Diary of a Network Geek

The trials and tribulations of a Certified Novell Engineer who's been stranded in Houston, Texas.

10/13/2017

My Luckiest Friday

Filed under: Fun,Red Herrings — Posted by the Network Geek during the Hour of the Snake which is just before lunchtime or 11:00 am for you boring, normal people.
The moon is a Third Quarter Moon

At least once a year, I try to write about Friday the Thirteenth.

Mostly, because, while other people seem to find it unlucky, I don’t. At least, I don’t find it any less lucky than any other Friday on any other date. If anything, I find myself feeling luckier than normal when everyone else seems to be feeling less lucky, hence the title of this blog post.
Besides, when I get stuck for topics, as I sometimes do, this is an easy enough post to whip together again.

Back in the old days, before the internet or Google or smart phones we use to answer every passing question, I used to assume that Friday the Thirteenth was considered unlucky due to some Biblical association, like since Judas was effectively the Thirteenth Apostle or some other Apocalypse-related numerology that I hadn’t bothered to dig into before or something similar. It’s not a big stretch, really, since so many superstitions seem to tie back to some obscure custom related to religion. But, I’ve since found out that nothing could be further from the truth. Apparently, Friday the Thirteenth is considered unlucky because of its association with the plot to suppress the Knights Templar, according to this article on GlobalPsychics.com. No, seriously! And, I quote:

The modern basis for the Friday the 13th superstition stems from Friday October the 13th, 1307. On this date, the Pope of the church in Rome in Conjunction with the King of France, carried out a secret death warrant against “the Knights Templar”. The Templars were terminated as heretics, never again to hold the power that they had held for so long. There Grand Master, Jacques DeMolay, was arrested and before he was killed, was tortured and crucified. A Black Friday indeed!

So, there you have it, Friday the Thirteenth is a global conspiracy, though, for a nice twist, the Knights Templar or Freemasons aren’t behind it, but, rather, the victims of it! Which I appreciate, incidentally, because I am both a Freemason and, via another Masonic body, a Knight Templar, ironically. Although, to be fair, that same web page I link to there also goes into the fact that 13 is generally considered unlucky due to the number of people at the Last Supper being, you guessed it, thirteen. But, aside from the number, which is considered unlucky in a lot of ways, it’s the association with the suppression of the Templars, which happened on a Friday, that makes the day unlucky historically.

Personally, as I already mentioned, I usually have better luck on Friday the Thirteenth, but, then, I always have been a little out of step with the world. Besides, I’m not a very superstitious person, so I generally don’t buy into most of this nonsense.
Oh, and if you’re not buying the Templar story, here’s a link to some alternate ideas why everyone else is afraid of Friday the Thirteenth.

Oh, and in honor of the upcoming NaNoWriMo, next week you can look forward to some hopefully helpful information about National Novel Writing Month and getting started.

5/13/2016

Another Friday The Thirteenth

Filed under: Red Herrings — Posted by the Network Geek during the Hour of the Hare which is terribly early in the morning or 6:30 am for you boring, normal people.
The moon is a First Quarter Moon

At least once a year, when it rolls around, I try to write about Friday the Thirteenth.

And, actually, I try not to write about it more than once per year, but, sometimes, I get stuck for a creative idea and I admit that I recycle the post.  Kind of like I’m doing right this week.
Back in the old days, before the internet or Google or I was always searching for words to fill the void on my blog, I used to assume that Friday the Thirteenth was considered unlucky due to some Biblical association.  It’s not a big stretch, really, since so many superstitions seem to tie back to some obscure custom related to religion. Personally, I assumed it had something to do with Judas being the Thirteenth Apostle or some other Apocalypse-related numerology that I hadn’t bothered to dig into before. But, I’ve since found out that nothing could be further from the truth. Apparently, Friday the Thirteenth is considered unlucky because of its association with the plot to suppress the Knights Templar, according to this article on GlobalPsychics.com. No, seriously! And, I quote:

The modern basis for the Friday the 13th superstition stems from Friday October the 13th, 1307. On this date, the Pope of the church in Rome in Conjunction with the King of France, carried out a secret death warrant against “the Knights Templar”. The Templars were terminated as heretics, never again to hold the power that they had held for so long. There Grand Master, Jacques DeMolay, was arrested and before he was killed, was tortured and crucified. A Black Friday indeed!

So, there you have it, Friday the Thirteenth is a global conspiracy, though, for a nice twist, the Knights Templar or Freemasons aren’t behind it, but, rather, the victims of it! Which I appreciate, incidentally, because I am both a Freemason and, via another Masonic body, a Knight Templar, ironically.  Although, to be fair, that same web page I link to there also goes into the fact that 13 is generally considered unlucky due to the number of people at the Last Supper being, you guessed it, thirteen.  But, aside from the number, which is considered unlucky in a lot of ways, it’s the association with the suppression of the Templars, which happened on a Friday, that makes the day unlucky historically.
Personally, I usually have better luck on Friday the Thirteenth, but, then, I always have been a little out of step with the world.  Besides, I’m not a very superstitious person, so I generally don’t buy into most of this nonsense.
Oh, and if you’re not buying the Templar story, here’s a link to some alternate ideas why everyone else is afraid of Friday the Thirteenth.

 

This post originally appeared on Use Your Words.

11/13/2015

Friday the Thirteenth

Filed under: Criticism, Marginalia, and Notes,Fun,Life, the Universe, and Everything,Red Herrings — Posted by the Network Geek during the Hour of the Tiger which is terribly early in the morning or 5:30 am for you boring, normal people.
The moon is Waxing Crescent

That’s right, today is Friday the Thirteenth.

I used to assume that Friday the Thirteenth was considered unlucky due to some Biblical association, since so many superstitions seem to tie back to some obscure custom related to religion. Personally, I assumed it had something to do with Judas being the Thirteenth Apostle or some such. But, I’ve since found out that nothing could be further from the truth. As it turns out, Friday the Thirteenth is considered unlucky because of its association…
Read More

3/13/2015

The Luckiest Thing

Filed under: Deep Thoughts,Fun,Life, the Universe, and Everything,Red Herrings — Posted by the Network Geek during the Hour of the Hare which is terribly early in the morning or 6:00 am for you boring, normal people.
The moon is a Third Quarter Moon

That’s right, today is Friday the Thirteenth.

As I’ve said before, I’m not really a superstitious kind of guy. Not really. But, I’ve known a lot of people who are. When I worked in the hotel industry, I actually had sold room 666 to someone not from a Judeo-Christian background, until a co-worker saw it and made a face. Then, I had to explain to the nice gentleman that some people found 666 to be an “unlucky” number. But, man, if…
Read More

6/13/2014

Superstitious Friday

Filed under: Fun,Life, the Universe, and Everything,Red Herrings — Posted by the Network Geek during the Hour of the Hare which is terribly early in the morning or 6:18 am for you boring, normal people.
The moon is Waning Gibbous

Yes, today is Friday the Thirteenth.

I’m not really a superstitious kind of guy.  Not really.  But, I’ve known a lot of people who are.  When I worked in the hotel industry, I once managed to “sell” room 666 to someone not from a Judeo-Christian background, until a co-worker saw it and made a face.  Then, I had to explain to the nice gentleman that some people found 666 to be an “unlucky” number.  But, man, if I had pulled that…
Read More

4/13/2012

Another Sunny Friday

Filed under: Criticism, Marginalia, and Notes — Posted by the Network Geek during the Hour of the Horse which is around lunchtime or 12:25 pm for you boring, normal people.
The moon is a Third Quarter Moon

Yes, today is Friday the Thirteenth.

My day started with a phone call from someone at the office who told me that the power was out.  It was out because a transformer literally exploded.  Then, when the fine folks from the power company came out to fix it, they managed to blow at least one more transformer.  When we left the office this morning, we were told it might be back up sometime after 2:00pm, but, no one really knows for sure.  So, instead of a stressful day at work, I’m home hours early.  Who says that Friday the Thirteenth is an unlucky day?

Most people in the Western World think of this day as unlucky, actually, but I never really have. For years I wondered why people were so funny and superstitious about Friday the Thirteenth. I always thought it was because Judas was the Thirteenth Apostle or something like that. No, according to this article on GlobalPsychics.com, it has to do with the plot to suppress the Knights Templar. Hey, stop laughing! That’s what it says!! And, I quote:

The modern basis for the Friday the 13th superstition stems from Friday October the 13th, 1307. On this date, the Pope of the church in Rome in Conjunction with the King of France, carried out a secret death warrant against “the Knights Templar”. The Templars were terminated as heretics, never again to hold the power that they had held for so long. There Grand Master, Jacques DeMolay, was arrested and before he was killed, was tortured and crucified. A Black Friday indeed!

So, there you have it, Friday the Thirteenth is a global conspiracy, though, for a nice twist, it’s not the Knights Templar or Freemasons who are behind it! Though, I do suppose they are indirectly involved. Personally, I usually have better luck on Friday the Thirteenth, but, then, I always have been a little out of step with the world. Oh, and here’s a link to some alternate ideas why everyone else is afraid of Friday the Thirteenth.

Enjoy it.

5/29/2011

DNS Redirect Attack

Filed under: Geek Work,News and Current Events,Rotten Apples,The Dark Side — Posted by the Network Geek during the Hour of the Horse which is around lunchtime or 12:34 pm for you boring, normal people.
The moon is Waning Crescent

I’m seeing traffic about this, so I thought I’d write up what I found.

I tweeted about a strange DNS-based network/malware attack that I saw on Friday, but, at the time, I didn’t see any interest, so I didn’t go into any real details.  Besides, I may be a hardcore geek, but I do have a life and was going out.  But, now, I’m seeing search engine traffic hitting my blog apparently looking for details, so I thought I’d describe the attack, as I saw it.

First of all, let me mention that I’ve seen a higher-than-usual occurrence of malware infections the past couple of weeks.  I mean, it’s a hazard of my business that, sooner or later, people are going to get infected, either through bad behavior or by accident, but the past three weeks or so I’ve seen way more problems like that than is even remotely normal.  So, bearing that in mind, I’ve been on a kind of high-alert status looking for any malware problems, but this was something new.

It started with someone from another location, who’s on a totally, physically separate network which uses a different internet service provider to connect to the Internet, calling me with a problem.  It was, apparently, a recurrence of a virus he had previously that we cleaned.  He described being taken to a webpage that featured a maroon graphic background with a white icon of a policeman holding up his hand to indicate “stop”.  The text on the page gave a message that said the user’s browser was not the correct version to access the page and that an upgrade was required.  Helpfully, it provided a button to press to receive the “upgrade”.  Obviously, the “upgrade” was an infection.  (You can see an example of the graphic here.)  Thankfully, I trained my users well enough to be suspicious of these kinds of things and no one who reported this actually clicked on it.

About the same time this happened, I noticed that my iPhone wasn’t connecting to the wifi hotspot I have setup in my office.  I checked the configuration and noticed that the DNS servers listed were wrong.  In fact, they’d all been replaced with a single DNS server; 188.229.88.7  Obviously, that seemed suspicious to me, so I opened a command prompt on my PC and did a tracert to see if I could figure out where this server was and, from that, why it had become the default DNS server on part of my network, despite my having very carefully configured totally different DNS servers that I knew were safe.  It looked like the tracert results showed me a network path that led out of the country somewhere, which was, to me, very suspicious.

Before I could really pursue that, though, I got another call from a user at my location reporting the exact same error message and graphic, but going to a totally different website! I went to his computer and checked the IP configuration and found that his DNS servers had been replaced by the rogue server as well.  I refreshed his network config, several times actually, and the DNS servers reset, but, when I thought to check some other people in the same area of the building, his configuration set itself back to the rogue DNS server!  So, I reset the local network equipment to clear the DNS cache, and whatever other caches may have gotten poisoned by this attack, and the problem seemed to go away.  Unfortunately, whatever had caused the compromise was still active and seemed to poison the DNS cache and the DNS configuration again.  It did seem sporadic, though, as if the ISP was trying to correct the issue at their end.

As far as I can tell, the attack actually seemed to be network-based in some way.
At least, I couldn’t find any computer on my network that was infected with anything that AVG, Norton Anti-virus, or Malware Bytes could find.  It is, I suppose, possible, that this attack was so new that no of those programs had an updated detection pattern for it, but, based on the lack of detection, and the fact that it happened on two physically separate networks almost simultaneously, leads me to believe that this was a network-based attack.  I suspect that an ARP cache or DNS cache or something similar was attacked and compromised on a major network router somewhere.  Possibly one of the edge routers at a trans-continental connection somewhere.  From the tracert results I had, it looked like it was the East Coast somewhere, leading to Europe via London to France, though I could be wrong.  It’s possible that was a blind alley meant to throw researchers off the trail in some way.
Also, as of this writing the rogue DNS server seems to be out of commission, though that might change, too.

The Internet is a wild and wooly place, ladies and gents, and you can’t always count on your friendly, neighborhood Network Geek to watch over you and keep you safe!  So, be careful out there!
(And, if you’re a fellow professional who’s seen this, too, leave me comments and tell me what you found!)
UPDATE: Looks like the server is still active, but my ISP has blocked DNS traffic to it, to fix the problem.
Also?  I hate the bastards that do these things.  I hate every last one of the little rat bastards!

UPDATE/FOLLOW-UP: So, it seems like a lot of people have been effected by this problem!
Check the comments for what other folks did and tools they might suggest to help with the problem.  Frankly, I wish I’d had known about those tools when I started my day!  Yes, I was *totally* wrong when I said it looked like it was coming in from outside the routers.  It was, in fact, *several* PCs that were infected with whatever it was.  I found it, much like at least one commenter, by checking the results of “ipconfig /all” in a command prompt.  I noticed that the DHCP server listed in the config was NOT my actual DHCP server!  So, as I went from machine to machine, I saw several PCs that kept coming up as DHCP servers.  I used Malware Bytes to scan the infected PCs and it seemed to clean them off.  At least, for now.  I’m not sure what I’ll find in the morning.
Apparently, Friday, when it looked like the problem was getting cleaned up, it was really just people shutting their workstations down early for the long weekend.
In any case, as at least one commenter has mentioned, it looks like updates for the various scanners should be coming out this week, so keep updating your antivirus and antispyware programs and scan your networks!  Well, scan them more completely and carefully than you already have.
And, as always, if you have any new information or suggestions for tools to clear up the issue, please, leave them in the comments!


Powered by WordPress
Any links to sites selling any reviewed item, including but not limited to Amazon, may be affiliate links which will pay me some tiny bit of money if used to purchase the item, but this site does no paid reviews and all opinions are my own.