Hi everyone, seen the issue of telnet attacks mentioned a number of times.
I use pfsense firewall at home. Easy to install and configure. And
with the pfBlockerNG package installed, turned on with a bunch of the normal countries blocked, my attacks have gone down by at least 98%.
Adding additional blocking lists (ie: Spamhaus) reduced it once again. It's on my list of things to do to try to figure out how to incorporate the badip.txt automatically, but for now the "out of the box" configuration has drastically helped. No need to change from port 23 now.
Hi everyone, seen the issue of telnet attacks mentioned a number of times.
I use pfsense firewall at home. Easy to install and configure. And
I use pfsense firewall at home. Easy to install and configure. And
with the pfBlockerNG package installed, turned on with a bunch of the normal countries blocked, my attacks have gone down by at least 98%.
just disable ascii logins and you wont see them and they will get
blocked via mis
I went looking to see if I could run it on my Pi but it look like that's
a no go :(
shows AMD and 32bit x86 install only. Most of us are on Linux/Pi
including me, can't be used.
No unfortunately. And I'd strongly recommend intel NIC's as well.
The system was brought down by an attack this morning via a worm, PDM:Worm.win32. Kaspersky total security detected these, cleaned the
files and were in quarantine, still I felt it best to restore the entire system from the back up on the thumb drive. The worm attempted to
delete several key files, mis.exe, nodespy.exe Luckily I am back and running. Something has to be done to stop these attacks, once and for
all, they are getting tiring. But that I guess why that is one of the reasons why a backup is recommended.
On 11/04/16, Gregory Deyss pondered and said...
The system was brought down by an attack this morning via a worm, PDM:Worm.win32. Kaspersky total security detected these, cleaned the files and were in quarantine, still I felt it best to restore the ent system from the back up on the thumb drive. The worm attempted to delete several key files, mis.exe, nodespy.exe Luckily I am back and running. Something has to be done to stop these attacks, once and for all, they are getting tiring. But that I guess why that is one of th reasons why a backup is recommended.
Wow, not good. Apologies too I see I need to reply to another messageIt happened again this morning as well (very early in the morning hours) mystic.exe mis.exe nodespy.exe all deleted.
from you.. will do so shortly.
Best, Paul.
On 11/05/16, Avon said the following...
On 11/04/16, Gregory Deyss pondered and said...
The system was brought down by an attack this morning via a worm PDM:Worm.win32. Kaspersky total security detected these, cleaned
It happened again this morning as well (very early in the morning hours) mystic.exe mis.exe nodespy.exe all deleted.
I followed the same process to restore these files as I did before. Followed by a full scan w/ kaspersky.
apparently there were no other files missing or damaged.
On 11/05/16, Gregory Deyss pondered and said...Same attack 2 nights in a row, with the same worm, on occasion it is rare
On 11/05/16, Avon said the following...
On 11/04/16, Gregory Deyss pondered and said...
The system was brought down by an attack this morning via a PDM:Worm.win32. Kaspersky total security detected these, cl
It happened again this morning as well (very early in the morning hou mystic.exe mis.exe nodespy.exe all deleted.
I followed the same process to restore these files as I did before. Followed by a full scan w/ kaspersky.
apparently there were no other files missing or damaged.
So was it reporting the same worm or something new this time?
Same attack 2 nights in a row, with the same worm, on occasion it is rare
Is it possible that the antivirus detected mystic as a worm as a false positive and quarantined the files (so they were deleted from where they should be)?
On Nov 6th 2:43 pm Gregory Deyss said...I don't want you to misunderstand, I am not blaming Mystic at all, just wondering how the worm got in the first place.
Same attack 2 nights in a row, with the same worm, on occasion it is
Is it possible that the antivirus detected mystic as a worm as a false positive and quarantined the files (so they were deleted from where they should be)?
I don't want you to misunderstand, I am not blaming Mystic at all, just wondering how the worm got in the first place.
andrew wrote to Gregory Deyss <=-
I mean, perhaps there was no worm, but the antivirus thought mystic was
a worm,
so it deleted it.
Sometimes Anti-Virus software is a little.. overzealous.
I've had antivirus delete all sorts of things in the past.
That sounds more feasible. To me, the odds of a worm targetting MysticThese people have been busy hitting this open port 23, so far in this session of Mystic that has been running continuously it has blocked 6394 and refused 2381.
is very low. Why would someone bother?
That sounds more feasible. To me, the odds of a worm targettingThese people have been busy hitting this open port 23, so far in this session of Mystic that has been running continuously it has blocked
Mystic is very low. Why would someone bother?
6394 and refused 2381.
Hi Gregory!Why do hackers create viruses and malware.
10 Nov 2016 20:10, from Gregory Deyss -> Vk3jed:
That sounds more feasible. To me, the odds of a worm targetting
Mystic is very low. Why would someone bother?
I had a script kiddy trying to login my Asterisk with theses accountsThese are all 'scripts' I guess it is just something that has to be allowed
0000 - 9999 and everything in between, he was "ready" in much less than
1 hour.
Why do hackers create viruses and malware.targettingThat sounds more feasible. To me, the odds of a worm
Mystic is very low. Why would someone bother?
| Sysop: | sneaky |
|---|---|
| Location: | Ashburton,NZ |
| Users: | 31 |
| Nodes: | 8 (0 / 8) |
| Uptime: | 163:31:39 |
| Calls: | 2,076 |
| Calls today: | 2 |
| Files: | 11,137 |
| Messages: | 947,148 |