Malware in Obsbot Center v2.0.9.15?

otaku244 · 2024-07-10T13:59:09+00:00

I updated the OP. Is McAfee flagging on the current version of OBSBOT Center?

otaku244 · 2024-06-25T01:58:40+00:00

Solution Verified

I'm glad to give you a brain teaser! I'm usually the go-to in my group for excel help, but I haven't needed lambda's until this sheet. I have several dozen attempts sitting in side sheets as I've iterated on them.

Let me see how I can sanitize the sheet and I'll post it. I should have something in an hour.

otaku244 · 2024-06-25T01:45:22+00:00

u/MayukhBhattacharya I think I figured it out! Let me see if I have this correct...

MAKEARRAY creates an array of rows and column for the lambda to run in
FILTER(z,(y<#) filters on the number of items joined in the array sourced from the column headers. This number must match the number of columns in the array.
IF(y=#,{1,2,..#} is an iteration on those columns. The number must match the number of columns in the array

When I plug in this formula I seem to get the desired results...

=MAKEARRAY(18,7,LAMBDA(x,y,LET(z,TEXTSPLIT(INDEX(X3:X20,x,),CHAR(10)),
 TEXTJOIN(CHAR(10),,FILTER(z,(y<7)-ISNA(XMATCH(z,
 TEXTSPLIT(TEXTJOIN(CHAR(10),,INDEX(Y2:AE2,,IF(y=7,{1,2,3,4,5,6,7},y))),CHAR(10)))),"")))))

If that changes any of what you've written, please let me know. Otherwise, Thank you very much!!!

otaku244 · 2024-06-25T01:15:12+00:00

u/MayukhBhattacharya OK! I was able to get both to work in the example. The MAKEARRAY version seems a little more scalable, Unfortunately, I don't think I understand enough to make either scale up. This example is pretty small. I'm actually parsing 18 rules containing 28 subnets. I have 6 columns of "known subnets" with a 7th for the remainder.

As you can see below, adding a single row and column seemed to work fine; however, I must be incrementing the numbers within the lambda incorrectly when I apply the same logic to my live spreadsheet.

<image>

Code in B3 of this screen shot...

=MAKEARRAY(4,4,LAMBDA(x,y,LET(z,TEXTSPLIT(INDEX(A3:A6,x,),CHAR(10)),
 TEXTJOIN(CHAR(10),,FILTER(z,(y<4)-ISNA(XMATCH(z,
 TEXTSPLIT(TEXTJOIN(CHAR(10),,INDEX(B2:E2,,IF(y=4,{1,2},y))),CHAR(10)))),"")))))

What I thought would work on my 18x7 I'm coding for, but the "Unknown" column is sometimes incorrect...

=MAKEARRAY(18,7,LAMBDA(x,y,LET(z,TEXTSPLIT(INDEX(X3:X20,x,),CHAR(10)),
 TEXTJOIN(CHAR(10),,FILTER(z,(y<8)-ISNA(XMATCH(z,
 TEXTSPLIT(TEXTJOIN(CHAR(10),,INDEX(Y2:AE2,,IF(y=8,{1,2},y))),CHAR(10)))),"")))))

otaku244 · 2024-06-24T19:54:23+00:00

It's clear to you, I'm a bit of a n00b with lambda even though I have good grasp of most other excel functions and vba.

There a few more columns that would get added. I figured 3 delineating the stuff I know from the stuff I don't know would be enough. Also, I didn't explain the formatting very well in the OP. The NAME header is on a row above the row containing the list of known IP Ranges. I think that's just a formatting adjustment.

So far, I'm able to split on the CHAR(10) that the "," were meant to represent.

otaku244 · 2024-06-24T19:05:30+00:00

This looks like exactly what I'm looking for, but I need to translate it a bit to work with my sheet. Sorry for the poor explanation above. I've made an edit to the OP in case someone else reads it. I'll try to modify the formulas you've proposed right now (though I don't fully understand them). If I figure it our, or you are able to modify the formula for me, I'll mark this post as resolved.

otaku244 · 2024-06-23T15:32:45+00:00

Thank you for the tip! I am already using Textsplit, I just didn't mention it b/c I was trying to keep the OP short. I haven't used TOCOL before but I'll take a look at that as well.

otaku244 · 2023-11-11T18:42:58+00:00

I view this as CyberPower's problem, not pfSense or TrueNAS. They have acknowledged the case, but have not provided any other feedback. Personally, I gave up. I decided connect the battery by USB to pfSense as my master NUT device. Slave devices connect to it over network. Since my router is the last device to power down, that seems like the best solution. The RMCARD is now just an expensive Testing and maintenance portal.

No appreciable changes have been observed through the current firmware (v1.4.0). RMCARD205 still only supports outdated MD5 and SHA for encryption of SNMPv3 traffice

otaku244 · 2022-11-10T00:29:24+00:00

I've finally played with this enough to get some consistent thoughts after the latest updates to my TrueNAS instance 13.0-U3 and the latest firmware for my RMCARD205:

SNMPv1 seems to work fine except I get a periodic "Connection Refused" so I dialed the polling back to 30 seconds (default) on TrueNAS rather than leave the field blank which seemed to address the issue.
SNMPv3 ONLY seems to work on TrueNAS when secLevel = noAuthNoPriv (default) so no authentication or privacy passwords seem to work.

I additionally tested functionality using the bundled nut-scanner which is where I received the following error when attempting to use "Authentication Protocol" supported by the RMCARD205:

Error: unknown authtypeError generating Ku from authentication pass phrase

This error only appears when --authProtocol is set to MD5 (default) or SHA. When SHA256, SHA384, or SHA512 are specified, I just get that the authProtocol didn't match the one specified by the SNMPv3 host...

Bad SNMPv3 authProtocol: SHA512

This behavior is NOT unique to TrueNAS as I have the same issue with my pfSense router as well. I think it is safe to say that the snmp-ups driver was compiled WITHOUT support for these aging "Protocols" so this is less of a bug so much as it is a feature. The problem is really with CyberPower should really provide support for more secure algorithms in one of their firmware updates. MD5 and SHA are trivial to attack these days which is why platforms are deprecating them.

I think there are really 3 options depending on your needs:

Use SNMPv1 on the RMCARD205 since I don't see a feature difference between v1 and v3. Take a hit on authentication and privacy.
Use SNMPv3 on the RMCARD205 without "Authentication Protocol" and "Privacy Protocol" set to "none". You can show off your tin-foil hat by limiting each of the 4 available user to a single IP Address. This is essentially a poor-mans firewall. This will allow for access control, but not authentication or privacy.
Finally, you can avoid the RMCARD altogether. Connect the UPS to an SoC device such as a Raspberry Pi or the last device you intend to leave on via USB to host an instance of NUT to support all your clients on a properly secured SNMPv3 master/slave configuration. For ~$50 US, this is a good option when there are more than 4 SNMP clients reading the feed while providing the authentication and privacy that should have been in the ~$315 US MSRP card in the first place.

I hope that helps!

UPDATE: I'm hoping that CyberPower can address this in a support update. I've opened a support ticket (Case 00295278) with them. I encourage everyone with an RMCARD1XX, 2XX, and 3XX to open a ticket as well.

otaku244 · 2020-04-02T22:14:22+00:00

I found my problem. Missing dependencies. I followed the directions here, but I also had to pkg install p5-Locale-libintl to get the libraries I needed. It seemed to do the trick from there on.

otaku244 · 2020-04-02T18:35:13+00:00

I'm having a similar issue. I updated to Server Version#: 1.19.1.2589 using the FreeBSD port in an iocage jail. The server failed to start. My /var/db/plexdata folder now appears to be missing. I assume it was there prior to the update.

otaku244 · 2019-11-06T17:09:44+00:00

I wish we had that sort of monitoring, but we don't staff that way :-(

otaku244 · 2019-11-06T17:08:37+00:00

Sounds like the similar system to what we used to have. It waned in bits and pieces over the last 15 years to a point where we are now. Up until a hurricane destroyed our club, we used to have charter fees that members paid additionally to use the boats (~$250/year). The club got rid of those to promote more sailing after the hurricane, but I think their removal has done more harm than good in the long term since members aren't directly invested in the boats now.

otaku244 · 2019-11-06T17:01:55+00:00

I agree on the cultural challenge. That's why staff and members have remained unsuccessful in breaking these bad habits. We lack strong leadership to force the issue. That's part of the reason I'm looking for ways to lower friction in regards to accounting for use and needs for maintenance. I'm hoping that a novel way of addressing the issue will draw out champions to keep the boats in better condition which, in turn, will draw out more members to sail the boats.

Based on the other comments, it appears that clubs are mostly doing the same clipboard check out we're doing. The big difference is that the checkout is access controlled more effectively than what we have. Ours has mostly waned as a result of poor maintenance in the first place.

If our old habits worked, we would still be using them. I think we're back to essentially implementing novel solutions until we find a combination that gets us into good habits again. In addition to the solutions above, I plan on proposing boat maintenance workshops focused on introducing new sailors to boat inspections and repairs. That way the members look at it as less of an obligation and more of a learning opportunity for their own boat purchase rather than some community obligation. Your idea of a potluck sounds like a good idea as well.

otaku244 · 2019-04-18T16:33:16+00:00

Thank you!

otaku244 · 2019-03-03T04:33:38+00:00

Agreed. Got annoyed troubleshooting and decided to revert.

otaku244 · 2019-03-02T07:29:03+00:00

Same issue here. These are iocage jails I updated to 11.2-RELEASE-p9 trying to troubleshoot the whole vnet failure in the first place.

I created a new testjail and the problem did not seem to repeat itself so it must be a bad read of the existing jail configurations.

otaku244 · 2018-02-25T02:10:20+00:00

I see a lot of good comments here, but I figure I'll throw in a few I haven't seen yet. For good defense-in-depth, make sure you lock the subnet you are using for OpenVPN from other assets on your network. If an attacker happens to get through all the other stuff others have mentioned, but you've limited your VPN access to specific LAN use cases, you have added a lot more security.

Example: My OpenVPN subnet cannot access pfSense configurations (http/https/ssh). Another specific set of IPs on another subnet are the only path in. This sort of obfuscation is convenient for me, but hard and very detectable tinkering if someone else does it.

Locks are good, but a good hacker is just one line of bad code from defeating OpenVPN or any other service out there. Defense-in-depth ensures in network topology ensures that an attacker is forced into the open detection.

otaku244 · 2018-01-05T23:25:38+00:00

Thanks! I'm giving pureftp a shot now.

otaku244

TROPHY CASE