It may ease ordering something but if that site (not just your account) gets hacked, then they may get your credit card info. I do have my credit card saved on my prescription delivery service with auto-ship and maybe one other place...

 

[Evan B]

Something one should consider...

We have all received those emails stating their company got hacked and will provide free credit monitoring.

Do not save your credit card info on other sites. It may ease ordering something but if that site (not just your account) gets hacked, then they may get your credit card info. I do have my credit card saved on my prescription delivery service with auto-ship and maybe one other place...

This does bring up an excellent point - in general, don't click links in just about any emails. Unless you're 110% sure it's legit (like confirmation links sent immediately after you signed up for a site or something), avoid it.