Reformatting a flash drive formatted as ISO

By | October 4, 2023
0 Comment

Typically, when a flash drive is formatted from an ISO image, the flash drive will be formatted as an ISO9660 type and not want to be re-formatted or erased easily. Take a look at Gparted showing a flash drive below with the Linux Mint ISO on it.

When I attempt to delete the Partition in GParted, it is greyed out. If you try to format it, you will also get an error. The proper method is to use a command like:

sudo dd status=progress if=/dev/zero of=/dev/sde bs=4k && sync

The problem is this takes forever to run and zero out the entire flash drive. What I do is probably considered some hillbilly method but it works and works fairly quickly. I only seem to need to use this method when I want to reformat a flash drive shown as an ISO format. I run the shred -v command and let it run for about 10% to 15% (Which takes only a couple of minutes typically). I then hit CTRL C to cancel the operation.

Remove the flash drive and re-insert it. Now go into Gparted and create a partition table and format the flash drive any way you want.

Now I format the flash drive however I want. In this case, I formatted it as a Fat32.

Formatted to Fat32 and ready to be used.

Maybe I’ll post a more proper method later, but the above is down and really dirty but works quickly.

Using Powershell to read registry HKEY_USERS

By | August 30, 2023
0 Comment

This is a small example I put together on how to quickly loop through each user SID in HKEY_USERS and find the value that shows what the wallpaper is set to for each user. This little script is a decent reference to use for finding (And with a little modification, setting) registry value(s) in the HKEY_USERS section. 

<#
.DESCRIPTION
    Example to show how you can go through each user branch in registry 
    HKEY_USERS and retrieve the wallpaper file path key.
#>

$hkUsers = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('USERS', $env:COMPUTERNAME)
$hkUsersSubkeys = $hkUsers.GetSubKeyNames()

$hkUsersSubkeys | % {

    $hkeyuserpath = "$_\Control Panel\Desktop"
    $hkeyuserpath = "REGISTRY::HKEY_USERS\$hkeyuserpath"

    Write-Host "`nUSER: $_"
    $wallpaperfile = (Get-ItemProperty -Path $hkeyuserpath -ErrorAction SilentlyContinue).Wallpaper
    Write-Host "WALLPAPER: $wallpaperfile`n`n===================="

}
Script execution. Shows the wallpaper path and file used for each user account in HKEY_USERS of the Windows registry.

Download files from website via Powershell

By | August 11, 2023
0 Comment

A simple method I like to use when I want to quickly run a powershell script to download a file from a webserver. I use this when endpoints are not on an internal network so a network share is not always available, but since I am usually remotely calling the powershell script, Internet access is established.

The commandlet I use is Invoke-RestMethod. I provide the source url for the file on a webserver to download and the destination, and I’m done. Extremely simple and extremely effective. There are so many ways to do this, but this is the method I personally use the most.

The below example is what I have used to download the CleanZoom utility from Zoom that will remove any installed versions of Zoom on an endpoint, save the file in a temporary directory and then execute the utility.

<# --------------------------------------------------------------------------------
	Uninstall all traces of Zoom from an endpoint.

    Script downloads the CleanZoom.zip file from Zoom.com and then extracts it and
    runs the utility.
----------------------------------------------------------------------------------- #>
$src = 'https://assets.zoom.us/docs/msi-templates/CleanZoom.zip'
$dst = "$env:TEMP\CleanZoom.zip"
Invoke-RestMethod -Uri $src -OutFile $dst
Expand-Archive -Path $dst -DestinationPath $env:TEMP -Force

Start-Process $env:TEMP\CleanZoom.exe -ArgumentList "/s"

Scareware is not dead

By | June 19, 2023
0 Comment

An email was forwarded to me that came from a security MSP trying to stir up business with someone at the company I work at. Their quasi-scareware email was funny, but a horrible way for us to take seriously. Only thing missing was a sentence asking for bitcoin.

I remember several years ago, companies were scanning their web server logs and doing DNS look-ups to find out what companies visited their website. Then the Spam and cold call of sales would begin. That tactic finally died off……mostly. The below email was not sent to our company from a DNS look-up scrape (I know, as our external IP’s at work can barely can tell you what state we are in), it was pure spam. Probably someone going through Linkedin and such finding contacts.

If you send an email that begins like this, we cannot take you seriously.

Ah, remembering the good ole days, when the scareware looked like an actual alert:

Aloha!

By | April 14, 2023
0 Comment

Not a good week for NCR Aloha POS hosted solutions. They have been dealing with a BlackCat ransomware attack as reported by articles at:

BleepingComputer – NCR suffers Aloha POS outage after BlackCat ransomware attack.

DataBreaches.net – A short-lived BlackCat listing suggests NCR’s customers’ networks were accessed

Securityweek.com – Payments Giant NCR Hit by Ransomware

CPO Magazine – Financial Services Firm NCR Hit by Ransomware Attack, Disrupting Aloha and Back Office Products

CybersecurityDive – NCR restores more services following ransomware attack

The below screenshot was taken from https://status.aloha.ncr.com

Install a DHCP Server

By | March 6, 2023
0 Comment

There are times when you need to run your own DHCP server. For me, this was needed to add to my laptop so I can program IP security cameras with my USB Ethernet adapter attached. The software that typically comes with security cameras is total crap with a bad Chinese translation layered on top and is usually for Windows only. It is just easier to connect the cameras to a DHCP network and login than use some clunky badly written Windows-based application. Here is how I installed and configured a DHCP server for my laptop.

Open a shell prompt and execute the command: sudo apt install isc-dhcp-server.

sudo apt install isc-dhcp-server.

Now, I run ip a to list all the network adapters and names. I found my USB adapter easily.

Use, “ip a”, to list the network adapters and info.

Open the /etc/default/isc-dhcp-server config file and add the interface name of the USB adapter. This defines the network adapter that will be dishing out DHCP IP addresses.

/etc/default/isc-dhcp-server config file.

Now we set an IP range for the DHCP server. I usually keep this really small between 10 and 20 IP addresses for convenience. I usually set the starting IP address one octet higher than the IP I set on the USB adapter. Below, you can see I entered, “192.168.10.1” as the IP address of my USB network adapter, then the DHCP range I set at .2 through .10. Set the subnet mask and since this does not need DNS, I just enter a bogus address of the laptop for domain-name-servers.

Set the network adapter info and IP range here.

Restart the DHCP server service.

sudo systemctl start isc-dhcp-server

Now I connect the IP POE camera to an injector which then connects to my USB adapter.

Laptop with USB network adapter, POE injector, and camera connected.

I use Angry IP Scanner to search and find the camera.

Enter the IP range in Angry IP and tell it to scan.

I now navigate to the IP address found and am able to sign in and configure the IP camera.

Camera responding at IP addressed issued from the DHCP server.

After configuration, live image working.

Successfully configured camera.

Firefox telemetry

By | February 20, 2023
0 Comment

Was looking at my Adguard for home server dashboard and I noticed the blocked links for Mozilla Firefox is sending telemetry data. I did some looking and Firefox data is mainly to help it make a better product but some products go too far. Either way, I want to disable it.

Adguard blocking Firefox telemetry

Firefox doesn’t hide that they are doing this, and posted an article on how to disable it HERE. Basically, go to Settings / Privacy & Security, and scroll down until you see, “Firefox Data Collection and Use” section. Uncheck the option that says, “Allow Firefox to send technical and interaction data to Mozilla”.

Uncheck the option that says, “Allow Firefox to send technical and interaction data to Mozilla”.

After you uncheck the option, you will see the below message. All good now.

Good.

Phishing emails

By | November 8, 2022
0 Comment

It is amazing how phishing emails are becoming more sophisticated. We have recently added a product called SlashNext to help protect our environment from phishing emails. It has been doing a fantastic job of catching emails that passed every other detection method. Below are six samples of the emails captured and blocked from going to the recipients.

SlashNext uses a method of analyzing the links within an email (Or website if you have browser protection also). Thus, this provides protection that most anti-spam and email protection systems, miss.

O365 prompting for an alternative email address

By | October 31, 2022
0 Comment

Recently, O365 started prompting users in my organization during sign-in to add an alternative (Authentication verification) email address. This is not an option we turned on, nor is it an option I wanted to be enabled. If the user needs help resetting their password or having issues signing in, our policy is for them to contact our helpdesk.

Alternative email / Authentication email prompt I never asked for.

To remove this, you will need to go into your admin portal. Then go into Azure Active Directory, then USERS, then REGISTRATION. Change the option, “Require user to register when signing in“, to NO.

Select NO for this option.

Now your users will no longer get prompted to enter an alternative email address for authentication verification. Our policy is that the IT department should be contacted.

Idiots using RAID0

By | October 20, 2022
0 Comment

About once a month I read a post somewhere that some poor schmuck is using or wanting to use RAID0 for spanning two drives together or thinking their SSD’s going to get better performance.

If you are one of those idiots, we cannot be friends. I cannot deal with that amount of stupidity.

RAID0 was originally designed to split data across multiple mechanical drives for improved performance with scientific calculations with older computers and storage. It was always known as volatile (Like 20 years ago). Now days, there is absolutely no reason to use it.