2021-10-18 Securing the home network: a separate DMZ network 17 hours ago
I have a lot of control over the software that runs on systems at home but there are limits to what I can fix and sometimes things are insecure. Things like the recent wordpress brute force attacks show that random 'loud' attackers who don't care about the chance of getting noticed will try. I sometimes do worry about the silent and more targeted attackers. So recently I updated my home network and I now have a DMZ network. At this moment it is a purely virtual network as it doesn't leave the KVM server. Hosts in the DMZ have a default-deny firewall policy to the other inside networks. Specific services on specific hosts have been enabled. I first moved the development webserver, which allowed me to tune those firewall rules and fix some other errors. Now other webservers and other servers offering things to the outside world have moved.
2021-10-17 New countries in amateur radio and enjoying 10 meter openings 1 day ago
I am sitting behind the radio running FT8 on the 10 meter band and it's open in some interesting directions. According to PSK reporter my signals have been received in India(!) but I haven't made any contacts to India on 10 meters. The interesting contacts I have made on 10 meters were a few new countries on that band: South Africa, Swaziland, Lebanon and Georgia. Earlier Swaziland was completely new for me thanks to the 3DA0RU DXpedition visiting there. I also got the DXpedition to Sao Tome & Principe in the log: S9OK.
2021-10-13 Wordpress brute force attacks 6 days ago
The wordpress blog software is a popular target for attacks. I normally have fail2ban running with some rules to detect bad things on sites behind haproxy but due to some other work on the firewall rules I had fail2ban temporarily disabled. Someone/something at IP address 184.108.40.206 (A Microsoft-managed IPv4 address) noticed this and fired off a brute force script which ended up making 521525 attempts at logging in, none of which worked. It was stopped when I enabled fail2ban again. The first indication of interesting amounts of things happening was that the disc i/o led of the server was blinking a lot. The second indication was the high amount of traffic seen for the specific backend in haproxy. Later I also discovered the actual power use of the server was higher.
2021-10-09 A long bitcoin extortion scam 1 week ago
This time the scammer / fraud / criminal tries using a lot of text to convince victims to pay bitcoins. Using bitcoin address bc1qtzqgwqe3cd4cnv26vawxvfg3kr09r0jv53p8nw where it shows this one is already known and no money has been lost. A bit of a sample, showing that the scammer has some imagination and a good grasp of English:During the pandemic outbreak a lot of providers have faced difficulties in maintaining a huge number of staff in their offices and so they have decided to use outsourcing instead. While working remotely from home, I have got unlimited abilities to access the user databases. I can easily decrypt passwords of users, access their chat history and online traffic with help of cookie-files. I have decided to analyse users traffic related to adult websites and adult content. My spyware functions as a driver. Hence, I can fully control your device and have access to your microphone, camera, cursor and set of symbols. Generally speaking, your device is some sort of my remote PC. Since this spyware is driver-based, then I can constantly update its signatures, so that no antivirus can detect it. While digging through your hard drive, I have saved your entire contact list, social media access, chat history and media files.Earlier items about bitcoin extortion scams: Earlier, earlier, earlier, earlier, earlier, earlier, earlier (although I think bitcoin is generally a really bad idea and a huge scam) Update 2021-10-13: As not enough money is coming into this wallet the scammer tries again. Same address, demanding an amount equivalent to $1150 (USA Dollars). As the mail comes from some random ISP in Chili I think the criminal is somewhere else on this planet.
2021-10-08 Op het spoor van de scammer/spammer 1 week ago
Een redelijk standaard valse mail, al bekend bij de fraudehelpdesk: Diverse onderwerpen Klik op “Lees meer” - fraudehelpdesk.nlGeachte heer/mevrouw , Er staat een document in uw Berichtenbox van Belastingsamenwerking Gemeenten en Waterschappen. Ga naar MijnOverheid om het bericht te bekijken. Mogelijk moet u naar aanleiding van dit bericht actie ondernemen. Lees het daarom op tijd. Met vriendelijke groet, MijnOverheid Logo Rijksoverheid Technisch onderhoud Berichtenbox app Vanwege technisch onderhoud is het momenteel niet mogelijk om het bericht via de Berichtenbox direct te lezen. Bekijk het bericht daarom direct via uw webbrowser.URL spoor:
Niet geheel onverwacht is dit domein vandaag geregistreerd:
- hxxps://ukrijgtterug2020.xyz/Domain Name: UKRIJGTTERUG2020.XYZ Registry Domain ID: D253685109-CNIC Updated Date: 2021-10-08T10:58:04.0Z Creation Date: 2021-10-08T10:44:42.0Z Registry Expiry Date: 2022-10-08T23:59:59.0ZSite staat achter cloudflare IP adressen. Dus het certificaat zegt ook niet zoveel op https://crt.sh/?id=5375183746 en de achterliggende site reageert op dit moment niet dus ik krijg een mooie cloudflare foutmelding.
2021-10-07 Adding security headers to websites I develop and run 1 week ago