Category: Little Tips

Data Leaked Cover Page
BackupLittle TipsPhishingSecurity

EXACTIS Database Laked – Likely Most Comprehensive Data Breach Announced

Word just go out that the marketing firm EXACTIS has in its possession a database with close to 340 million individual records available until recently ( as of June 2018) on a publicly accessible server. The balk of the database comprises “close to 2 terabytes of data that appears to include personal information on hundreds of millions of American adults, as well as millions of businesses,” claims the magazine WIRED. In their article on the subject, WIRED provides further details:

While the precise number of individuals included in the data isn’t clear—and the leak doesn’t seem to contain credit card information or Social Security numbers—it does go into minute detail for each individual listed, including phone numbers, home addresses, email addresses, and other highly personal characteristics for every name. The categories range from interests and habits to the number, age, and gender of the person’s children. “It seems like this is a database with pretty much every US citizen in it,” says Troia, who is the founder of his own New York-based security company, Night Lion Security. Troia notes that almost every person he’s searched for in the database, he’s found.

You may need to go check https://haveibeenpwned.com/ by Troy Hunt to see if your email address was among the leaked data and to sign up for a notification should your email address appear in such a leak and become available to ‘;–have i been pwned? (HIBP).

As HIBP suggests in one of their recent emails,  monitoring Have I Been Pwned for data breaches is a great start, you should take two more steps to protect all your accounts:

  1. Protect yourself with strong, unique passwords for each website with a password manager like 1Password or LastPass or any of good one of your choice.
  2. Enable 2 factor authentication and store the codes inside your password manager.

Further recommendation would be that you keep an eye out on your credit records and any other possible social engineering attacks against you or your family.

Advertisements
AntivirusLittle TipsMalwarePhishingSecurity

Spam Alert: These People Never Get Tired Of Trying To Get You

 

Here is little warning and reminder not to get too comfortable thinking that scammers are gone or that your email spam filter is so good they will never get to you. Here is your wake up call: These people never get tired of trying. They use all sorts of means to disguise themselves including shortening their links by means of “short url” machines like in the case of the above picture.

Spam Email Example

Example of an email that hides a dangerous link behind a tinyurl link under the UPGRADE NOW button.

In fact, I just got right in my inbox one of those messages with a malicious link to some phishing scam hosted on https:// [some_malicious_place] .us.archive.org. But the link that was actually in the big blue button was not pointing there directly. It was disguised behind a https:// tinyurl.com/ [some_extension_goes_here]. It took running the link through Google’s online virus scanner virustotal.com to detect that the final destination of the link is an archive.org-hosted malicious content and site.

So, when you get an email that makes you uncomfortable as to why you are getting it or one that it looks suspicious, you probably are right. It is probably suspicious and dangerous. Get your IT friend look at it or just do not click on any links or attachments in it until you can get it verified by someone who has the tools. If you know how to extract the links without activating them, then do that and report the links if malicious to places like virustotal.com or to your antivirus software so they can include it in their next update. Please note that sometimes the email may come from an address of a person you actually know (after their mailbox was hijacked or is being spoofed).

Google is full of resources on how to tell if the email you are looking at is Spam. Seriously. Just type such a question and you will find a plethora of reputable sites with good examples. Emphasis on reputable. Do not fall for more phishing while trying to detect some.

virustotal.com reveals the actual final destination of a tinyurl or Shortened URL.

This screenshot from virustotal.com details page shows us the final URL the tinyurl link or Shortened URL that was in the phishing email would have led to.

What to do when you can't delete a program in Windows
Little TipsMalwareWindows 10 TipsWindows PCWindows Server Tips

How To Manually Uninstall a Stubborn Service in Windows?

There are programs that are not easy to uninstall. Sometimes you can easily uninstall the said programs only to find out that they left a trail of files in C:\Program Files\ or C:\Program Files (86)\ that you then try to manually delete.

If all goes away and leaves your computer alone, great! You do not need this article. This article is for times when the program just won’t go away and reports that there is another system using it or another user currently running the program. If there is no user that you know of and there are not programs you are aware of that are still running the unwanted application:

  1. Try to kill the process in the Applications tab of your Windows Task Manager.
  2. If the problem persists, Check your Services tab of the Windows Task Manager and look for the name of the unwanted application or for anything related to it.
  3. If the application you are uninstalling had a server component, you will find it in the list of Services. (Hint: Sort the list by Name instead of PID you can at least identify the program by name.)
  4. Once you find the problematic service. Right mouse click on it to Stop the service and then try to delete the folder or application you had a hard time deleting.
  5. If that still does not let you remove it, then go ahead and run an elevated command prompt to run sc.exe
  6. The command  sc.exe delete <service name> should help you completely remove or delete the service, where <service name> is the name of the service itself as you see it in the service management console, not of the exe.
  7. Finally try to delete the folder you were attempting to delete from C:\Program Files\ or wherever you had installed the application.
  8. If all none of the above solves the problem, there are certainly other methods out here. Let us know what did the trick for you by commenting below. (Pro Tip: Consider bringing in some of the big guns like the Process Explorer from Microsoft’s SysInternals Utilities).
Gmail emails with dots still get to you
GoogleLittle TipsSecurity

Did You Know that Dots Don’t Matter in Gmail Addresses?

Yes, an extra dot in the username part of the email address does not change who gets the email address at Gmail.com. Please be careful to notice that this might not be true of all other email service providers.

For example: john.doe@gmail.com is the same as j.ohndoe@gmail.com or any variation of the position or number of dots before the @ sign. If someone tries to open a new Gmail account with just a dot as a difference between their address and yours, Google will tell them the username already exists.

Caution: if you used Gmail through an organization like school, business, or company, your dots do matter.

More on this in this Gmail help article.

Have you experienced anything that contradicts the above? Please share here in comment.

Local Session Manager
Little TipsNetworkingRDS - Remote Desktop ConnectionWindows Server Tips

How To Find Out All Remote Desktop Logon Sessions That Took Place On Windows Server 2012 R2

The first time I used these logs is when I was running an audit to figure out whether a specific user has recently accessed my server using Remote Desktop Connection.

In order to identify who has recently had a full session remotely running on your server, you: look at the events located at these two places:

Event Viewer > Application and Service logs > Microsoft > Windows > TerminalServices – Local SessionManager > Operational

and

Event Viewer > Application and Service logs > Microsoft > Windows > TerminalServices – RemoteConnectionManager > Operational

To have any events logged in here, you have to at least have these things in place:

  • You must be running the Windows Feature AppServer (Terminal Services Application Server)
  • The specified logs must be enabled.

With these conditions in place, these logs show give you the user names and computer names of all Remote Desktop sessions that have taken place between your computer and other client devices for a certain duration of time. Of course the length of the log depends on the properties you have set for the logs (e.g. Enabled logging, Maximum log size, what to do when maximum event log size is reached, etc.).

Please note that these logs can also be used to diagnose and troubleshoot RDS sessions that disconnect in an apparently random way.

One other place you can check is your Event Viewer > Windows Logs > Security which should have audit log of successful and failed logons if you had activated the “Audit logon events” in Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy snap-in.

Finally, a rather simple way you can go about it is by using the command line as an administrator and typing the following command (more about it at the Windows Command Line reference below):

net user  username | findstr /B /C:"Last logon"

Do you know of any other ways to achieve this audit? Please let us know in the comment section.

Some other useful resources include:

Sitemap Illustration
GoogleLittle TipsSEOWeb DevelopmentWordPress

How to Refresh My Sitemap for Google Search Console to Find It?

Is Google Search Console failing to retrieve your website’s sitemap? It is possible that you need to refresh your permalinks.

To do that:

  1. Go to your /wp-admin page.
  2. Go to the “Settings” menu and click on Permalinks.
  3. Once on the permalinks page, without altering anything, click on “Save Changes.”

Give it some time and then go test yoursite.com/sitemap.xml and see if Google is finally picking something up.

You can find some more ideas here:

Beware of Phishing Emails
AntivirusLittle TipsSecurity

Security Warning – Beware of Emails About Uber

Hello, Friends,

Uber has suffered a data breach a year ago, and the address and email information of 57 million people were stolen. Uber paid off the hackers who then supposedly deleted the data, but that cannot be confirmed.

Watch out for phishing emails related to this Uber data theft, for instance that your “Uber account was compromised” and that you need to change your password, or anything else related to Uber that could be suspicious.

Never click on a link in an email for situations like these, always go to the website yourself through your browser’s address bar or a bookmark you have set earlier.

Remember, Think Before You Click!