WordPress is one of the most popular website platforms for bloggers and businesses as of 2017. It is easy to use and flexible as well as highly supported by developers and designers, but its security should also be considered. WordPress Security Issues It is a sad fact that a great many websites have been hacked […]

It is possible to establish a security context with another domain by using the net use command. Syntax: net use \\<server name>\IPC$ /USER:<domain>\<account> Explanation: If you want to manage the Booky domain, with a PDC called Kooky, and you had an administrative account on Booky called bookadmin, you could use: net use \\kooky\IPC$ /USER:BOOKY\bookadmin you […]

We picked up a DEC Alpha Multia cheap at auction a couple years ago. We will use this multia to dump the network traffic that NT creates on boot using TCPDump. The first problem we had was that our Multia is not Y2K compatible. Many of our files ended up with dates of 2019, and […]

Free NIMDA Scanner checks for known NIMDA worm files (admin.dll, load.exe, readme.exe, etc.), checks your system.ini, and remotely checks “Administrators” group for “Guest” account. Click here to download. [Beware of running free programs that scan for viruses… better look that gift horse in the mouth. 🙂 Ed.]

Nmap is a free port scanner you can use to audit your own network and ensure the security of your hosts from outside your firewall as well. It is also entirely likely that your external interfaces are being scanned at this very moment with Nmap, or tools like it. One cool thing about Nmap, is […]

Do check out the Baseline Security Analyzer tool from Microsoft. Just download the MSI package from the page and install it with a shortcut on the Desktop (default). We ran it against a fresh Windows 2000 install with just SP2 installed. Here is a screenshot of the results. We are alerted to many security issues. […]

If you are being attacked or abused by a particular host, just enter the following command to deny all access to the host: /sbin/route add -host <ip address> reject Replace with the IP address of the host you want to block. The address will stay blocked until you bounce the interface. Alternatively, you could allow […]

Check out the European Institute for Computer Anti-Virus Research (eicar) Anti-Virus Test File page. EICAR provides test files you can send to your users to determine if their anti-virus software is functioning correctly. We’ve seen this work fine on Trend Micro and Norton Anti-Virus software, but most ant-virus software should correctly detect these files. To […]

If you have any kind of intrusion detection set up like Psionic’s PortSentry or a personal firewall, you’ll see attempts to connect on ports you may not be familiar with. Even looking up the port in /etc/services doesn’t tell the whole story. To find all known network services, trojans, worms and exploits associated with a […]

We wrote about blocking particular IP addresses with the route command here. If you are already using iptables, or want to start, a better way is to block particular hosts: iptables -I INPUT -s 25.55.55.55 -j DROP This command will simply drop any packet coming from the address 25.55.55.55. To list the chains: iptables -L […]

Conventional encryption is where there are no keys involved. This can be done with the -c option on GnuPG. When you use this option you will be asked for a passphrase. To decrypt the file the same passphrase is needed. This is ideal for password lists, where you have the ability to share the passphrase […]

One key to check on Windows boxen is the Run key. The run key is located in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. When a user logs on, the programs specified in the run key also run. Many times a trojan will install itself here. A lesser evil is the hordes of small little apps that like to run some […]

When I was a kid in 1975, my dad brought home a terminal with an accoustical coupler on the top where I could put a standard phone handset in, and communicate with a Microdata minicomputer at his work. [Dick Pick developed the operating system for the Microdata. To make it fast, he programmed it using […]

There is a most fabulous utility available for free download from Shavlik Technologies here that will scan your Windows boxen for needed security/bug fixes. The command line version doesn’t require registration, and is quite easy to use. The cool thing is that the status of current patches is downloaded at run time. Let’s run this […]

Yet another worm making the rounds via email. This one has a nasty payload. More info here. Removal tool here. Additional info for administrators and operators on IRC networks here.

As moon-howling, tree-hugging, packet-sniffing pagans, we like to celebrate the Summer Solstice by doing a security audit of the systems on our network. Spending the longest day of the year auditing systems will help us avoid spending the longest night of the year restoring a hacked one. In our audit, we will be disabling unused […]