Author: admin

The weather is fairly cold locally for the season, but an extra layer is not a bother. So more apt a conversation is security. Without a ton of hyperbole and a flood of links, usage and personal information is why you are seeing most everyone using ‘free services’.  Social relationships are spiking because the technology boom is completely breaking social comprehension of the world they live in.

Why is something being stored relating to what can be found?  The sickness of it is how much marketing is everyday.  If you do not seek out various opinions about, really any matter you seriously have concern about… is frankly, ignorant.  Researching can be exhausting, but if you rely on bias you are facilitating that.  Secure things and work with people.  Share your reason for disagreeing.  Stop imprisoning some of the smartest people for being observant.  Allowing an individual to make a non-baited opinion about what is ‘allowed’.  Maybe stop fighting, especially over text words.

Thank you for reading.  Keep thinking about your well being to help others instead of flip a power leverage trope.

I wanted to share some experiences I have been having on an existing AD topology I manage. Backstory: This site has been run by various contractors over a decade or so. Having been a contractor myself in the past, I got pretty familiar with poorly configured server deployments and gaining the task to cleaning them up.

Great. Back to the point, multiple group policies can get messy, but the slop comes into play when you are trying to set Internet Explorer settings to domain machines. IE 11 changes quite a bit of these options around and I actually had policies fail to apply, with IE 11 installed due to all the subsettings for the browser. This is the part where you review what settings were being modified and determine what ones are actually relevant. IMO, some of the settings are defined, for the sake of generating more service calls, than to actually implementing helpful security.

So about the faults. In this case, I had a few servers that did not report to the local WSUS patch server. Turns out bad policies were the cause of this. I removed the multi-policies that were not applying valid settings, and shortly after said servers started reporting to my WSUS list. Message here being, revisit your group policies, export them to XML and review them. If you have a bunch applying different settings, consider merging them. Policies can also be exported, so doing that before making changes, will give you a control of what the config was, before you made any changes.

Back to cleaning malware off a machine one of the helpdesk people ignored the other day. Living the dream. Lol not so much there.

Edit: Oh yes, let me add some helpful commands for tinkering with your group policy. It should be obvious, but keep notes of what you change, especially if changing the active policies. You do not want to break the parts that are working / critical to operations.

rsop.msc = Resultant Set of Policy.  This will show you what policies are applied and what the settings are.  Also errors will display here if the policy fails.
gpupdate = Group Policy update tool.  Run 'gpupdate /force' to apply all settings @ execution time.

Log into your WSUS server and confirm the machine in question is reporting to the patch server. You can run the following command to have it query the WSUS server for patches.

wuauclt /detectnow

This should shortly display a tooltip bubble with pending updates. Assuming you approved them on the WSUS server, the client machines should see them and you can install them. Pick your install method via Group Policy to determine if you want them to auto install or prompt the user to install them. Review your reports in WSUS to see how many are being installed and if any are having errors installing.

I wanted to share the details listed in Google services with your history. https://history.google.com/history/ will let you check through search history, advertising settings and so on.

To clear them, you want to click the vertical … bar and select Delete options. Pick advanced and All Time.
You will need to do this for each record set / option of google services. If you use chrome and log in, you will surely see some data there. Personally, I think Google is playing a little Cover-Your-Ass by disclosing these tools to general users. Along those lines, I find it hard to pretend other major data players, do not do the same thing with user data.

Here is a guide on the privacy settings. Remember your GPS history is there and that some content will persist, even after a clear all history. You ‘Pause’ the tracking services. Interesting wording there.

October is a great month and one of my favorite seasons. As the consumer holiday shopping season comes up, the amount of disclosures seem to scale up as well. Granted the last year continues a steady stream of disclosures on bugs, exploits, and patches that may address them. Allow me to take a moment to point out that malware distribution through advertising networks, is not only a thing but has become pretty common. This has been one of those things I suspected, but have more recently seen to become a common attach vector.

Speaking of security, we certainly live in a world where more than windows platforms are targeted. Be it flash, java, or some other variant… issues arise. Social network sites like to do post-reactive security. However putting up a condition based lock for something originally designed to be accessible, tends to lead into the additive protection being side-stepped. For some odd reason, security in the design phase seems to remain under-looked or overlooked completely. Scale also is a factor, since getting the scope of all use is difficult to do, before implementation and feature requests come into play.

Rambling aside, let’s note the more common infection of linux machines being herded into botnets. A nice technical read at the link.
Mobile phones are not immune either. Android has it’s abandoned versions (4.3 and lower) and apple iOS has patches until a device is considered ‘end of life’. Keeping in mind the patches, only cover the disclosed and more publicly disclosed exploits. So yes, mobile phones are being used as attack vectors.

Cryptography wise, your key is great, but when the machine gets exploited, your credentials to that encrypted drive have (multiple) risks of being stolen. If a government can do it, you should bet individuals or 3rd party contracting groups have the same or potentially more means to do the same.

Finally, you can enjoy some art of the security nature.

If you wish to not install Windows 10, and also prevent the sharing of installers off your connection, you will want to make sure not to / remove the KB3035583 update.

I am considering a Windows 10 test install, but not to wipe over my main windows install. However the use of my connection, a la Xbox Live methods, is not so much in my interests.

Here are some extra GWX details.

Without making this a huge rant of observations in Windows 10 thread, I will say that the privacy controls need to actually not phone back to microsoft servers, when you set the options that are supposed to disable that feature. Also automatic forced updating is not my cup of tea. I believe in testing.
Call me crazy.

I find myself enjoying some late nights. Looks like I have a bite here on the Windows 8.1 PC. HTTP and HTTPS services running as RPC items.

Discovered open port 445/tcp on localPC
Discovered open port 135/tcp on localPC
Discovered open port 139/tcp on localPC
Discovered open port 5357/tcp on localPC
Discovered open port 49154/tcp on localPC
Discovered open port 49153/tcp on localPC
Discovered open port 49158/tcp on localPC
Discovered open port 49152/tcp on localPC
Discovered open port 49159/tcp on localPC
Discovered open port 49155/tcp on localPC
Completed SYN Stealth Scan at 22:59, 1.22s elapsed (1000 total ports)
Initiating Service scan at 22:59
Scanning 10 services on localPC

Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) is port 5357

I also hope you got to read my submission in 2600 32:2 issue. Always looking to explore something. It has been a blast so far.