malware Archives

Home » malware » Page 4

How hard-coding your DNS can improve your security

Dave Farquhar security May 27, 2015November 3, 2025intel, malware, PCI Express, PCI-X, pcie, pfsense

I’ve long recommended hard-coding your DNS settings as a performance and reliability enhancement–here’s my guide for that–but it turns out it can be a security enhancement too.

Botnets targetting routers aren’t new at all, but there’s a particularly nasty one named Moose running around right now. Among other things, it changes routers’ DNS settings to point to rogue DNS servers that allow the attackers to steal your social media credentials, furthering the bot. Read more

Dave Farquhar

David Farquhar is a computer security professional, entrepreneur, and author. He has written professionally about computers since 1991, so he was writing about retro computers when they were still new. He has been working in IT professionally since 1994 and has specialized in vulnerability management since 2013. He holds Security+ and CISSP certifications. Today he blogs five times a week, mostly about retro computers and retro gaming covering the time period from 1975 to 2000.

dfarq.homeip.net

Build the best, most secure wifi in your neighborhood

Dave Farquhar DD-WRT, Servers and Networking March 24, 2015August 26, 2017AES, android, apple, cat5, DDWRT, lowercase letters, malware, Meraki Wifi Stumbler, Micro Center, netflix, Roku, SSID, TL, wi-fi

My neighbor asked me for advice on setting up wi-fi in his new house. I realized it’s been a while since I’ve written about wi-fi, and it’s never been cheaper or easier to blanket your house and yard with a good signal.

Blanketing your house and yard while remaining secure, though, is still important.

Dave Farquhar

dfarq.homeip.net

Lenovo is penitent, but its customers aren’t out of the woods yet

Dave Farquhar security March 9, 2015March 8, 2015antimalware, antivirus, Bing, lenovo, malware, spyware, Windows 10, windows 8

After having an incredibly bad week last month, Lenovo started saying the right things, and perhaps doing some of the right things too. But some laptops with the Superfish malware preinstalled on them are still in the supply chain, which means some people are unwittingly buying them.

This isn’t terribly surprising. But there are a couple of things you can do about it, and they’re things worth doing anyway.

Dave Farquhar

dfarq.homeip.net

A watering hole attack example from the real world

Dave Farquhar security March 2, 2015November 3, 2025firewall, malware, vulnerability

You may have heard people like me talk about watering-hole attacks. It’s an indirect attack on someone by compromising a third party and using that to get in. Here’s a watering hole attack example from the real world.

In this case, back in November, attackers got a Forbes ad server, and from there, attacked visitors from government and bank networks.

Here’s the logic: Since ad servers tend to be much less secure than your target company, you compromise an ad server from a site someone on the target network is likely to visit, then infect them from there. The attackers jumped to the ad network first. That put them into position to jump onto government and bank networks.

Dave Farquhar

dfarq.homeip.net

Yes, we need to run vulnerability scans inside the firewall

Dave Farquhar security February 18, 2015February 15, 2015AIX, firewall, malware, old windows, unix, vulnerability, windows 2000, windows nt

I got an innocent question last week. We’d been scanning an AIX server with Nexpose, a vulnerability scanner made by Rapid7, and ran into some issues. The system owner then asked a question: The server is behind a firewall and has no direct connection to the Internet and no data itself, it’s just a front-end to two other servers. Is there any reason to scan a server like that?

In my sysadmin days, I asked a similar question. Nobody could give me an answer that was any better than “because reasons.” So I’ll answer the question and give the reasons.

Dave Farquhar

dfarq.homeip.net

You’re telling me someone gave a stranger his password?

Dave Farquhar security February 17, 2015January 23, 2022Adobe Acrobat, Adobe Reader, antivirus, breach, hp, IBM, LinkedIn, malware, passwords

I was talking breaches last week when a very high-up joined the conversation in mid-stream.

“Start over, Dave.”

“OK. I’m talking about breaches.”

“I know what you’re talking about,” he said, knowingly and very clearly interested.

Dave Farquhar

dfarq.homeip.net

What to do with insanely fast routers

Dave Farquhar Hardware January 15, 2015January 16, 2015firewall, IDS, malware

I read a story last week about an insanely fast router that can run at up to 5.3 gigabits, far faster than even the crazy-fast gigabit Internet service that only a lucky few people are able to get. The article questioned what anyone would do with it.

Think beyond network speeds, though, and there’s a lot you can do with that power.

Dave Farquhar

dfarq.homeip.net

Retracing the Home Depot attackers’ steps

Dave Farquhar security November 7, 2014November 6, 2014breach, home depot, malware, Patch Tuesday, Privilege escalation, vulnerability

New details emerged on the Home Depot attack that left 56 million consumers with compromised credit cards. The interesting thing in the new details is that it could have been much worse, but maybe not for reasons immediately obvious.

Dave Farquhar

dfarq.homeip.net

More Home Depot details emerge

Dave Farquhar security September 22, 2014September 20, 2014antivirus, breach, Brian Krebs, code execution, Data breach, home depot, malware, Payment systems, Retailing, vista, vulnerability, Windows Server, Windows Server 2003, Windows Vista, Windows XP

Late last week, Home Depot finally released a statement about its data breach. At least they had the decency to call the attack “custom” and not spin it as “advanced” or “sophisticated.” Even “custom” is really a euphemism, as the attack wasn’t all that different from what other retailers experienced earlier in the year. It may have been as simple as recompressing the BlackPOS malware using a different compression algorithm or compression ratio to evade antivirus.

The breach involves about 56 million cards, making it a bigger breach than Target. Read more

Dave Farquhar

dfarq.homeip.net

Solving the Windows 0x13d error, aka the 317 error, and watch for the scams

Dave Farquhar scams, Windows September 10, 2014December 11, 2015Bing, malware, NIST

Yesterday when performing a routine server inventory, I received a Windows 317 error, aka a Windows 0x13d error, when I tried to view some directories remotely from a batch file.

The exact text of the error message: The system cannot find message text for message number 0x13d in the message file for System.

If you’ve received a 0x13d error and you’re wondering what it means, it seems to be an unhealthy system’s way of saying “file not found.” In my case that’s what it appeared to be. If the lack of a human-readable error message bothers you, I found two possible culprits: One is system hardening–perhaps you’ve applied the recommendations from CIS, USGCB/NIST, or the DISA STIGs to the system–or the more likely culprit, services not running that need to be. Start with some very routine maintenance. Check the remote machine to make sure all the services that are set to start automatically are indeed running, and you might want to think about rebooting.

In case you need legitimate details, pay http://msdn.microsoft.com/en-us/library/windows/desktop/ms681382%28v=vs.85%29.aspx a visit.

When researching the error code, I found an interesting scam—tons of sketchy web sites, some that did a decent job of impersonating Microsoft, offer programs to fix the issue. Microsoft doesn’t offer downloadable fix-its for error messages like this because these are the kinds of problems that require some human intelligence to resolve.

Dave Farquhar

dfarq.homeip.net