The Morning I Found a Plugin I Never Installed
A plugin folder appeared on my site that I never installed. It was caught before it did damage, and the investigation changed how I run every part of my WordPress stack.
Tag: Incident Response (Page 2)
CybersecurityMy Own Site Got Hit: Anatomy of a WordPress Supply-Chain Attack
The email said malware had been quarantined on my site and I had three days to fix it. Deleting the file took a minute. The forensics took two days, and the trail ended somewhere worse than a break-in: the plugin…
CybersecurityThe Ransomware Years: When Laptops Became Bricks
Somebody opened a link, and their machine was a brick. Literally unrecoverable. Across a fleet of 1,500 desktops and laptops we lost machines to ransomware over and over, and never lost the network, because the network was designed by people…
CybersecurityThe Infection That Kept Coming Back
Clean machine A. While you are cleaning machine B, machine C reinfects A. We played whack-a-mole against a network worm that never got tired, and lost, until we stopped treating machines and started treating the network.
CybersecurityThe Virus That Crashed Our Own Email Server
ILOVEYOU never encrypted a file or stole a password from us. It just sent mail, from hundreds of our machines at once, until our Exchange server ran out of disk space and died. Recovery took weeks, and it changed how…
Book ReviewsForensics
If a crime writer owns one forensics reference, this is probably the one: comprehensive, authoritative, and written by a physician who knows how to teach writers and correct the TV-forensics myths. The cornerstone of the Howdunit series, notably more current…
Book ReviewsCause of Death
A physician's forensic reference on death, autopsy, and the procedures that follow, the companion to a wounding guide. Competent on the timeless basics, but its early-1990s detail is badly dated in a field transformed by DNA. A foundation to verify…