Steve Ragan
Indianapolis
As seen in:
Cisco Blogs,
Fast Company,
PCWorld,
The Daily Dot,
Macworld,
Computerworld,
Computerworld Australia,
CIO,
InfoWorld,
CSO
and
Covers:
Anything security and technology related, especially hacks, data breaches, and security research.
Doesn't Cover:
"crypto" currency. ICOs or related topics.
Father. Grandpa. Geek. Hacker. Former journalist. Security researcher. CMO @BSidesLV. Member: @CuratedIntel | BOD @CircleCityCon (RIP). | Tweets are my own.
Articles by Steve Ragan
Password Advice for the Rest of Us
October is Cybersecurity Awareness Month (CAM). All month long we’ll be presenting tips and tricks, as well as advice on a number of security topics, with the aim of helping inform and educate the public. We’ll start with some bad news some of you might not know, passwords are a problem and it’s hard to make a good one. This leaves many people vulnerable and exposed. So then, what is it exactly that makes a good password?
password manager Archives
Cisco Blogs / password manager password manager Password Advice for the Rest of Us 5 min read Passwords are a problem and it’s hard to make a good one. So what can you do? Make them long, make them random, and maybe use a password manager.
Gift Card Scams are a Year-Round Problem
Gift card fraud seems to pick up around the holidays, but this global scam is a year-round problem. This type of fraud is favored by criminals because it’s hard to track, and less likely to be intercepted by law enforcement. Some of the methods used during gift card scams are basic snatch-and-grab confidence ploys, where intimidation (either direct or passive) is used to extort the victim.
Fake AV phishing spikes in Q1 2022
There has been a noticeable uptick in the number of Fake Anti-Virus (Fake AV) phishing pages in Q1 2022. During my normal daily phishing scans, I rarely (if ever) come across the source code for these scam pages. Yet, during the first quarter alone this year, I’ve collected more than 50 samples targeting users on Windows and Apple devices.
Phishing 2021 - A Year in Review
If this year has taught me anything, it’s that phishing is still a problem, and it’s one that isn’t going away any time soon. With 2021 winding down, it’s the perfect time to look back at all my research and offer up some thoughts and details concerning the interesting and important aspects of what I observed. Table of Contents By the Numbers I. Log Traffic II. Operating Systems Targeted Brands I. Social Brands II. ISP & Tech Services III. Banking Pandemic Phishing Obfuscation and Control I.
When legitimate emails look like phishing attacks
An interesting example Awareness training programs frequently encourage users to report emails as phishing if they suspect anything unusual. For example, if the From address looks shady, or if the email message itself appears to invoke a sense of urgency, or warns of some sort of pending problem unless action is taken immediately, then users should report the email to IT, or the anti-phishing group.
KeyBank phishing attack hits Spectrum users too
KeyBank challenge questions I received an interesting phishing email Wednesday (08-September-2021). The message claimed to be from KeyBank. The original encoded message, as it first appeared in my inbox, is below. The encoding likely helped the lure1 bypass email filtering. Now, I’m not a KeyBank customer. So the email immediately came across to me as a scam when I looked at the from field. The body of the message confirmed my logic.
Kit Hunter 2.0 - Getting Started
Requirements Installation Usage Directory Scanning Shell Scanning Overview Kit Hunter is, at its most basic function, a search tool for administrators. With the release of version 2.0, this post will serve as a basic overview of the installation instructions and usage examples. Other posts will follow this one, and offer more granular levels of explanation on usage, but this brief overview will serve as a general getting started post. What is Kit Hunter?
Kit Hunter Version 2.0
Kit Hunter 2.0 is almost done! It’s been a while since I updated this blog. I felt it was time to hop on and update anyone who happens to be reading about the status of my Python experiment. As the title says, Kit Hunter v2.0 is almost done. The script is in its final stages, but there is some cleanup and documentation I want to work on before I release it. Honestly, it’s almost a completely different script compared to v1.0, which was released late last year.
Curated Intelligence Conversations on Apple Podcasts
1 hr 13 min This week, Technical Outcast hangs out with the crew on the Curated Intelligence Discord channel to talk about ransomware. The conversation covers best practices, mitigation, ransomware discovery, and what to do about ransom payments... should you pay? 1 hr 13 min
Tax Season: Criminals Play the Numbers Game Too
Criminals love tax season. The stress and urgency surrounding this time of year makes the victim pool highly vulnerable to various types of schemes. In addition to phishing, tax season is also the time of year when criminals focus their efforts towards other types of attacks including Local File Inclusion (LFI), SQL Injection (SQLi), and credential stuffing. In case you missed the news, the IRS moved tax day to May 17, 2021, so expect a second wave from criminals targeting the new date.
NHS Vaccine Scams: Criminals Still Targeting COVID-19 Anxiety
It's 2021, but the anxiety, fear, uncertainty, and stress caused by the COVID-19 pandemic in 2020 is very much alive today. Criminals are targeting the most vulnerable among us, using the lure of COVID-19 vaccination in their most recent phishing campaigns. Today's post will examine some of the history related to COVID-19 scams, and the latest vaccination scam, which the National Health Service (NHS) in the UK is warning the public about.
Technical Outcast - Issue #1
Subscribe to our newsletter By subscribing, you agree with Revue’s Terms and Privacy Policy. Feb 2, 2021 Revue This newsletter is mostly going to focus on what it is I'm reading, as well as my thoughts at the mom February 2 · Issue #1 · View online News and opinions from a former journalist and current security researcher. This newsletter is mostly going to focus on what it is I’m reading, as well as my thoughts at the moment on the topic.
The Dunning-Kruger Effect: A Discussion with Andy Ellis
The State of the Internet series provides expert insights on the cloud security and web performance landscape, based on data gathered from the Akamai Intelligent Edge Platform.
Minecraft players are targets even off the network
When we write the SOTI and talk about attacks against gamers, we spend a good deal of time focusing on network-level events, such as DDoS and credential stuffing. These are serious types of attacks and attack surfaces, but they aren't the only things gamers have to deal with. In fact, the add-on attacks are far more common than one would imagine. Recently, I became aware of a Minecraft player who was targeted by a scammer that demanded a ransom payment via the chat service Discord.
People Management with Kathryn Kun: A Discussion
The State of the Internet series provides expert insights on the cloud security and web performance landscape, based on data gathered from the Akamai Intelligent Edge Platform.
A quick Kit Hunter report example
(Updated 2021-09-26) To start with, Kit Hunter is a contextual search tool that can be used on any system that supports Python 3. It was created to assist administrators with the task of detecting and removing phishing kits from their websites / webservers. This is especially useful in shared-hosting environments where an administrator would need to search multiple directories. However, it also has useful applications for single domain managers, as well as researchers investigating phishing kits.
Three Editors Walk Into A Podcast: A Discussion
The State of the Internet series provides expert insights on the cloud security and web performance landscape, based on data gathered from the Akamai Intelligent Edge Platform.
Abandoned WordPress Installs
Criminals love abandoned WordPress installations Criminals love taking advantage of abandoned WordPress installations, often targeting vulnerable add-on scripts or modules to compromise the domain. They do this in order to upload phishing kits and other malicious payloads, and leverage the otherwise clean - or presumed safe - reputation of the compromised website. The older a domain is, the more valuable it can be.
Phishing research project
I started doing some research during my December vacation, and focused my efforts almost entirely on phishing and phishing kit development. It’s an interesting process, because no two kits are alike, even if the same person developed them. There’s always a slight variation somewhere, and as kits get recycled or copied, they become this hodgepodge of code and variables. That’s another interesting thing.
What A Year: A Discussion
The State of the Internet series provides expert insights on the cloud security and web performance landscape, based on data gathered from the Akamai Intelligent Edge Platform.
A Discussion: Kristin Nelson-Patel's path to InfoSec & Imposter Syndrome
Martin and Steve talk with Kristin Nelson-Patel, the Lead Architect on Akamai's Sensors Team, about her path into InfoSec, impostor syndrome, and what her job entails. This episode is a continuation of the theme started in October, and earlier this month, where others shared their experiences.
A Discussion: Imposter Syndrome & Paths Into InfoSec
In this week's episode, Martin and Steve talk about imposter syndrome and various paths into InfoSec, as well as how they got their careers started. Everyone's path is unique, and this episode explores that aspect with some recent examples including interviews published by SC Magazine with Lesley Carhart, and Wired who spoke with Maddie Stone - two exceptional examples of security professionals working in the field today.
IOCs and CVEs in the OT - Technical Outcast Episode 004
Today we’re joined by Ron Brash (@ron_brash), the Director of Cyber Security Insights at (Verve Industrial Protection). In this episode, Steve and Ron talk about operational technologies (OT), and how CVEs are a tricky task to tackle these days. In addition, the two discuss the issues related to Ripple 20 - the collection of zero-day vulnerabilities in a widely used low-level TCP/IP software library developed by Treck, Inc that were disclosed by JSOF. Listen to the episode below:
Personal Impact and Interactions (Andy Explains) - Technical Outcast Episode 003
Andy Ellis (@csoandy), CSO at Akamai Technologies, joins Steve Ragan for a discussion about adding value, and having an impact when interacting with the public. It’s the little things that matter, and during their talk, Steve and Andy discuss how things in their past shaped who they are and how they interact with the public today. Listen to the episode below:
Breaking Things With a Purpose - Technical Outcast Episode 005
In today’s episode, we’re joined by Jake Miller (@theBumbleSec) from Bishop Fox to discuss various aspects of the pen-testing industry, such as policy and scope, as well as getting the most out of your assessments. Jake also shares an amusing war story involving Microsoft Excel, and the power of basic built-in functions. Listen to the episode below:
Breaking things with a purpose - Ep 003
Breaking things with a purpose - Ep 003 Technical Outcast • By Steve Ragan • Oct 25 1x Breaking things with a purpose - Ep 003 In today's episode, we're joined by Jake Miller from Bishop Fox to discuss various aspects of the pen-testing industry, such as policy and scope, as well as getting the most out of your assessments. Jake also shares an amusing war story involving Microsoft Excel, and the power of basic built-in functions.
IOCs and CVEs in the OT - Ep 002
IOCs and CVEs in the OT - Ep 002 Technical Outcast • By Steve Ragan • 4 hours ago 1x IOCs and CVEs in the OT - Ep 002 Today we're joined by Ron Brash, the Director of Cyber Security Insights at Verve Industrial Protection. In this episode, Steve and Ron talk about operational technologies (OT), and how CVEs are a tricky task to tackle these days.
A Discussion with Amanda Berlin, CEO of Mental Health Hackers
The State of the Internet series provides expert insights on the cloud security and web performance landscape, based on data gathered from the Akamai Intelligent Edge Platform.
Don't Blame The User: A Discussion
The State of the Internet series provides expert insights on the cloud security and web performance landscape, based on data gathered from the Akamai Intelligent Edge Platform.
Personal Impact and Interactions (Andy Explains)
Personal Impact and Interactions (Andy Explains) Technical Outcast • By Steve Ragan • 11 hours ago Go to next audioGo to next audio Go to prev audioGo to prev audio 1x Work Life Balance (Andy Explains) Andy Ellis (@csoandy), CSO at Akamai Technologies, joins Steve Ragan for a discussion about work / life balance, in this inaugural segment called Andy Explains.
Work Life Balance (Andy Explains) - Technical Outcast Episode 002
Andy Ellis (@csoandy), CSO at Akamai Technologies, joins Steve Ragan for a discussion about work / life balance, in this inaugural segment called Andy Explains. Today’s Andy Explains segment is an important one, as the balance between daily life and work has become central to people across the globe during the COVID-19 pandemic. Some of the items discussed include distractions, and the importance of management providing multiple levels of support to employees.
Darknet Exploration - Technical Outcast Live Stream
Host Steve Ragan, joined by Krpyt3ia and rand0h, introduce Technical Outcast to the public during a live stream to raise money for Ocean Academy. The episode covers the basics of the Darknet, as well as other aspects of the criminal economy. The Ocean Academy is the only high school on Caye Caulker, an island of Belize. The students and school have been seriously impacted by the COVID-19 pandemic, and Technical Outcast was recorded live as part of a 24-hour stream to benefit the kids.
Darknet Revisited - Technical Outcast Episode 001
Steve and Dr. Krypt3ia return to talk about the Darknet, including elements that were left out of the live stream. In this episode they discuss the late and great Bob Ross, a recently opened market place, a carded product shop, the difference between real shops and scams, as well as the disturbing elements of the Darknet that are best avoided. Listen to the episode below:
Work Life Balance (Andy Explains)
Go to next audio Go to next audio
Credential Stuffing Attacks During the COVID-19 Pandemic
Since COVID-19 isolation protocols started in the United States in early March, bad actors have had a lot of time on their hands and a large pool of victims to target. Thousands of people, millions across the globe, suddenly found themselves working from home and away from many of the enterprise-grade protections that governed their day-to-day workflow. Immediately, remote work became the norm.
Vote Shaming by the Center for Voter Information
IMAGE CREDIT: CENTER FOR VOTER INFORMATION We’ve mailed your voting record to your neighbors I got an interesting letter in the mail recently, and so did several of my friends and neighbors. It came from the Center for Voter Information, and it comes off feeling like vote shaming, if not an outright attempt at intimidation. The letter starts by informing me that while who I vote for is private, my voting record is not. This is true, but using voter information like this just comes off as tacky.
An Example of a Failed Off The Record Attempt
A quick reminder about how off the record works Earlier this year, I wrote about off the record, on the record, and on background in a different post. One of the main points of that earlier article centers on the fact that off the record is only an option when both you and the journalist agrees. Note:You can’t just say something is off the record and leave it at that. The journalist has to agree. Otherwise, everything discussed is in fact on the record and subject to use.
Twitter Changes Basic Account Rules Heading Into Election Season
Twitter has disclosed some rule changes heading into the mid-term elections, and one of them has an impact on data. According to their blog post, the social media giant is going to close accounts that share hacked data, as well as those accounts that claim responsibility for a given hack. Distribution of hacked materials: Our rules prohibit the distribution of hacked material that contains private information or trade secrets, or could put people in harm’s way.
Project Update - Kit Hunter v0.2.27 Released
Kit Hunter Updated to v0.2.27 Earlier this summer I wrote about Kit Hunter, my Python project for systems administrators that locates phishing kits on web servers. For the most part, most of the updates have centered on the tags file instead of the kit itself. Today I updated the core code because I needed to add a brief note explaining the delay as the tags file itself is read.
Media Tip - When You Say “No Comment” That Is a Comment
One of the questions I’m frequently asked centers on the usage of “No Comment” during an interview. The question goes something like this: “If I’m asked about something I can’t talk about, or don’t want to talk about, isn’t it just easier to say ‘No Comment’?” Not really, and in some cases it can do more harm than good. Let me explain. The term “No Comment” is pretty straight forward. However, to some journalists it can mean a number of things depending on the questions asked.
Technical Outcast - The First Public Post
Well. Here it is. The first post public post I’m putting up online at Technical Outcast now that the website isn’t invite only. Some of you will notice I’ve removed a lot of the old content. It isn’t needed now. For the curious, it was mostly research notes, story notes, and random links to various things. I’m still not sure what I want to do with this website, other than the fact I intend to use it to further my journalism path and serve as a portal for useful information.
Project Update - Kit Hunter v0.3.01 Released
Kit Hunter Updated to v0.3.01 It’s been a while since I’ve written about Kit Hunter, the project I first started last summer in order to learn more about Python. Life has been a bit hectic, so I haven’t updated it as much as I want, but I sorted 66 phishing kits today and added new tags to help identify them. These updates will also likely discover other kits that are likely to be developed from the base code.
COVID-19 - Spare a Thought for Hourly Workers
Image Credit: Centers for Disease Control and Prevention (CDC) With COVID-19 circulating in the news, social media, and daily conversations, I’m reminded of how fortunate I am. “If you’re sick, just stay home.” Easy words to say, but not everyone is able to take them to heart without serious consequences There was a time when getting sick meant I’d have to lose a day of pay. Such a thing usually resulted in deciding what bill wasn’t going to get paid this month or what day I’d skip meals.
Co jsou a jak fungují phishingové sady
Phishing představuje útok, který přímo souvisí se sociálním inženýrstvím. Phishing je všeobecně založen na e-mailech, které zločinci využívají k získání přístupu nebo informací. Phishingové útoky mohou být základní, nebo přizpůsobené vzhledem k obětem a jejich organizaci. Phishingový útok s přímým zaměřením se nazývá spear phishing. Pokud by se například zločinci zaměřili na skupinu nebo osobu v rámci společnosti, použili by spear phishing k tomu, aby e-mail vypadal a působil jako legitimní.
Two employment scams are hiding in plain sight—here’s how to spot them
Job hunting is stressful enough, but when the job you’re hoping for turns out to be a scam, the sense of embarrassment and loss compounds things. Not to mention costing you money. The Better Business Bureau estimated employment scams resulted in a median loss of $1,200 per victim.
Security Boulevard
A recent blog post by LinkedIn says there are more available job postings listed in October than any other month. Since 89% of the hiring managers who spoke to LinkedIn said it takes less than four weeks to fill those roles, there is a limited window of opportunity – for both job seekers and criminals. October is National Cyber Security Awareness Month (NCSAM).
Fraudulent Card Transactions - A Black Friday Story
Itâs Saturday, the day after Black Friday. Iâm checking email to see if Iâve missed anything. Itâs the normal collection of bulk email, mostly previews of Cyber Monday deals, but something unusual catches my attention. One of the emails was a charge notification from PayPal. At 2:14 PM EST, someone used by PayPal Business Debit Mastercard to make a purchase for $73.14. The last time I used this particular card, it was an online purchase at DoorDash (food delivery).
Extortion Emails Threaten Victims with Bombings, Demand Bitcoin Payoff
Over the last few days, someone has been targeting organizations with extortion letters that threaten a bombing unless payment is made via Bitcoin. The emails themselves are spoofed to come from a btconnect.com domain, but the reply-to address changes with each email blast. So far, the scammers are using .cz domains, but that can and will change as this extortion scheme progresses.
Hacking Team hacked, attackers claim 400GB in dumped data
On Sunday, while most of Twitter was watching the Women's World Cup – an amazing game from start to finish – one of the world's most notorious security firms was being hacked. Note: This story is the first of two on the Hacking Team incident. A follow-up has been posted here. Specializing in surveillance technology, Hacking Team is now learning how it feels to have their internal matters exposed to the world, and privacy advocates are enjoying a bit of schadenfreude at their expense.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Steve
Contact Steve, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack