Cyber security analyst, software and hardware exploitation geek.

  • 0 Posts
  • 52 Comments
Joined 1Y ago
cake
Cake day: Jun 11, 2023

help-circle
rss

That is a shady sketchy as fuck Russian site. Please, if anyone is reading this, DO NOT access it or put your fucking IP in there.


If your DNS sinkhole is down, your modem/router/host operating system settings (and even the PiHole itself) should allow a fallback. If you didn’t set that up and don’t know how, then you should consider not using Pihole until you know what you’re doing.


This is he best Cloudflare guide I’ve seen so far. Thank you!




All apps send telemetry, this includes NewPipe. Your data is in that telemetry. The less apps you have installed, the less likely your data is sent to parties that leverage your information for profits.


DDG has a browser, and it’s based on Chromium which is from Google, so this is a shit take. Do not use Chromium based browsers if you value privacy or ad blocking features.


Why install the app when all the same features work in browser? Not only did I save storage space, I also kept privacy as well as reduced CPU/RAM usage on my mid-tier phone using the browser that was already installed.



Mines behind an NGINX reverse proxy as well. EMOTET is a very advanced malware and can get around those now. My IDS detected data exfiltration to an unknown Brazilian IP, and I have a VPN with an IP tunnel on top of my reverse proxy, as well as everything on port 443. It still found a way.


First read this

Then use the following:

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:“[CIS] Emotet C2 Traffic Using Form Data to Send Passwords”; content:“POST”; http_method; content:“Content-Type|3a 20|multipart/form-data|3b 20|boundary=”; http_header; fast_pattern; content:“Content-Disposition|3a 20|form-data|3b 20|name=|22|”; http_client_body; content:!“------WebKitFormBoundary”; http_client_body; content:!“Cookie|3a|”; pcre:“/:?(chrome|firefox|safari|opera|ie|edge) passwords/i”; reference:url,cofense.com/flash-bulletin-emotet-epoch-1-changes-c2-communication/; sid:1; rev:2;)

And the following:

alert tcp any any -> any $HTTP_PORTS (msg:“EMOTET:HTTP URI GET contains ‘/wp-content/###/’”; sid:00000000; rev:1; flow:established,to_server; content:“/wp-content/”; http_uri; content:“/”; http_uri; distance:0; within:4; content:“GET”; nocase; http_method; urilen:<17; classtype:http-uri; content:“Connection|3a 20|Keep-Alive|0d 0a|”; http_header; metadata:service http;)

And also this one:

alert tcp any any -> any $HTTP_PORTS (msg:“EMOTET:HTTP URI GET contains ‘/wp-admin/###/’”; sid:00000000; rev:1; flow:established,to_server; content:“/wp-admin/”; http_uri; content:“/”; http_uri; distance:0; within:4; content:“GET”; nocase; http_method; urilen:<15; content:“Connection|3a 20|Keep-Alive|0d 0a|”; http_header; classtype:http-uri; metadata:service http;)


I will simply copy/paste here then:

I have a refurbished server rack system that is running Zeek and also Suricata. I have a managed switch that will duplicate all network traffic to the system that is running those applications and a JBOD setup to store the countless logs. I have scoured through nearly all the CISA documents and alert reports to copy the various Snort rules they mention in each report and also purchased a specific modem to connect with my ISP that provides a service to monitor my traffic that has Minim.

I am a cybersecurity expert and still don’t know what I’m doing most of the time, so this is literally scratching the surface, as well as only detecting threats not really stopping them which requires more knowledge.


I have a refurbished server rack system that is running Zeek and also Suricata. I have a managed switch that will duplicate all network traffic to the system that is running those applications and a JBOD setup to store the countless logs. I have scoured through nearly all the CISA documents and alert reports to copy the various Snort rules they mention in each report and also purchased a specific modem to connect with my ISP that provides a service to monitor my traffic that has Minim.

I am a cybersecurity expert and still don’t know what I’m doing most of the time, so this is literally scratching the surface, as well as only detecting threats not really stopping them which requires more knowledge.


I have nginx setup and acessing through a Cloudflare tunnel but still getting EMOTET issues detected by my IDS.


I do this already and also am inside an encrypted Cloudflare tunnel… Still getting EMOTET warnings from my IDS.


My Jellyfin server keeps getting pinged by EMOTET malware lately. Everyone here should be aware if you expose the Jellyfin port to the internet it will get data exfiltration attempts. Use strong passwords.




Apologies, @admin. Thank you for the warning instead of instant ban. I will respect your community and pay attention to the site I’m commenting on the future.

I have edited my comment to comply with your mandate.


The military took the effort to plan the operation, prepare the battle space, implement procedures, designate all the proper personnel, equip the weapon systems, trained the military operators, developed the intelligence reports, and checked off all the tedious bureaucratic bullshit to prevent legal and international investigations and put that stack on his desk.

All that fat fuck Trump moron did is listen to the 4-star ivy-league college educated general summarizing the request to him like he would to a toddler while Trump stuffed his fat fuck face with McDonald’s and signed the paper to allow it.


you can do things in this game that you can’t do in any other.

I’m not a SC hater, and had purchased Squadron 42 almost a decade ago, and I call bull shit on your statement. Please name all of the things you claim it innovates no other game does. I bet you money it does not and you cannot name anything special.


They have decided to adjust all development focus on being able to stimulate the perfect realistic animation of a poop crowning out of an in-game dog’s ass.



You haven’t even named a single one and might as well not have wasted time posting your useless fucking comment.

For everyone else, here’s one: https://1337x.to/



Yeah this is right up my alley. Can’t wait to install this and document everything.

I am very paranoid about security, so is there a reason you deter people from using this application in a Docker container per your website?


His golden parachute value is tied to the stock value of the company, so of course he doesn’t care about long term projections, only short term while he’s still at the company for a couple years.


Anyone know where I can buy or place bids on batches/pallets/etc of them? I want to self host a bunch of shit using those cheap computers that are being thrown out.


ASUS will receive a non-exclusive license to Intel’s NUC systems product line designs, enabling it to manufacture and sell 10th to 13th Gen NUC systems products and develop future designs. This will enable ASUS to provide product and support continuity for Intel NUC systems customers. ASUS will establish a new business unit called ASUS NUC BU.

Saved you a click.


How the fuck do you self host Google Photos ya dingus?



I don’t own one, but want to as well. Commenting here to return and see what anyone replies to you.


Yo, reading your comment, I realized your dad raised a cool af kid.


I can search and read about LogSeq, but I can’t find anything about Obsidian. Can you please help me out? Thanks.



They used to be Denver-based, but got bought out by a shitty British mega corporation with shit policies, so I dropped them for Nord, which also sucked because their servers were slow.


They are a great VPN. People hated them because it’s a fad to hate on the status quo, as well as their heavy and annoying advertising campaign.


There seems to be a lot of limp-wrist ninnies there clutching their pearls because a pirated game software manager suite is called “Crackpipe”.


Fuck, this worries me. Looks like my upcoming next PC build will exclude an OS and opt for a Linux distribution.


This has been a decade too late for me, but I’m still excited to play again once Adventure Mode is up to speed.