Jason Rush - Part 3

Re: unknown charge on my card

I received the following email from our address on a clients system (with their email domain name redacted):

From: denise@chefspecialties.com [mailto:denise@chefspecialties.com]
Sent: Thursday, June 16, 2016 6:36 AM
Subject: Re: unknown charge on my card

What is this $816.27 charge on my credit card?
It shows this amount charged by <REDACTED DOMAIN NAME>.
Please check the screenshot i have attached and tell me what is this about?

Thank you
Denise Allen
Chef Specialties
P: 814.3217085
F: 814.2353106

The email also included an attachment “<REDACTED DOMAIN NAME>_card_screenshot.doc” that showed as follows: Continue reading “Re: unknown charge on my card”

Attached scan doc

The other day a client received the below email with an attached .html file (“dropbox file share.html”):

From: Jonathan Wunrow [mailto:jonwunrow@gmail.com]
Sent: Wednesday, June 15, 2016 11:33 AM
Subject: Attached scan doc

See the Attached quote file

—

Make it a Great Day!

Jonathan Wunrow
Program Manager/Grant Writer
Cell – (907) 617-9956

Continue reading “Attached scan doc”

Good morning – malicious Javascript attachment

A friend received an email titled “Good morning” with the following contents:

I was visting your webpage on 5/5/2016 and I’m interested.
I’m currently looking for work either full time or as a volunteer to get experience in the field.
Please look over my Resume and let me know your thoughts.

Regards,

—
Chaitanya Prabhat

The email also happened to include an attachment named Resume_475.js which is a Javascript file. This is potentially nastier than Javascript in a standard webpage because the code is executed via Wscript (Windows-Based Script Host) and thus does not have restrictions such as Same-Origin Policy, and allows this Javascript access to local files and to run arbitrary commands.

Continue reading “Good morning – malicious Javascript attachment”

Windows computers and Adak time & timezones

The Issue

A few weeks ago, I ran into an issue where time on computers in Adak (an island in the Aleutian Islands, in Alaska) were completely wrong after Daylight Savings. Adak is 1 hour behind the rest of Alaska (per Wikipedia, and the client), but was now 2 hours behind. Continue reading “Windows computers and Adak time & timezones”

Nagios check_esxi_hardware CRITICAL: Execution time too long!

Today I ran into a Nagios check that had shown status “UNKNOWN” with output “CRITICAL: Execution time too long!” for the check_esxi_hardware check. The server and ESXi system all seemed to be functioning just fine, and no updates had been applied between it working and the new “UNKNOWN” status. Continue reading “Nagios check_esxi_hardware CRITICAL: Execution time too long!”