Security: Protection Against Cryptware Wannacry

You heard perhaps last day’s about the major problems of Attacks to Systems with the “WannaCry” Crypto Ware

Howto protect yourself?

  • Enable the Firewall on Windows Systems!! Always!
  • Update daily the Virus Scanners and Windows Patches!
  • Disable and CLOSE Ports you never need! SMB Protocol is a open unencrypted Transfer Protocol!
  • Use a second Router with Firewall behind your ISP Router or Modem! (openwrt, pfsense)
  • Check with nmap Portscanner Tool the taken Rules and check if the work!
  • For Network Access use ALWAYS SFTP with Authentification over KEYs Logins (Two Factor: Key and Password for unlock the Keyfiles id_rsa)
  • For fresh installed Systems do a Full Backup of the Disk.
  • To Save your work files use USB Drives or USB Sticks which can be unplugged, if you don’t need them.
  • Backup weekly the Windows Disk to a external USB Disk 1TB sold for less than 50$
  • ..last but not least use a Live CD of Linux like ubuntu to access the Internet..

Update:

  • The Linux Windows Share Service called Samba is also under attack CVE-2017-7494
  • to fix enter smb.conf with a Editor:

nt pipe support = no

  • restart the Service with:

$service samba stop && service samba start

  • Don’t use reload, to be secure that the config is really reloaded!! A “systemd” Problem!
  • Check the Samba Share for write and read access!

MediaWiki: Purge All Users hold Page Content

If you use MediaWiki to hold your Infos, you perhaps want to Mirror the wiki to other Locations or drop all Users but hold the Content?

You can do it with onboard tools:

On the Source:

  • Login into the Console of the Webserver
  • go to /webspace/wiki/maintenance
  • run here:

php  dumpBackup.php --full > backup.xml

  • tar or rsync the image folder to destination Webspace
  • copy backup.xml to the destination Webspace
  • if you not have done, install MediaWiki new on the destination
  • go to the /webspace/wikinew/maintenance
  • paste backup.xml here
  • restore the backup:

php importDump.php backup.xml

  • run rebuild Database:

php rebuildrecentchanges.php

  • cleanup Caches:

php update.php

  • go to the Wiki and Login!
  • Check out the Content and you have NO Spam Users inside!!
  • This Steps can be used with Scripts to mirror Wiki Content WITHOUT User mirroring!! (filter out Spam Users!)

 

Chrome Browser: Disable Password Passphrase Autologin Seahorse

Today i got a call and was asked how to STOP Seahorse from asking with a Passphrase Popup after opening Chrome or Chromium Browser:

Seems that google implementated a new Tool for Security to Prevent Access to STORED Browser Passwords, BUT this won’t work on Desktops with USER AUTOLOGIN like Lightdm!

Howto:

  • open a Terminal an enter

ln -s /usr/share/applications/google-chrome.desktop /home/username/Desktop/google-chrome.desktop

    • Now open the new Icon on the desktop with the mouse right click
    • Change Command Line for Chrome :

google-chrome-stable --password-store=basic %U

  • or for (chromium):
  • chrome browser disable password
  • Now open the Browser with the new Icon Link
  • On Ubuntu you can hold the Icon at the Taskbar after open the App with Store on the Taskbar
  • Changed only on  the User Desktop prevent you from Change the App by default for other Users!
  • Changed only on  the User Desktop prevent Chrome Updates from overwriting the new Command!

Google: Chrome Browser RSS Reader

If you use a Chrome or Chromium Browser, the google RSS Extension can help you to stay “up to date”

Howto install:

extension url chrome

  • select “get more extensions”
  • now on the App Store filter “by google” left
  • and search rss google

rss google extension official

  • install it
  • then you will find the installed tool on

enabled rss extension google

rss website feed

  • grab the RSS feed by touch on the right shown Icon
  • SAVE NOW the current URL “chrome-extension://…”  without to subscribe to the Browser local URL Toolbar! (Offline, needs no Account!)
  • The Reader Plugin convert the RSS XML to HTML!
  • click on any article you want to read..the overview is CLEAN!
  • to be “up to date” you can read daily the RSS Feed without and Ads!

rss feed view

Android: Amazon Fire TV replace App Starter

If you have a Amazon Fire TV Stick and you was touched by the “forced” Firmware Update from 5.2.1.2 to later.

You will see now a full blown Advertisement Screen on Start which plays Advertisements Videos on Scroll down Button (Ads Video Autostart with Tone)

The “New Amazon Bloatware” Menu:

fire tv menu 2017

Appstarter CLEAN Menu:

Howto:

  • Connect the Fire TV Stick to the TV and boot the Stick
  • Check Wifi
  • Go to Stick System Settings, check out IP Address of the Stick 192.168.XXX.XXX
  • Enable ADB Development Access at System Settings of the Stick, need some search
  • Enable ADB Install (Siteload) at the System Settings of the Stick
  • Download the Fire TV Appstarter.apk (feel free to donate the Developer!)
  • Start a PC with installed free Android “adb Tools” (perhaps ubuntu where adb-tools is at the Software Catalog)
  • The PC MUST be on the same NETWORK AREA! Cause connect thru port UDP 5037 and 5555
  • Connect to the Stick via Adb Tools with enter:

adb devices "ipaddressofstick" 
adb connect "ipaddressofstick"

Linux Console Echos:
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
connected to 192.168.1XX.XXX:5555

adb install Appstarter.apk
adb disconnect

  • Goto Apps Area on the Stick System Settings Menu! Start the “Appstarter” by open from the Settings List!

Screen should now view this CLEAN MENU!

clean fire tv app starter alternative

 

Remark:

  • The App isn’t installed with root rights so you must start the Appstarter on every power on of the Stick.
  • But you don’t need to power off the Stick he needs less than 1Watt/hour!
  • If you buy again this Media Stick search for Alternate Hardware! Cause you can’t purge the Bloatware as “non root”
  • Prefer Devices whrere Updates are NOT forced by the Manufacter..

WordPress: Useful Keyboard Shortcuts Editor

If you use WordPress you can speed up your blogging by using the WordPress Shortcuts:

Visual Editor:

Basics:

  • Ctrl + b = Bold
  • Ctrl + i = Italic
  • Ctrl + c = Copy
  • Ctrl + v = Paste
  • Ctrl + x = Cut
  • Ctrl + a = Select All
  • Ctrl + z = Undo
  • Ctrl + y = Redo
  • Ctrl + [number] = Insert heading sizes, e.g. CTRL+1 =

Advanced:

  • Alt + Shift + n = Check Spelling
  • Alt + Shift + l = Align Left
  • Alt + Shift + j = Justify Text
  • Alt + Shift + c = Align Center
  • Alt + Shift + d = Strikethrough
  • Alt + Shift + r = Align Right
  • Alt + Shift + u = Unordered List
  • Alt + Shift + a = Insert link
  • Alt + Shift + o = Numeric List
  • Alt + Shift + s = Remove link
  • Alt + Shift + q = Quote
  • Alt + Shift + m = Insert Image
  • Alt + Shift + w = Full screen distraction free writing mode
  • Alt + Shift + t = Insert More Tag
  • Alt + Shift + p = Insert Page Break tag
  • Alt + Shift + h = Rich text editor help

Plain Editor (Default):

  • Ctrl + c = Copy
  • Ctrl + v = Paste
  • Ctrl + x = Cut
  • Ctrl + z = Undo
  • Ctrl + y = Redo
  • Ctrl + p = Print
  • Alt + Shift + p = publish = “Save” or “Update” Page!!
  • Alt + Shift + f = Full Screen distraction free writing

WordPress: Enable Distraction Write Mode Editor

If you use WordPress, you perhaps switched off some features long time ago, once i missed was the Editor Fullscreen Mode where the Posting Paper only was shown.

To enable it again:

  • Login as User with Editor Rights
  • Enter on Browser Fullscreen (Firefox = F11)
  • Open with the Mouse the “Screen Options” Menu on the top right
  • There you find the switch to select on.
  • Now a “Cross Button” appear on the tools bar
Enable Distraction Writing WordPress
Enable Distraction Writing WordPress

See on the right site the “Cross Distraction Button”, click to cleanup the Editor.  The WordPress Borders are hidden.

Distraction Button WordPress
Distraction Button WordPress for Clean Full Screen Editor