SSH is a software package that enables system administrators to securely administer their systems from a remote network with user authentication, commands, output, and file transfers being encrypted to protect against attacks in the network. While it is much more secure than common login services such as telnet, ftp, rlogin, rsh, and rcp, its default installation isn’t hardened. This advisory covers some of the hardening measures you can take to secure ssh. For details visit: Securing SSH
Description Memcache is temporary data storage service used to improve the overall performance of the website by storing chunks of data in a cache. If misconfigured memcached on port 11211 UDP & TCP is used to cause reflection DOS attack (send a spoofed packet to a device and have it reflected back). Memcached allows access to the data stored in the cache without any form of authentication and the attacker can easily access data in the corresponding caches and even modify them. How to Fix: Bind the Memcache server to a particular Source IP Only. Don’t expose this service in the […]
Tuesday 6th of February 2018 is globally marked as Safer Internet Day 2018 with the theme: ” Create, Connect and Share Respect: A better Internet starts with you“ . Every individual internet user has a role to play in making the internet a safer space. BtCIRT encourages everyone to review following advisories at BtCIRT website and remember simple steps you as an individual cyber citizen can take to secure internet world. Protecting-Privacy-on-the-internet Browser Security Protection from Phishing Mobile Security We also recommend you to visit childnet-safer-internet-day and https://www.saferinternet.org.uk/safer-internet-day/2018 to gain insight on how to be safer online.
Money Mules are people who consciously or innocently serve as intermediaries to move stolen/illegal money using their bank account(s) on behalf of criminals/fraudsters. While we have known of only rare cases in Bhutan, lots of these are happening around the globe. How does it happen: The criminal will get in touch with the victim via email, instant messaging apps, job website, blogs or even phone calls. They will convince the victim into providing their bank account details with either an attractive job , commissions or by seeking sympathy. The Fraudsters will transfer an amount into the victims account. Then the […]
Overview The report captures all essential activities undertaken by BtCIRT from July to December 2017. The overall mission of BtCIRT is to enhance cyber security in Bhutan by enabling cybersecurity information coordination and by establishing computer security incident handling capabilities within the country. Inline with its mission, BtCIRT has conducted security workshops, published articles and alerts on latest cyber trends, threats, vulnerabilities and best practices. BtCIRT also conducted security awareness program targeting end users, developed security baseline and conducted organisational security assessment of some of the organisations. View Report