Security Performance Management
Continuous Monitoring
Cyber Insurance
National Cybersecurity

Articles in this section

See more

Insecure System Finding Messages

Avatar
Ingrid
Follow
Publication Date – September 12, 2023

⇤ Insecure System Findings

WARN

Message Description Remediation Instructions
File sharing: Gnutella Endpoint is reaching out to abandoned Gnutella peer-to-peer file sharing service domains. Track down the endpoint system by using the available details, disable network connectivity, and/or disable P2P BitTorrent applications.
File sharing: Tracker Endpoint is reaching out to torrent tracker domains for information about files to download via BitTorrent. Track down the endpoint system by using the available details, disable network connectivity, and/or disable P2P BitTorrent applications.
App: Go Contacts Pro Android endpoint is using abandoned “Go Contacts Pro” software. Track down the endpoint system by using the available details and uninstall the application.
App: Auto Words With Friends Cheats Android endpoint is using abandoned “Auto Words With Friends Cheats” software. Track down the endpoint system by using the available details and uninstall the application.
App: Itiva Internet Accelerator Endpoint is using abandoned “Itiva Internet Accelerator” software. Track down the endpoint system by using the available details and uninstall the application.
Remote management: McAfee Corporate AV Corporate& endpoints are contacting abandoned domains from McAfee Enterprise Corporate AntiVirus. Track down the endpoint system by using the available details, and then reinstall or remove the related insecure application.
Remote management: Microsoft SUS Corporate endpoints are contacting abandoned domains for Microsoft Windows Server Update Services. Track down the endpoint system by using the available details, and then reinstall or remove the related insecure application.
Remote management: HVAC controllers Honeywell HVAC industrial/residential controllers are contacting abandoned domains. Track down the endpoint system by using the available details, and then reinstall or remove the related insecure controller or device.
Service: LDAP Endpoint is reaching out to unused LDAP servers via expired domain names. Track down the system accessing the LDAP service by using the available details, and then reconfigure or disable the destination access. Reevaluate your systems contacting remote services. For additional security, block the LDAP port on company edge network infrastructure or use LDAP over TLS/SSL (LDAPS).
Remote management: Microsoft SCCM Devices are using Microsoft System Center Configuration Manager (SCCM) over abandoned domains. Ensure that the management service is not publicly visible from outside of the company's networks by blocking the port on company edge network infrastructure. Use a Virtual Private Network (VPN) if secure access to the resource is needed.

BAD

Message Description Remediation Instructions
App: ActivateTBKS This Android app, pre-installed in The Creative Life (TCL) devices, can steal device and user data. It can also silently install and uninstall Android Application Packages (APK). Track down the endpoint by using the available details and uninstall the application.
IPTV: Abandoned platform Endpoint is an abandoned Chinese-based IPTV platform. Track down the IPTV system by using the available details and disable the insecure application.
IPTV: LiveTV add-on Endpoint is a software media center with abandoned Live TV add-on. Track down the IPTV system by using the available details and disable the insecure application.
Mobile debug firmware: IMEI: 123XXX Mobile endpoint contains firmware with rootkit capabilities disguised as a debug tool, and should not be communicating. Use the available details about the device to track down the source, and then update or disable access to personally identifiable information and confidential data on the device. Ensure the device receives a thorough security review.
Proxy auto-discovery configuration Endpoint is using an abandoned domain for proxy configuration. Track down the system using the proxy by using the available details, and then disable or update the remote proxy auto-configuration setting.
Service: SMB Endpoint is reaching out to Windows Netbios network via an abandoned domain. Track down the system accessing the SMB service by using the available details, and then reconfigure or disable the destination access. Reevaluate your systems contacting remote services. For additional security, block the SMB ports on company edge network infrastructure. If NetBIOS connectivity is required, tunnel any connections through a secure Virtual Private Network (VPN) connection. Implement strong passwords and either strong password handling protocols or a key authentication system.
IPTV: Swarmcast Endpoint is using abandoned “Swarmcast” internet television services. Track down the IPTV system by using the available details and disable the insecure application.
Remote management: Symantec patches Corporate endpoints are contacting abandoned domains from Symantec patch management solution (Altiris). Track down the endpoint system by using the available details, and then reinstall or remove the related insecure application.
Remote management: McAfee ePolicy Corporate endpoints are contacting abandoned domains from McAfee ePolicy Orchestrator (McAfee ePO). Track down the endpoint system by using the available details, and then reinstall or remove the related insecure application.
Remote management: Symantec EPM Corporate endpoints are contacting abandoned domains from Symantec Endpoint Protection Manager. Track down the endpoint system by using the available details, and then reinstall or remove the related insecure application.
Remote management: mydlink DLink routers are using abandoned service domains from “My DLink” portal. Track down the endpoint system by using the available details, and then reinstall or remove the related insecure application.
Remote management: TR-069 CPE Customer-premises equipment (CPE) devices are using the TR-069 protocol for remote management on abandoned domain names. Track down the endpoint system by using the available details, and then reinstall or remove the related insecure application.
Remote management: Citrix PN Agent Devices are using Citrix Received PN Agent over abandoned domains. Track down the endpoint system by using the available details, and then reinstall or remove the related insecure application.

NEUTRAL

Software versions that cannot be determined or are unsupported, but still receive security fixes are evaluated as “NEUTRAL.” These items do not affect the Insecure Systems grade, but should be resolved.

Message Description Remediation Instructions
IPTV: Media Hub Endpoint is using an abandoned media hub, named “Media Hub.” Track down the IPTV system by using the available details and disable the insecure application. Samsung recommends transferring Media Hub accounts to M-GO.

Related articles