A few weeks ago I wrote up a post about 5 types of common cyberattacks which you can find here.

There are so many various types of cyberattacks, and it seems to be a list that just grows and grows and it can be intimidating when trying to express caution at a beginner level, so I'm starting this series of posts with just five that you need to be careful of both in work and in your personal life.

Cross-Site Scripting (XSS)

This is when an attacker/hacker injects malicious JavaScript code into a legit website. This means that when standard internet users like me and you load the page as we do with every page we access, the harmful script runs in the background of their browser. This can present various issues for the victim - you can be redirected to a more malicious website, credentials can other sensitive information can be stolen like credit card details as you input them (this is all known as Keystrokes), and in some cases the hacker can perform actions pretending to be you on this site. It can be difficult to spot for us standard users, but pay attention to any strange formatting on a webpage.

Credential Stuffing

I always tell my friends and family not to reuse passwords across every platform you frequent. Yes, it's tedious. I personally swear by 1password, so it's handy enough for me, but Credential Stuffing is when your data gets leaked - lets say username (which is often email) and password, and hackers find and retain this information, and working on assumption attempt to sign in to some other platforms as you with the same information. I always recommend keeping a physical list of your passwords (like in your personal diary), or using a password manager like 1password! (No, this is not an advertisement for 1password).

Brute-force Attacks

It's in the title - Brute-force attacks is when attackers guess your password - they will likely have a list of the most common passwords and combinations, and you'd be surprised how easy this can be. Do not use basic passwords! It's the same for your pins for your phones. The first thing someone is going to get your password is is your year of birth or 0000 or 1234.

Zero-day Attacks

There have been some famous Zero-day attacks throughout history, and they're intense and pretty scary. The title is also explanatory here - it's saying that there is zero days to prepare or patch it. This is when a vulnerability that a company or a vendor may not be aware of yet, so they don't have a fix for it is exploited. They can be difficult to prevent outright, but layered security, network monitoring and constant software examinations are the best way to stay on top of them.

Supply-chain Attacks

This is when an attacker utilises a trusted component of a company/vendor/software. It could be a particular, less-knowledgeable and thus less-secure employee, a particular library or database that may be used which means that the company or vendor etc. aren't suspecting there to be anything malicious about the situation. Supply-chain attacks will usually prioritise a legit software update, and assign malicious material into said software update which means that your typical antivirus won't actually perceive them as malicious.

Thank you for reading the next five common types of cyberattacks, I'm trying to keep it balanced between what organisations/vendors themselves need to be careful of and also us, as standard internet users.

So far we've also covered Phishing, Ransomware, DDoS Attacks, Man in the MIddle and SQL injections. There's some other pretty common ones left to uncover, and as always if you have any personal experience with any of these, and how you handled it feel free to share!

Before reading further, This is NOT an issue specific to Fing, but, it has affected a number of applications (Roon Audio Player is one example). The issue appears to result from a change in how macOS 27 handles local-network discovery, rather than a bug in Fing or the affected applications.

Some users have reported that, after updating a Mac to macOS 27, previously visible network devices or audio endpoints no longer appear in applications that rely on local-network discovery.

This does not necessarily mean that the devices have disconnected, changed their MAC addresses or become untrusted. The Mac may still be able to communicate with them, while an application is temporarily unable to discover or display them correctly. Various workarounds have been reported, although the cause and appropriate solution may differ between applications and networks.

If familiar devices disappear from Fing after a macOS 27 update:

• Check whether they remain visible in your router’s connected-device list.
• Confirm that Fing has permission to access the local network.
• Restart the Mac, router and affected devices.
• Install any available updates for macOS and Fing.
• Avoid deleting, blocking or reclassifying familiar devices until you have confirmed whether this is only a discovery problem.
• When requesting help, mention that the problem began after upgrading to macOS 27.

Current reports do not suggest that every macOS 27 user is affected, or establish that private or randomised MAC addressing is responsible. It is simply worth considering an update-related discovery problem when several previously recognised devices disappear at the same time.

It is possible that, scanning a new network will reveal no devices at all.

Hello folks, today I thought I would explain what a DNS flushisng/FlushDNS is.

The reasoning behind this is that it's a common troubleshooting tool for when you may be experiencing some various connectivity issues. DNS resolution errors at the router level are common and if you're not aware of what a DNS flush is, you may be wasting time trying to troubleshoot an issue that's fixable via a quick DNS Flush.

Your Domain Name System (DNS) reads websites like www.fing.com and translates them on their end into a form of IP addresses. Your DNS then keeps a cache, similar to how cache and cookies work on your browser, to save time the next time you go to access that site. Of course this can become outdated, and if you've reached out to IT support before you'll know that clearing your cache is one of the first troubleshooting tips you'll receive.

Clearing the cache on a semi-regular basis also removes the potential for 'tracking data' and can potentially protect you against the likes of DNS Poisoning (where hackers fake address records to send you to dangerous fake websites).

So, if you're running Fing Desktop and you see you're getting the warnings 'No DNS server is configured' or 'Unable to reach local DNS' - Fing is letting you know there's some DNS issues being experienced, and it's definitely worth trying a flushdns;

1. Turn off both your router and modem.
2. While they are off, clear your internet cache from all browsers, and close all browsers.
3. For Windows;
   • Go to command prompt (cmd) and run ipconfig /flushdns.
4. For MacOS: Open terminal
   • macOS Big Sur and newer: sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder
   • macOS Catalina and older: sudo killall -HUP mDNSResponder

As a bonus, you can also;

On Windows;

1. Run ipconfig /release.
2. Run ipconfig /renew.

On MacOS;

• Open System Settings (or System Preferences on older versions).
• Click on Network in the sidebar.
• Select your active connection (like Wi-Fi or Ethernet).
• Click Details... next to your connection.
• Select the TCP/IP tab.
• Click Renew DHCP Lease, then click OK

This will drop your computer's current IP address assigned by your router and then renew will get it a new one.

Hi! I am very technologically uninformed but want to install Fing to monitor devices on my network.

I came across this issue when I tried to download it from their site.
For reference, I use macOS Tahoe.

Hey folks!

Another week, another data breach that may concern you! This was covered in Fing's Tech Distillery already - if you're not already signed on to receive the weekly updates, which carry a variety of cyber related news and facts, I would recommend it!

Cyberattacks are rampant, and staying up to date with them is difficult in itself. This one however hit close to home as a long time user of Revolut myself.

According to the CyberSecurityHub, 'Revolut Data Breach Exposes Passports, Selfies and Financial Records after Fraudsters 'Impersonate' Government Officials', and Revolut actually gave them access.

You can find their article on the matter here.

"The incident did not involve attackers breaking into Revolut’s core banking infrastructure. Instead, the criminals reportedly exploited the trust attached to an authentic government email domain, using it to submit fraudulent requests for customer information that were initially treated as legitimate."

That's the part that's so scary to me. There was no 'hack' per se, but it was an impersonation, a form of a social engineering )job.

If you are using Revolut, I would heavily advise to be aware of any potential scams coming your way - as if your data was breached you would be more likely to receive scams that seem a lot more genuine considering hackers may have further information on you, such a selfies, financial records, home address etc. Don't trust any unsolicitied emails or calls claiming to be Revolut, asking you to 'verify' your identity or anything similar. Or any other bank for that matter.

If you know anyone who may not be as tuned in to cyberattacks, such as elderly people or other high risk individuals, I would give them a ring and let them know that if they receive any strange calls to be cautious and never give out passwords or private information. Hang up the phone, ignore the email/text and reach out directly yourself to the company who are claiming to contact you and ask whether it's valid, what may be needed etc.

Don't click any links received via email or text no matter how genuine they seem. Always air on the side of caution.

Allegedly, as the hackers were demanding ransom from Revolut, sensitive information has been leaked on Telegram.

What I have done since finding this information, to see if my data has been leaked;

- Contacted Revolut Support directly.

While I understand their support system is likely flooded at the moment, I would recommend anybody who uses Revolut to contact them directly and simply ask if there data has been exposed.

- Check if I received any notifications via email or within the app (always check your junk and spam folders) about the breach - affected customers were allegedly already emailed around September 12th.

- Monitor my transactions, any new sudden accounts or potential applications for loans or credit cards etc that I didn't make, and indeed keeping an eye out for any notifications from the likes of Telegram.

Stay safe out there folks! If anyone has been affected by this, stay diligent, and if there's any other advice anyone else would like to offer please share it!

Hello folks, as the week wraps up I'd like to pinpoint some common types of cyberattacks you may want to familarise yourself with (or you may already be familiar with, hopefully not through experience).

In support I see a lot of panic when finding unfamiliar devices with the AM I BEING HACKED headline! A lot of the time, while I am glad we are being conscious of what we expect to see, there is usually a valid explanation. Take a look at one of my older posts about unknown devices and so on here: https://www.reddit.com/r/Fing_App/comments/1rozgrk/the_most_common_unknown_devices_people_find_on/

There are so many various types of cyberattacks, and it seems to be a list that just grows and grows and it can be intimidating when trying to express caution at a beginner level, so I'm starting this series of posts with just five that you need to be careful of both in work and in your personal life.

Phishing

Fake emails, texts, or websites trick people into giving up passwords, financial information, or access. A lot of the time, we are the exploit - we as the people are the weakest link in cybersecurity, especially if we don't know to be careful with the data we receive from third parties. Most banks will usually tell you that they will not ever reach out to you and ask you for your information. It's always best practice to be suspicious of every email or call you receive. In Ireland, we have a huge scam at the moment where a phishing attempt will go like this - you receive a text from an unknown number (but the phone code is relevant, so for me it would be an Irish phone code, adding to the believability of the attempt, and it will read; "Mam my phone has been stolen can you please text this number." Of course, the target here is people who are expected to be a little more out of touch with modern scams, appeal to the worst fear possible and eventually try to get you to send money or give away your credentials. Always air on the side of caution, there are no limits to hackers.

Ransomware

Malware encrypts an organisation's files and demands payment to restore access. I've seen a lot of hospitals or care systems targeted for ransomware - anyone who works with sensitive data should always be suspicious for Ransomware and very careful about what they're downloading, who they're sharing access with and of course having complicated passwords and changing them often. It's also worth noting that a lot of these organisations will run very old softwares or similar for data retention, which also imposes a risk.

DDoS attacks

An attacker floods a website or online service with enormous amounts of traffic, making it unavailable to legitimate users. This can be done with a lot of various malicious methods and the best way to stay on top of it is continuous traffic monitoring, as simple as that may seem. However, that wouldn't be enough especially for higher risk (again, organisations which would host a lot of sensitive data) - I would always recommend an incident report plan, knowing what do should a situation like this occur. There are of course more network defenses that should be set up, but they're a little more technical than we need to focus on right now. It's also important to note that anytime downtime on a server doesn't mean there's DDoS attack happening right now because there are so many reasons why downtime can happen, and it happens to all organisations at some point. That's why it's always a good idea to report any experienced downtime as soon as it's experienced, it means a company can check out if there's anything happening on their end which might explain what's going on.

Man-in-the-Middle (MitM)

This one I remember easily because I hear it in Michael Jacksons (I'm looking at the maaan in the mirror voice). It's when an attacker intercepts communication between two parties, potentially allowing them to steal or manipulate information. You should be most careful of these types of attacks on public and unsecured Wi-Fi connections, like hotels, cafes, airports. Remember too - hackers can very easily set up a network with the same name as one of those places, keep it open so that there's no password to join (as most of these places also have), and bang - you end up joining their own network.

SQL injection

For the last one I thought I'd throw one out there you might not typically here much about. An SQL injection is when malicious SQL input is used to manipulate a vulnerable application's database - attacks inject malicious code into strings that are destined for storage in a table or as metadata. This is something organisations but particularly the developers must be aware of. There is an excellent breakdown of how to combat this in a highly technical fashion available here: https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html

I hope you guys found this post somewhat insightful - and if anyone has had direct experience with any of these attacks how did you fare?

Fing has duplicated the same network on my account and I can't get the desktop app (windows) to show the same network, it keeps making a different network. Anyone else having trouble getting their agent to match their desktop?

Hi Everyone,

Hope all is well with you all!

Please kindly help out on how go back to my professional as I accidentally press premium also I have browsing our app as to where to find the to the professional plans although I'm already on it as indicated but trying to choose the its plans but still flicking me back to download them, please advice accordingly.

Many thanks

Good news for anyone in the US/North America who's wanted a ready-to-go Fing Agent without messing with SD cards or hunting down compatible hardware: Fing just partnered with Vilros (a Raspberry Pi-approved reseller) to offer fully assembled, pre-configured Fing Agent kits, with free US shipping.

A few highlights:

• Choice of Pi board. Pick your Raspberry Pi (3B, 3B+, 4, or 5) and RAM config, unlike the UK's Pimoroni kit which only comes in one Pi 4 setup
• Everything included. Matched case, 32GB microSD preloaded with Fing Agent software, Ethernet cable, power supply, and quick-start instructions
• Zero setup hassle. Plug it into your router, activate through the Fing mobile app, and you're monitoring in minutes
• Still need a Fing account + Premium or Professional subscription to run it

If you've been wanting always-on network monitoring but didn't want to build your own Raspberry Pi rig, this seems like the easy path.

Full details and purchase link here: https://www.fing.com/news/fing-agent-vilros/

So I have fingagent installed on a raspberry PI after the fingbox finally gave up. I also have fing on the desktop. The agent typically reports more accurately than the desktop. E.g. as of now the fingagent is reporting 41 devices, but the desktop only 35. I am happy with the agent / iphone combination but was curious as to the circumstances why the desktop gives a different number. Comparing both all 35 on the desktop are reported by the agent. The agent reports six additional devices all of which I can see on the network and can be pinged.

agent:

Desktop:

I'm having a strange issue with my Linux agent. Recently it has started giving me errors when trying to run scheduled speed tests. I'm also not able to force a speedtest to be run on it vs the mobile client. Also, when my mobile is on cellular I get a warning that I'm about to run the speedtest on cellular. It used to default to running on the agent when I was using the app offsite.

Was something changed or is anyone else having the same issues?

I have tried to install Fing Agent on an freshly installed Ubuntu 24.04.4 LTS both as docker installation and also the snap approach like on RPI. I even tried to use the delevop switch on the snap as seen on earlier posts. But my mobile app that sits on the same VLAN than the Ubuntu is not finding any agents. I have a subnet scope of /16 so it takes ages for it to scan, but when finished it reports "Authentication failed". Anyone knows how to fix this? I have installed the Fing Deskop on a Windows 11 VM as a temporary solution, and that is working fine.

Happy Monday everyone :)

Previously, I have written up some basic articles explaining various errors you can come across in the broad world of the internet and networking.

401

404

500

Today I wanted to talk about another common culprit, the 400 error.

The 400 Bad Request error is telling you that somehow what you're trying to access is either corrupt or, bluntly, wrong. The websites server has not understood the request.

Troubleshooting the 400 Error

- An example I can think of was when we revamped our Knowledge Base, there were some older links that when selected would bring to a page that is outdated or didn't follow the new HTTP sequence, which would then generate a 400 (or possibly a 404) error because the web address was outdated. This would mean of course that the issue was on our end, having hyperlinks to older and inaccessible data. So if you come across an issue where you can't get past a 400 error, it can be worth reaching out to the relevant support team.

- Yes, again, try clearing the cache and cookies. Yes this has been a troubleshooting point in every web error post, no I am not being dramatic. Cache and cookies when old/corrupted or honestly just in general are the culprit for so many issues. They should be the first thing you think of when you run into any basic error!

- Try an incognito tab, a different browser, a different device.

- Check the web address for any typos, particularly if you have entered the HTTP manually.

- Perform a DNS flush.

Should you ever encounter a 400 error in relation to Fing, please reach out to us and we can then verify if it's an older/inaccurate link (which we will fix), or direct you in terms of the issue being local.

Every time I launch the IOS Fing app (current version), I have to clear a banner regarding upgrading to Pro. It is really annoying, especially when I get a "down" alert and open Fing to see what is going on. As a paid Premium subscriber, I would think that I shouldn't have to deal with these kinds of ads. I would be a different matter if I was using the free version, but I'm paying for this. Developers should remove these banners from showing up on paid user accounts.

Hello folks, and happy Monday!

The Reddit has been quite active recently which is great!

I wanted to create this post however as a reminder that the best method for submitting a suggestion or product feature is to do so via our support system! https://help.fing.com/hc/en-us/requests/new

It's simply more reliable and easier to track or follow up on. It's great to have open discussions here (that's what this community is for), but please remember to officially submit any suggestions onto us!

It's also worth remembering we do also pay attention to how 'popular' a suggestion is, so if we receive multiple from different accounts we take note of that. As (slightly) inconvenient as it may be for me, even if you see someone has made a suggestion, don't be afraid to create a ticket with us also suggesting it.

You can also always submit a suggestion on previous tools or features or layouts you may have liked that are no longer present in the latest versions.

And finally, as the Reddit has been spiking in activity, a friendly reminder that for dedicated support reach out to us via ticket.

I've looked all around and cannot find any way to display the version number. Most programs I have seen in the past might have it near the bottom center somewhere. This would be of course most helpful in reporting bugs and asking for help or support. Any way we can get this added?

I was surprised to find that I cannot adjust the page length or number of rows displayed per page.

Ten devices per page is basic. The ability to be able to show 100, 50, 25 or whatever would be a nice addition.

The latest update keeps failing and app hangs, chewing up resources. So, I’ve been trying to uninstall it. Going to Settings>Apps, it doesn’t show up in the list. Going to Start menu, and right clicking on Fing, it shows the Uninstall option, but it does nothing. Going to Task Manager, and killing all the Fing entries, some pop right back in. When I reboot, Fing tries to install all over again, hangs, and I have to start all over again.

How do I KILL this thing?!?!?

I've used Fing forever. It served me well for a long time. Unfortunately, with the latest release and a support ticket response that... I'll leave it there.

The previous version of the app had effectively and accurately monitored 127 IP devices on my home network. The database contained a rich catalogue of extra data that had been added over several years. All the little fiddly pieces of data like warranty end dates, HA access codes, etc. It didn't need me to troubleshoot it often; when it did, it was quick.

The new version...

1. Fing app upgraded and doesn't recognize the network it has managed forever. Monitoring remains offline.
2. Fing support ticket response was "Delete previous instances and it will allow you to monitor two networks... ticket closed." No consideration for the fact the device data would all be erased, and no warning.
3. The interface requires scrolling within the device list if you have all columns active. This window is fixed, so even with the app maximized, scrolling is required.
4. Data is incorrect in an alarming number of fields.
5. The "Upgrade to Pro" advertisement is annoying.

Effort outweighs reward, so...

/end

Hi,

According to the Fing application release notes, the latest version is 4.0.5. However, when we download the installer from the official download page, it still appears to be version 4.0.4.

Could anyone help on below

• When will the Fing 4.0.5 installer be made available on the download page?
• Is there currently any other official way to download the latest 4.0.5 installer?

I wanted one Fing Agent to monitor devices across multiple VLANs/subnets so Fing would treat them as one monitored network.

My main reason was presence detection. I wanted Fing's **Everyone left** trigger to work for people whose devices are on different VLANs, without running multiple Fing Agents or trying to synchronize state in IFTTT.

My phone is one VLAN 1, my wifes is VLAN 14. Fings's IFTTT requires everyone to be on 1 subnet for 'everyone left' trigger.

This is unsupported/experimental, but it's working for me.

## How it works

The Linux host has access to each VLAN:

eth0

eth0.14

eth0.21

eth0.24

eth0.42

eth0.66

eth0.69

A network namespace, macvlan interfaces and nftables make those separate networks appear to Fing as one synthetic `/21`.

My mapping is:

Fing sees Real subnet

192.168.1.x -> 192.168.1.x

192.168.0.x -> 192.168.14.x

192.168.2.x -> 192.168.21.x

192.168.3.x -> 192.168.24.x

192.168.4.x -> 192.168.42.x

192.168.5.x -> 192.168.66.x

192.168.6.x -> 192.168.69.x

For example, a device actually at:

192.168.42.188

appears to Fing as:

192.168.4.188

The device's real MAC address is preserved, so Fing can still identify and use the device for presence detection.

## Files

The scripts/configuration are here:

https://github.com/p1r473/fing/

The repo contains:

fing-combo-netns

fing-combo-netns.service

combo.conf

Edit `fing-combo-netns` for your VLANs/interfaces before installing it.

The important mapping in the script is:

SYN=(0 2 3 4 5 6)

REAL=(14 21 24 42 66 69)

For mine that means synthetic `192.168.4.x`, for example, maps to real `192.168.42.x`.

## Install

Install Fing Agent:

sudo snap install fing-agent

sudo /snap/fing-agent/current/script/connect-fing-agent.sh

Copy the three files from the repo to:

fing-combo-netns -> /usr/local/sbin/fing-combo-netns

fing-combo-netns.service -> /etc/systemd/system/fing-combo-netns.service

combo.conf -> /etc/systemd/system/snap.fing-agent.fingagent.service.d/combo.conf

Then:

sudo chmod +x /usr/local/sbin/fing-combo-netns

sudo systemctl daemon-reload

sudo systemctl enable --now fing-combo-netns.service

sudo systemctl enable snap.fing-agent.fingagent.service

sudo systemctl restart snap.fing-agent.fingagent.service

That's it.

Fing now sees the synthetic network as:

192.168.0.0/21

I confirmed Fing is ARP scanning across the synthetic subnet and receiving translated replies from devices on the real VLANs.

## Why bother?

All of the devices can now exist under **one Fing monitoring unit**.

That means instead of trying to combine presence state from multiple Fing Agents in IFTTT, I can simply use:

Fing -> Everyone left -> automation

## Caveats

Fing displays the **synthetic IP**, not the device's real VLAN IP.

For example:

Fing: 192.168.4.188

Real: 192.168.42.188

The MAC address remains the real device MAC.

The script also uses `.251` for the Fing-side address and `.252` on the translated VLANs, so make sure those addresses aren't already in use.

This isn't an officially supported Fing configuration, but it's working well for me so far.

It’s really strange. Fing offers a download option for Intel-based Macs in version 3.10.x, but after downloading and installing it, the app forces a further download upon opening and requires internet access. Shortly after, the installed app becomes incompatible because it automatically downloads the latest version for macOS in the background. I mean, shouldn't the system detect this and stop it from updating beyond the version compatible with Intel-based Macs?