BaroqueInMind

That is a shady sketchy as fuck Russian site. Please, if anyone is reading this, DO NOT access it or put your fucking IP in there.

deleted by creator

Never heard of LibreOps and checked them out; they seem legit. Thanks for the information, I will try them out!

OMG I love that new amazing tracker that everyone is currently using, named…

All apps send telemetry, this includes NewPipe. Your data is in that telemetry. The less apps you have installed, the less likely your data is sent to parties that leverage your information for profits.

DDG has a browser, and it’s based on Chromium which is from Google, so this is a shit take. Do not use Chromium based browsers if you value privacy or ad blocking features.

Why install the app when all the same features work in browser? Not only did I save storage space, I also kept privacy as well as reduced CPU/RAM usage on my mid-tier phone using the browser that was already installed.

Mines behind an NGINX reverse proxy as well. EMOTET is a very advanced malware and can get around those now. My IDS detected data exfiltration to an unknown Brazilian IP, and I have a VPN with an IP tunnel on top of my reverse proxy, as well as everything on port 443. It still found a way.

First read this

Then use the following:

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:“[CIS] Emotet C2 Traffic Using Form Data to Send Passwords”; content:“POST”; http_method; content:“Content-Type|3a 20|multipart/form-data|3b 20|boundary=”; http_header; fast_pattern; content:“Content-Disposition|3a 20|form-data|3b 20|name=|22|”; http_client_body; content:!“------WebKitFormBoundary”; http_client_body; content:!“Cookie|3a|”; pcre:“/:?(chrome|firefox|safari|opera|ie|edge) passwords/i”; reference:url,cofense.com/flash-bulletin-emotet-epoch-1-changes-c2-communication/; sid:1; rev:2;)

And the following:

alert tcp any any -> any $HTTP_PORTS (msg:“EMOTET:HTTP URI GET contains ‘/wp-content/###/’”; sid:00000000; rev:1; flow:established,to_server; content:“/wp-content/”; http_uri; content:“/”; http_uri; distance:0; within:4; content:“GET”; nocase; http_method; urilen:<17; classtype:http-uri; content:“Connection|3a 20|Keep-Alive|0d 0a|”; http_header; metadata:service http;)

And also this one:

alert tcp any any -> any $HTTP_PORTS (msg:“EMOTET:HTTP URI GET contains ‘/wp-admin/###/’”; sid:00000000; rev:1; flow:established,to_server; content:“/wp-admin/”; http_uri; content:“/”; http_uri; distance:0; within:4; content:“GET”; nocase; http_method; urilen:<15; content:“Connection|3a 20|Keep-Alive|0d 0a|”; http_header; classtype:http-uri; metadata:service http;)

I will simply copy/paste here then:

I have a refurbished server rack system that is running Zeek and also Suricata. I have a managed switch that will duplicate all network traffic to the system that is running those applications and a JBOD setup to store the countless logs. I have scoured through nearly all the CISA documents and alert reports to copy the various Snort rules they mention in each report and also purchased a specific modem to connect with my ISP that provides a service to monitor my traffic that has Minim.

I am a cybersecurity expert and still don’t know what I’m doing most of the time, so this is literally scratching the surface, as well as only detecting threats not really stopping them which requires more knowledge.

deleted by creator

I have a refurbished server rack system that is running Zeek and also Suricata. I have a managed switch that will duplicate all network traffic to the system that is running those applications and a JBOD setup to store the countless logs. I have scoured through nearly all the CISA documents and alert reports to copy the various Snort rules they mention in each report and also purchased a specific modem to connect with my ISP that provides a service to monitor my traffic that has Minim.

I am a cybersecurity expert and still don’t know what I’m doing most of the time, so this is literally scratching the surface, as well as only detecting threats not really stopping them which requires more knowledge.

I have nginx setup and acessing through a Cloudflare tunnel but still getting EMOTET issues detected by my IDS.

I do this already and also am inside an encrypted Cloudflare tunnel… Still getting EMOTET warnings from my IDS.

My Jellyfin server keeps getting pinged by EMOTET malware lately. Everyone here should be aware if you expose the Jellyfin port to the internet it will get data exfiltration attempts. Use strong passwords.

I have firefox mobile with uBlock Origin and Sponsorblock addons and haven’t seen a fucking ad in two years. No app needed.

Tampermonkey
LibRedirect
Sponsorblock

Zelda TotK cooking vibes from this post.

https://www.xmanagerapp.com/

https://github.com/Team-xManager/xManager

Lots of Spotify dick riding font on in this thread…