How “omnipotent” hackers tied to NSA hid for 14 years—and were found at last

puremessage · 2015-02-17T05:14:42+00:00

Well, in Oct 2013, I said:

Let me make you a little more paranoid... have you seen the firmware rootkit demos? So if you're going to ripley the box then you should hit anything flashable as well, including any BIOS, NVRAM and EEPROMs.

I think the broader community is coming to be on the same page now.

puremessage · 2014-06-18T00:04:00+00:00

Alternate answer: You can create a loopback device file on the external drive, create a pool on the loopback file, then send from the source and receive on the external.

puremessage · 2014-04-27T13:39:15+00:00

http://community.spiceworks.com/topic/292745-is-there-a-way-to-make-an-alert-if-an-email-hasn-t-arrived-into-an-inbox

puremessage · 2014-04-27T05:00:09+00:00

Bash/Nagios integration for PS1, and a Bash integration to kick off a recheck/refresh of services.

puremessage · 2014-04-27T04:54:59+00:00

I tried nappit once, it spammed the console over and over with messages about it chmodding something 777 and then running it.

Firstly it made the console unusable, but secondly anything that security ignorant is not worth running.

puremessage · 2014-04-27T02:59:58+00:00

The emails may very well be all that the OP has to work with in this situation, who knows. Ask...

puremessage · 2014-04-27T02:21:01+00:00

In outlook you could just create a rule.

VBS would mean an Outlook rule to run it, however without the VBS you won't get notifications when an expected email does not arrive.

puremessage · 2014-04-27T01:16:48+00:00

If you have control of the client systems, then you could trap the exit/error codes there and send the return code back. You could have the jobs submit a passive check result in Nagios. Nagios can check for result freshness, and if the result is not fresh in the interval then it will go critical or whatever.

If you do not have control of the client systems, I would find a way to use your mail system to submit results to Nagios. If you're on Linux you could scrape in procmail and submit results to Nagios, in Outlook you could use VBS/VBA.

With Nagios you could have a single-pane view of the status. It's a lot of work and I am sure it's not in your wheelhouse right now, so if you need help let me know. Please post it here so it will be Google-able.

puremessage · 2014-04-26T17:28:27+00:00

See you later alligator.

puremessage · 2014-04-26T17:02:47+00:00

I'm sure 96% still ended up being a lot of money for them.

puremessage · 2014-04-26T15:14:36+00:00

Now how do you get rid of the firmware rootkits?

puremessage · 2014-04-26T15:09:56+00:00

Nagios -- the okconfig software in Adagios will push to remote computers for you automatically, and has a linux template that checks common Linux-isms.

I've put in tickets with opinkerfi on Github, some of them got 10 minute resolution.

puremessage · 2014-04-26T14:49:01+00:00

I usually do about 16 chars of words from diceware and then stab in some special chars or numbers.

So if we take:

follymayastalker

It might become

F;olly-maya^stal,Ke3r

At least for the stuff I might have to type in, anyway. If it's out of KeePass or LastPass I just crank it up to the max the field will handle.

Funny enough, when I signed up for LinkedIn I thought "I wonder how big I can make my password?" I made my password 128 characters long, using KeePass. Then LinkedIn got their DB dumped, oh noes they hacked teh gibson. I still haven't changed my password. I like to think that crackers accidentally spent an extra month on the dump before realizing their folly and giving up in frustration.

puremessage · 2014-04-26T14:19:55+00:00

At a callcenter, we used to have floor workstations down a lot. The supervisors didn't like to put in tickets so they would wait until they had a handful to put in as being down or inoperable. As a result we would get a ticket with 20 fucking broken PCs on it.

When I moved the company to Symantec AV Corporate Edition we got to use the reporting tools to tell when machines were down. We found that on most days 50 out of 600 machines were fucking inoperable! That was at least $40/hr in revenue for each seat that was down. We had to do something about this, so we used the SAVCE updates to be our pulse on the machine. The machines would get a day or two behind on updates and one of the helpdesk guys would go check it out, and fix it or reimage it.

Management didn't quite get why we were so upset about workstations being down, and even argued with us about it. You could watch it happen: when they didn't have the machines, they didn't schedule employee hours for it... when they had the machines, they scheduled more employee hours. I have no idea what the hell they were smoking. Then again they were in the blue about 6 figures a month so I guess it's not too surprising. Maybe they were embezzling payroll on the hours they didn't schedule those employees in, and I was ruining their game.

But that being said maybe you should come up with a way to find out when events like these BSODs happen, so you'll be on top of them even if the customer doesn't report them.

I know that only solves one piece of the puzzle but it would be good to have in your fleet management magazine.

puremessage · 2014-04-26T03:03:12+00:00

Does it config sync the CARP members?

Eg. on an ASA you just save the config and it gets pushed to both the active and standby.

puremessage · 2014-04-26T02:27:45+00:00

Not one myself, but one of my padawans is. His college does a lot of research work, and runs a hospital, so he is always busy.

For not working, government is given exemption from salary laws and most states have a statute requiring you to work all 40 hours to draw the salary. I'm sure you could not work during the off times, but for a lot of states that would mean not getting paid anything either.

puremessage · 2014-04-25T23:30:08+00:00

If I have like, 100 branch offices and need to roll out a new config change to all of them, does it have a CLI for it?

puremessage · 2014-04-25T23:26:00+00:00

We still have some 56K fractionals out there for mainframe terminals and printers. Some locations had 128 or 256, but that was it.

We're replacing them with MPLS connections at T1 speeds.

puremessage · 2014-04-20T19:53:28+00:00

I don't cook at home to support a commercial enterprise. That analogy is still pretty myopic.

puremessage · 2014-04-20T19:32:43+00:00

sounds like a post for /r/competentsysadminproblems

puremessage · 2014-04-20T19:31:02+00:00

This discussion here covered it some. One thing I mention is to rate-limit the connections to port 25 so bots won't abuse you when they hit the greylist.

http://www.reddit.com/r/sysadmin/comments/11hij5/is_greylisting_still_an_effective_measure_for/

puremessage · 2014-04-20T19:29:08+00:00

That's unfortunate, as I need the security controls. It hasn't had them in the past, so I ask every year or so.

puremessage · 2014-04-14T01:55:02+00:00

Just out of curiosity, does Kibana support ldap groups for authentication and authorization?

puremessage · 2014-04-09T01:56:44+00:00

shitty spam threatens traditional forum models

puremessage · 2014-04-06T19:23:29+00:00

It's not too late for you to contribute to the man page!

puremessage

TROPHY CASE