@VessOnSecurity

Anti-virus, malware and infosec expert, crypto amateur, privacy advocate and general annoyance. PGP keyID: 0x365697c632dd98d9

 Bulgaria
bontchev.nlcv.bas.bg/index.html
Joined January 2016
  • Tweets49.5K
  • Following68
  • Followers16.7K
1.4KMedia
Bontchev's Law of cybersecurity: "The number of discovered software vulnerabilities doubles roughly every two years." cve.0xosprey.com/
2
4
22
2,400
Alight, we have some sort of solution now. Thanks to those who actually helped instead of flaming us for not using Linux/Nginx/Claude/CoudFlare/whatever. I'll share the solution below but first some clarifications are in order.
Vess@VessOnSecurityOct 23
OK, serious question. About 2/3 of our customers are on PHP 7.3, one is on 5.6 (all on Windows, Apache 2.4, PHP started as a Fastcgi process, not Apache module). They can't install the latest PHP. We've done the recommended PHP settings mitigations, but they are not enough.
10
8
1
60
10,820
more replies
This resolves the emergency, so now we have some time to think. First order of business is to have a serious chat with the boss and tell her to have a serious chat with the customers and explain them that they are at risk running obsolete versions.
3
1
10
1,237
But that upgrading them is a hell of lot of work that cannot be done for free, so they need to allocate some budget for it. Once this is done we could get to it with the help of Claude and do some extensive testing. And if they can't shell the money they shouldn't blame us.
6
1
11
1,184
OK, serious question. About 2/3 of our customers are on PHP 7.3, one is on 5.6 (all on Windows, Apache 2.4, PHP started as a Fastcgi process, not Apache module). They can't install the latest PHP. We've done the recommended PHP settings mitigations, but they are not enough.
267
15
12
197
105,538
Any suggestions what else to do? I've seen recommendations to use AppArmor to prevent the server from spawning processes - but that's a Linux thing and they are all using Windows.
32
23
14,562
Is everyone aware of cybersecurity yet?
4
12
1,601
I recently had to set up a WireGuard VPN. Never done that before. Win10 server, clients for Win10, Linux Mint, Android/iOS phones. Setting up the mobile clients was especially cumbersome - the app can get a config from a QR code but nothing generates it.
4
5
1,324
So, I wrote a guide and two helper PowerShell scripts; one of them generates QR codes for the mobile clients (among other things). Decided to make them (scripts and guide) public, in case it helps others: gitlab.com/-/snippets/606917…

Setting up a WireGuard VPN ($6069174) · Snippets · GitLab

GitLab.com

gitlab.com
1
1
6
594
Can anyone recognize the ransomware from this ransom note? id-ransomware is of no help.
5
1
17
2,893
more replies
Large files (probably larger than 1 Mb but I don't know where the cut-off is exactly) have only their first and last 9216 bytes encrypted; smaller files are encrypted completely.
1
1
362
Sadly, @demonslay335 seems to have left Twitter.
1
249
Attention SIP botnet herders! Fix your bots! They are not processing your template correctly. For 3 days in a row, the only messages my SIP honeypot gets from the attackers look like this: OPTIONS sip:${RAND_ALPHA=8}@${DADDR} SIP/2.0 The "From" and "To" fields are borked too.
1
2
10
1,060
Health (or lack thereof) update: blog.bontchev.nlcv.bas.bg/en…
2
4
29
4,238
Health (or lack thereof) update: blog.bontchev.nlcv.bas.bg/en…
3
13
2,303
Load more