Mobile Users Falling Victims To URL Spoofing
Yikes, aren’t there enough mobile vulnerabilities already? Now we have to tend to URL Spoofing and determining if the website is real or not?
A Rapid7 researcher named Tod Beardsley, which disclosed the vulnerability, said this flaw, is an instance of CWE-451 from the Common Weakness Enumeration. It is cause for concern because these victims on mobile devices can’t tell the difference between a real site and the fake site victims land on.
In its most common cases a user would get lured to click on a link from a social media site, or receive a text on their mobile device with a link that would take them to the fraudulent site. In just about every instance, once the user clicks, he’s asked to give up something, whether it’s credentials or credit card information.
… Read the rest“I can’t really tell the difference,” Beardsley said. “The mobile address bar is so small that
Hackers From Iran Are Spreading Dharma Ransomware Via RDP Ports
A group of hackers from Iran are targeting worldwide companies that use public-facing Remote Desktop Protocol (RDP) and infecting them with the Dharma Ransomeware.
The attackers would lunch their campaign by first scaning ranges of IPs for hosts that contained these vulnerable RDP ports like 3389 which is the default RDP port, afterwards attempt weak credentials. They have been using a scanning software called Masscan.
Once vulnerable hosts were identified, the attackers deployed a well-known RDP brute force application called NLBrute, which has been sold on the dark web forums. Using this tool, they are able to brute-force their way into the system, and then check the validity of obtained credentials on other accessible hosts in the network.
Attackers also attempted to elevate privileges using an exploit for an elevation privilege flaw. This medium-severity flaw (CVE-2017-0213), which affects Windows systems, can be exploited when an attacker runs a … Read the rest
Netgear Zero-Day Vulnerability Allows Full Takeover
A cybersecurity researcher found a Netgear Zero-Day vulnerability which allows full takeover of about 79 Netgear router models.
“The specific flaw exists within the httpd service, which listens on TCP Port 80 by default,” according to the ZDI report, which covers the bug’s presence in the R6700 series Netgear routers. “The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, stack-based buffer.”
“This vulnerability affects firmwares as early as 2007 (WGT624v4, version 2.0.6),” he said in his post. “Given the large number of firmware images, manually finding the appropriate gadgets is infeasible. Rather, this is a good opportunity to automate gadget detection.”
Affected router models
According to Nichols, 79 Netgear router models and 758 firmware images contain the vulnerable HTTPD daemon.
A list of these affected models and firmware can be found in Nichols’ PoC exploit.… Read the rest
Restore Dell N4024 or N4048 Switch to factory defaults
To restore the Dell N4024 or N4048 switch to factory defaults you can follow the below procedure:
- Manually reboot your switch
- While the switch is booting up keep an eye on the bootup screen and find “Dell Networking Boot Options” and select option #2 (Display Boot Menu) within 3 seconds.
- On Boot Main Menu, enter choice # 10 for enable password removal.
Dell Networking Boot Options
Select a menu option within 3 seconds or the Operational Code will start automatically…
1 – Start Operational Code
2 – Display Boot Menu
Select Cl , 2) # 2
Boot Main Menu
1 – Start Operational Code
2 – Select Baud Rate
3 – Retrieve Logs
4 – Load New Operational Code
5 – Display Operational Code Details
9 – Reboot
10 – Restore Configuration to Factory Defaults
11 – Activate Backup Image
12 – Start Password Recovery
Enter … Read the rest
Restore Dell N3024 or N3048 Switch to factory defaults
To restore the Dell N3024 or N3048 switch to factory defaults you can follow the below procedure:
- Manually reboot your switch
- While the switch is booting up keep an eye on the bootup screen and find “Dell Networking Boot Options” and select option #2 (Display Boot Menu) within 3 seconds.
- On Boot Main Menu, enter choice # 10 for enable password removal.
Dell Networking Boot Options
Select a menu option within 3 seconds or the Operational Code will start automatically…
1 – Start Operational Code
2 – Display Boot Menu
Select Cl , 2) # 2
Boot Main Menu
1 – Start Operational Code
2 – Select Baud Rate
3 – Retrieve Logs
4 – Load New Operational Code
5 – Display Operational Code Details
9 – Reboot
10 – Restore Configuration to Factory Defaults
11 – Activate Backup Image
12 – Start Password Recovery
Enter … Read the rest
Unifi Cloud Controller Adoption Using SSH
In this Tutorial I will be showing you how to adopt New Unifi Devices to your Unifi Cloud Controller using the SSH Method.
We will first start off by:
- Download and install Advanced IP Scanner.
- Open the Advanced IP Scanner and run a scan to locate all your New Unifi devices.
- Note: Make sure network discovery is enabled on your computer
- Within Advanced IP Scanner make sure to notice the IP addresses that each Unifi Device is using.
- Download, install, and run: PuTTY
- Enter the IP address of the UniFi device, Port 22, Connection type: SSH, and click “Open”
- Login using the default username is ubnt and password is ubnt.
- In that same console window type without quotes “set-inform” followed by the server address http://yourdomain:8080/inform”
- Make sure to use a DNS name instead of an IP address.
- Make sure to use http:// instead of https:// and use :8080/inform,
Unifi Cloud Controller Adoption
In this Tutorial I will be showing you how to adopt New Unifi Devices to your Unifi Cloud Controller.
We will first start off by:
- Download and install Google Chrome.
- Download, install and run within Google Chrome the Ubiquiti Device Discovery Tool
- Next Click: [Scan] and wait for your devices to show up.
- Note: Make sure network discovery is enabled on your computer.
- Afterwards click on [Unifi Family] on the top right corner.
- You should now see the [Action] Button next to all the devices.
- Click [Action].
- In this popup window change the “Inform URL” to your Unifi Controller’s set-inform URL
- Make sure to use a DNS name instead of an IP address.
- Make sure to use http:// instead of https:// and use :8080/inform, at the end of the domain, example: http://unifi.patrickdomingues.com:8080/inform.
- Log into your Unifi Cloud Controller and create your new site if needed. You should notice
How To Enable UniFi Controller MFA
In this Tutorial we will show you how to enable MFA for the UniFi Controller and once it is setup correctly you will be presented with the MFA login.
We will first start off by:
- Creating an account on Ubiquiti’s website https://account.ui.com/. Make sure to use the same email address that you are going to use for the Controller.
- Then follow these steps https://help.ui.com/hc/en-us/articles/115012986607-How-to-Enable-Two-Factor-Authentication#2
- Now log into your controller and go to Enable Settings > Remote Access > Local login with UBNT account on your UniFi server.
- Afterwards within your controller and create your admin account using the same exact username, email, and password as your UI account.
- Log out and then when you log in directly to UniFi you will be prompted for MFA
- PowerShell Script to Force Uninstall Umbrella Roaming Client
- How to Install Moodle on a Ubuntu 24.04 VPS with a Scripted
CISA Alerts in Ongoing Ransomware Exploiting Vulnerabilities in RDP and VPNs
The DHS Cybersecurity & Infrastructure Security Agency (CISA) has issued an alert regarding an on going Nefilim ransomware campaign, after the New Zealand Computer Emergency Response Team (CERT NZ) issuing an alert as well.
Nefilim ransomware is the successor of Nemty ransomware and was first discovered in February 2020. The developers of the ransomware conduct their own attacks and deploy the ransomware manually after gaining access to enterprise networks.
Once an attacker gains a foothold through the remote access system, they then use tools such as mimikatz, psexec, and Cobalt Strike to elevate privileges, move laterally across a network, and establish persistence on the network.
The attacker identifies and extracts sensitive information from the network and encrypts files. Nefilim ransomware has commonly been used, but other ransomware can also be used. Once the attacker has the information they want they attempt to sell or publicly release the information.
Ransomware Mitigations
… Read the rest
Kaseya Script for Windows Disk Cleanup
Aren’t you glad you stumbled upon this Kaseya Script for Windows Disk Cleanup? This Windows Disk Cleanup script for Kaseya cleans up everything from windows.
What does it do?
I am glad you asked. The script uses the Kaseya scripting engine to apply the options below to the registry and afterwards the script will run a CMD to run the specific Disk Cleaner Settings Profile we created to clean up all the junk.
- Active Setup Temp Folders
- BranchCache
- Downloaded Program Files
- GameNewsFiles
- GameStatisticsFiles
- GameUpdateFiles
- Internet Cache Files
- Memory Dump Files
- Offline Pages Files
- Old ChkDsk Files
- Previous Installations
- Recycle Bin
- Service Pack Cleanup
- Setup Log Files
- System error memory dump files
- System error minidump files
- Temporary Files
- Temporary Setup Files
- Temporary Sync Files
- Thumbnail Cache
- Update Cleanup
- Upgrade Discarded Files
- User file versions
- Windows Defender
- Windows Error Reporting Archive Files
- Windows Error Reporting Queue Files
- Windows Error Reporting System Archive
Loading ...