Loading ...

233 Rogue River Hwy #873, Grants Pass, OR 97527

541-761-9549

support@farmhousenetworking.com

Mon-Fri: 9:00 am - 5:00 pm

541-761-9549

We Answer Our Phones!

541-761-9549

Month: June 2017

CIA hacking home routers with Cherry Blossom since 2007

In the latest dump of purportedly top secret CIA cyber exploits from WikiLeaks, dubbed “Vault 7”, there is evidence of a home router firmware modification called Cherry Blossom. (The CIA has never publicly acknowledged the programs nor the leaked Vault 7 documents.)

What is Cherry Blossom?

“The Cherry Blossom (CB) system provides a means of monitoring the Internet activity of and performing software exploits on targets of interest,” the WikiLeaks documents state. “In particular, CB is focused on compromising wireless networking devices, such as wireless (802.11) routers and access points…to achieve these goals.”

Among the companies whose wireless routers have reportedly been compromised are Motorola, Linksys, Dell, Netgear, US Robotics, Belkin, Asus, Buffalo, DLink and Senao. Cherry Blossom relies on implanting altered versions of the products’ firmware remotely posing as wireless upgrades. An implanted device is known as a “FlyTrap” and communicates via beacon with a CIA-controlled server known as CherryTree (CT).

If your company is a consumer grade home router instead of a business grade router, then contact us for assistance.

Powershell One Liner: Disable User Protocols

Here is a quick powershell one liner that I came up with when I got a request from Microsoft Support to disable user protocols. I did some research and found out that they meant the protocols or services used to access Office 365 Exchange Online.

Connect to Microsoft Office365 via Powershell

Open Windows Azure Active Directory Module for Windows Powershell as Domain Administrator and type in the following to connect to Exchange Online via Powershell:

Set-ExecutionPolicy RemoteSigned
$creds = Get-Credential
(Enter the Office 365 Administrator credentials then click “OK” button.)
Import-Module MsOnline
Connect-MsolService -Credential $creds
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $creds -Authentication Basic -AllowRedirection
Import-PSSession $Session

Disable User Protocols

Once connected to Office 365 via Powershell, here is the one liner to disable user protocols:

Set-CASMailbox user@company.com -ImapEnabled $False -PopEnabled $False -OWAEnabled $False -ActiveSyncEnabled $False -MAPIEnabled $False

Enable User Protocols

Here is the one liner to enable user protocols:

Set-CASMailbox user@company.com -ImapEnabled $True -PopEnabled $True -OWAEnabled $True -ActiveSyncEnabled $True -MAPIEnabled $True

If your company is currently using Office 365 and needs help translating commands given by Microsoft Support, then contact us for assistance.

Nagios Core SNMP Monitoring APC UPS

God has recently lead me to do some charity volunteer work for a worldwide organization and their IT department. My first project was to untangle their Nagios Core system and then take over the administration of that server and the monitoring of the rest of the network. Part of this volunteer work took place yesterday with deep dive into the Nagios framework, Linux and SNMP to allow monitoring APC UPS devices.

Initial Trip Off Course

My initial thought was not to re-invent the wheel and head to the Nagios Exchange to find a pre-made project that would elegantly provide monitoring APC UPS devices. I found the check_apcupsd project which looked simple and had a great screenshot. Little did I know what I was getting into. Turns out there are a couple undocumented dependencies for this including apcupsd itself and an undocumented connection to port 3551 which I could not find inside the portal page for the SMART-UPS 1500 network management card. After a couple hours of frustration I abandoned this and removed all linux packages associated with it.

Trip Down SNMP lane

After looking over other projects at the Nagios Exchange, I decided to research using SNMP to provide monitoring APC UPS devices. This lead me to an article by Mihai Radoveanu which provided the detailed steps to create monitoring APC UPS devices in Nagios Core. He details editing the command.cfg file to add the check_snmp and his own check_snmp_inverter to list of commands. (Please note that the check_snmp_inverter.sh file will need to be edited to Change the Home variable to point to the Nagios Core plugins directory) He details creating host templates, host groups, adding a separate configuration file to the main file which includes hosts and services. I prefer the more standards based approach to creating individual host files, adding them to a host group and then creating a service file that points to the host group. Made these changes to the Nagios Core framework and confirmed my configuration before making the changes live.

APC Changes Needed

Finally came the changes to the APC UPS network management card configuration:

Login to the network management card webpage, click on Configuration > Network > SNMPv1 > Access then check the box next to Enable and click on Apply.
Click on Configuration > Network > SNMPv1 > Access Control then click on a community name then type in the network SNMP community name and the IP address of the Nagios Core server. It will only need Read permissions. Click on Apply.

That is all that is needed. This introduction to the Nagios Core framework later allowed me to setup SNMP monitoring for the High Availability link ports between their Sonicwall 4600 devices.

If you are looking for expert monitoring of your network systems by highly trained technicians, then contact us for assistance.

© 2016-2023- Farmhouse Networking. All rights reserved

Terms and Conditions Privacy Policy