Jump to content

sdnian

Members
 View Profile  See their activity

  • Posts

    184

  • Joined

  • Last visited

  • Days Won

    1

 Content Type 

Posts posted by sdnian

    Ransomware

    in Malware Finding and Cleaning

    Posted

    8 minutes ago, Marcos said:

    It doesn't matter. Some malware can run even without admin rights. The main problem here is that an "attacker" remoted in and that should be solved in the first place. Even without admin privileges it's possible to escalate them.

    So this is not a problem with ESET? Then I should make this video public, reminding ESET customers to pay attention to this problem.

    Ransomware

    in Malware Finding and Cleaning

    Posted · Edited by sdnian

    5 minutes ago, Marcos said:

    This scenario assumes that an attacker successfully connected via RDP with admin rights. If that happens, the user has a much bigger problem than not detecting files from an RDP share under these specific circumstances when the network speed is limited. With admin rights, a user can do virtually anything. Actual attackers would attempt to kill or remove an AV that would enable him or her to run any malware regardless of the size and type of malicious files.

    That said, the problem that should be solved in the first place is securing RDP (e.g. by limiting it only to connections from LAN and using VPN or 2FA on an RDP gateway).

     

    No. this don't need Admin rights. It just a user account in that video.

    Warning <resource-not-found> After Upgrade

    in ESET PROTECT On-prem (Remote Management)

    Posted · Edited by sdnian

    On 9/5/2018 at 11:40 PM, maorgr said:

    Hi Guys,

    I have upgraded from ERA 6.5 to the latest version 7 and the process was pretty smooth, however - 
    I am getting multiple computers with the following warning message: <resource-not-found-0x1211002d> 

    Is it the same issue with https://forum.eset.com/topic/16536-resource-not-found-after-upgrade-esmc-v7/ ?

     

    No scan file saving from Windows to Linux

    in ESET Products for Linux Servers

    Posted

    I've a Linux Server, OS: SLES 11 SP4 + OES 2005 SP1. I installed ESET File Security for Linux Server 4.5.11 and setting PAC to scan /

    Everything is okay. I try to download eicar.com from Internet to save any folders. It can be detected and deleted by EFS. But if I copy eicar.com from Windows to this server volume (It's Novell NSS volume). It can't be detected.

    If I miss something? How to resolve it?

    Apache HTTP Proxy settings for replication

    in ESET PROTECT On-prem (Remote Management)

    Posted · Edited by sdnian

    @MichalJ I've setup username/password for Apache HTTP Proxy, but still don't work. I have confirm the username/password are right.

    The username is eset, password is 123 

    curl --proxy hxxp://192.168.1.2:3128/ -U eset:xxx https://edf.eset.com/edf
curl: (56) Received HTTP code 407 from proxy after CONNECT

    The password of this command is wrong. So I get error code 407. 

    curl --proxy hxxp://192.168.1.2:3128/ -U eset:123 https://edf.eset.com/edf
<?xml version="1.0" encoding="UTF-8"?><ecp:message xmlns:ecp="hxxp://www.eset.com/2012/02/ecp"><ecp:response><code>20101003</code><message>Unsupported Content-type: unknown</message></ecp:response></ecp:message>

    This command work well.

    Now, ESMC Agent error message is..

    ERROR: InitializeConnection: Initiating replication connection to 'host: "192.168.1.1" port: 2222' failed with: Request: Era.Common.Services.Replication.CheckReplicationConsistencyRequest on connection: host: "192.168.1.1" port: 2222 with proxy set as: Proxy: Connection: 192.168.1.2:3128, Credentials: Name: eset, Password: ******, Enabled:1, EnabledFallback:1, failed with error code: 14, error message: Connect Failed, and error details:
    • Replication details: [Task: CReplicationConsistencyTask, Scenario: Automatic replication (REGULAR), Connection: 10.11.3.247:2222, Connection established: false, Replication inconsistency detected: false, Server busy state detected: false, Realm change detected: false, Realm uuid: 5df4b312-4e4b-4aa4-b4ea-be3d56defcf0, Sent logs: 0, Cached static objects: 69, Cached static object groups: 10, Static objects to save: 0, Static objects to delete: 0, Modified static objects: 0]
    • All replication attempts: 215
    Could you please tell me more detail information how to fix it? Thank you!

    Apache HTTP Proxy settings for replication

    in ESET PROTECT On-prem (Remote Management)

    Posted

    I'd like to settings ESMC agent v7 to connect ESMC Server through Apache HTTP proxy. But it's don't work.

    For example, I've these three computers.

    ESMC Server: 192.168.1.1

    Apache HTTP Proxy: 192.168.1.2

    ESMC Agent: 192.168.1.10

    If let ESMC agent connect to EMSC server, port 2222. It works! 

    But I setup to use proxy server, host: 192.168.1.2, port 3128 in ESMC agent. And I block source 192.168.1.10 in ESMC server. But it connect failed. 

    If I change the httpd.conf. Remark the line 'deny from all' between <Proxy *> </Proxy>. It could connect again.

    Next, I read the document - https://support.eset.com/kb6920/. So I've enable 'deny from all' back, but I add below contents:

    <ProxyMatch ^192.168.1.1$>

    Allow from all

    </ProxyMatch>

    It can't connect again. (I've restart Apache HTTP Proxy)

    The error message:

    ERROR: InitializeConnection: Initiating replication connection to 'host: "192.168.1.1" port: 2222' failed with: Request: Era.Common.Services.Replication.CheckReplicationConsistencyRequest on connection: host: "192.168.1.1" port: 2222 with proxy set as: Proxy: Connection: 192.1.1.2:3128, Credentials: Name: , Password: ******, Enabled:1, EnabledFallback:1, failed with error code: 14, error message: Connect Failed, and error details:
    • Replication details: [Task: CReplicationConsistencyTask, Scenario: Automatic replication (REGULAR), Connection: 192.1.1.1:2222, Connection established: false, Replication inconsistency detected: false, Server busy state detected: false, Realm change detected: false, Realm uuid: 5df4b312-4e4b-4aa4-b4ea-be3d56defcf0, Sent logs: 0, Cached static objects: 69, Cached static object groups: 10, Static objects to save: 0, Static objects to delete: 0, Modified static objects: 0]
    • All replication attempts: 91
     
    What do I wrong?
     

    Excluded IP address for Web Protection don't work in version 6.6.2078.5

    in ESET Endpoint Products

    Posted

    7 minutes ago, MichalJ said:

    Hello @sdnian

    Can you share a bit more details about what is not working?
    Especially the address you want to exclude and the actual exclusion. We need more data for analysis. 

    For example.. I'd like to exclude IP address 192.168.1.10 by web protection scanning. So I setup '192.168.1.10' in the 'Excluded IP addresses' list. Then I try to download eicar.com from 192.168.1.10. It should be detected by real-time protection. Right? But this file be detected by HTTP scanner in version 6.6.2078.5.

×
×
  • Create New...