Quite a few years ago a client had a requirement for a Captive Portal page on their guest networks - we explored the commercial offerings available, but they required ongoing subscriptions/long contracts and were outside the clients budget for what amounted to a requirement for a disclaimer page (advising users that traffic was logged, and that it would be passed to law enforcement if requested - the client was a hotel, and I won’t elaborate on the circumstances that led to the request).

Modern Microsoft 365 environments change constantly. New policies are added, configurations drift, and security settings evolve as teams deploy new services. Without continuous monitoring, it’s easy for misconfigurations to creep in unnoticed.

This is a slightly unusual post for me, as I can actually discuss an incident in depth without being bound by an NDA. Also unusual as this is a scam affecting domestic users, most of whom don’t have a budget to perform full incident response and therefore I don’t often see, but may provide some insights into the tools, techniques and procedures used in a Microsoft Tech Support Scam.

As a relatively new Mac user, I frustratingly noticed that following a recent update my /etc/ssh_config had been wiped out. I connect to a lot of devices via and unfortunately some of them only support older key exchanges, or I have to use specific SSH keys or unusual usernames to connect that I have no control over.

Following on from a couple of Twitter conversations and as a result of this thread I thought a deeper dive into how this works (at least more than 280 characters, anyway), and how people can protect themselves from this type of scam.

I’m a bit of a closet fan of Draytek Routers/Firewalls. Given a choice of device for a small office at a budget of < £200 they give quite a bit of bang for your buck, with support for IPSEC, SSL VPNs, ingress/egress firewall rules, ability to create groups and objects, IP restricted remote access and remote syslog built in.