Security

SSL/TLS protocol settings may be specified in the primary Nginx configuration file (usually located at /etc/nginx/nginx.conf), or in your site configuration files. Look for a line beginning with ssl_protocols. For example, the following is from the default nginx.conf file from a fresh Nginx install on Ubuntu: ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE You can edit…

A quick method to scan your network and enumerate the SSL Ciphers in use on systems is with nmap. nmap –script ssl-enum-ciphers -p 443 192.168.0.1/24 This will scan the entire 192.168.0.0 subnet for open port 443 and if found enumerate the SSL Ciphers enabled. You can also use openssl if the command is installed in…

Break-fix call on a CrySiS Ransomware infection.  It’s actually not CrySiS, but a fork of it, which is not decryptable at this time.  CrySiS shut down its operation a month or so ago and dumped the master encryption key so victims could decrypt their files.  Not so much with this variant. After infection, it drops…

I found the database dump of the CryptoLocker release from May 30, 2015 by the ransomware’s author.  I decided to put it into a database and make a lame front-end for it to be queried against by either the bitcoin address or the public RSA key from the infected computer. Hope it helps someone out…