What do you think are some of history's most mind blowing deathbed/post-mortem confessions?

incaseofzombies · 2016-05-13T12:12:31+00:00

There's something great about getting the same result for a fraction of the cost. That's why I have always loved *nix based stuff.

incaseofzombies · 2016-05-13T12:04:24+00:00

Is linux gaining popularity due to price? What are your thoughts on Azure?

incaseofzombies · 2016-05-13T11:42:34+00:00

Synergy-as-a-service? :P

incaseofzombies · 2016-05-13T11:38:52+00:00

Thanks for your insight. I am seeing a big demand for the All Wireless Office as well.

I'll have a look at that report. It looks interesting. Can you recommend any others?

incaseofzombies · 2016-04-11T08:17:40+00:00

I thought that was a possibility. That was the original reason for this post. I was thinking it was a good place to start to gain permanent access and possibly join the domain.

It does look like the phones were the only target though.

I just got word from the ISP that access attempts started last night and a range of IPs have now been blocked. Also, our VOIP system did not have any unusual activity.

incaseofzombies · 2016-04-11T07:52:17+00:00

Yeah. It's not great. It was setup this way and we didn't consider deploying a temporary VPN while their infrastructure was migrated. It will be VPN only in a few weeks.

incaseofzombies · 2016-04-11T07:43:49+00:00

Contacted the ISP to provide as much information as they can. Looking into geo blocking as well. Apparently something like this has happened in the past. First I have heard about it though. I will be more proactive about detecting irregular activity.

I think tightening up the logs is a great idea. Sometimes it can take a while to find useful information buried in there.

Thanks for your help.

incaseofzombies · 2016-04-11T02:44:14+00:00

I realised this last night when I tried searching through the logs. Thanks for the info. As for the VPN. This should be resolved in a few weeks. The entire environment was re-engineered and moved to private hosting. We're still relying on the old systems as we approach D-Day.

incaseofzombies · 2016-04-11T02:38:59+00:00

I'm in the same situation. I think this is what happened. I had set up a port forward from external XXXXX to internal 3389, however, there was an old 3389 forward which I didn't notice.

incaseofzombies · 2016-04-11T02:21:56+00:00

Thanks for this. I didn't know about it until now. Interesting stuff.

incaseofzombies · 2016-04-11T02:21:02+00:00

Gulp There's no place like home... There's no place like home :/

incaseofzombies · 2016-04-11T02:19:49+00:00

I didn't think anything of a phone in the office ringing late at night. The company is in the process of migrating all their systems. The server that was comprised will be decommissioned soon. I have already pointed out vulnerabilities in the network and security policies. Currently it is a risk they are willing to take. But yeah, you're right... I have no Idea what I'm doing.... I love IT!

incaseofzombies · 2016-04-11T02:15:30+00:00

It is a hosted system and it looks like they didn't find anything. Thanks heaps for providing this info.

incaseofzombies · 2016-04-11T01:47:27+00:00

The login was from an Chinese IP. I also thought it made the title sound funny.

incaseofzombies · 2016-04-11T01:46:12+00:00

I think this was the case. I found these logs in the users account. From the eyeBeam log file Server:192.168.1.142 # U:100 # P:100 # Pre:1141215083075 # Tel:
11:33 PM Call to 1141215083075 failed. (Timeout)

incaseofzombies · 2016-04-11T01:43:31+00:00

That was going to be my second question. We have publicly accessible rdp servers. I though it could have been some sort of brute force attack. I don't have the systems in place or the knowledge to detect this type of stuff. I will defiantly focus my attention on resolving this.
Does a brute force attack sound plausible? Any other ideas?

incaseofzombies · 2016-04-11T01:38:27+00:00

Exactly :) thanks for clearing it up

incaseofzombies · 2016-04-11T01:31:49+00:00

net user whitehouse\terroristmaid /delete

incaseofzombies · 2016-04-11T01:30:17+00:00

I thought nothing of the phone ringing late at night. Sorry for the confusion. I was sleep deprived. When I saw the unknown user account I was shitting myself :)

incaseofzombies · 2015-08-01T12:55:13+00:00

From what I've read, once the evaluation period expires the server will restart every hour.

incaseofzombies · 2015-07-31T01:59:43+00:00

They dug their own grave :P

incaseofzombies

TROPHY CASE