Category: SANS Internet Storm Center, InfoCON: green

Apple May 2021 Security Updates, (Mon, May 24th)

This article has been indexed from SANS Internet Storm Center, InfoCON: green Apple has released several updates for iPhones, iPads, Apple Watches, and Macs earlier today (May 24). More details are available on the Apple Security Updates website. Read…

“Serverless” Phishing Campaign, (Sat, May 22nd)

This article has been indexed from SANS Internet Storm Center, InfoCON: green The Internet is full of code snippets and free resources that you can embed in your projects. SmtpJS is one of those small projects that are very interesting for…

Ransomware Defenses, (Mon, May 17th)

This article has been indexed from SANS Internet Storm Center, InfoCON: green Ransomware attacks continue to be in the headlines everywhere, and are also an almost weekly reoccurring subject in the SANS Newsbites. As useful as many of the reports…

Microsoft May 2021 Patch Tuesday, (Tue, May 11th)

This month we got patches for 55 vulnerabilities. Of these, 4 are critical, 3 were previously disclosed and none is being exploited according to Microsoft. Read the original article: Microsoft May 2021 Patch Tuesday, (Tue, May 11th)

Who is Probing the Internet for Research Purposes?, (Sat, May 8th)

Shodan[1] is one of the most familiar site for research on what is on the internet. In Oct 2020 I did a diary on Censys [2][3], another site collecting similar information like Shodan. The next two sites are regularly scanning…

Exposed Azure Storage Containers, (Fri, May 7th)

A couple months ago, we already covered the topic of exposed Azure Blob Storage in two separate ISC diaries, “Exposed Blob Storage in Azure” and “Preventing Exposed Blob Storage in Azure”. The information therein is still relevant and valid, so…

Alternative Ways To Perform Basic Tasks, (Thu, May 6th)

I like to spot techniques used by malware developers to perform basic tasks. We know the lolbins[1] that are pre-installed tools used to perform malicious activities. Many lolbins are used, for example, to download some content from the Internet. Some…

Quick and dirty Python: masscan, (Tue, May 4th)

Those who know me are aware that I am a recovering shell programmer. I have 35+ years of various shell scripts involving complicated code pipelines with grep, cut, sort, uniq, awk, input files, output files, redirects, pipes etc…cobbled together to…

Important Apple Updates, (Tue, May 4th)

On Monday May 3rd, Apple released important updates to macOS Big Sur, iOS and iPadOS, and watchOS to resolve an issue in WebKit which when “Processing maliciously crafted web content may lead to arbitrary code execution.” Apple has indicated that…

From Python to .Net, (Thu, Apr 29th)

Read the original article: From Python to .Net, (Thu, Apr 29th) The Microsoft operating system provides the .Net framework[1] to developers. It allows to fully interact with the OS and write powerful applications… but also malicious ones. In a previous…

CAD: .DGN and .MVBA Files, (Mon, Apr 26th)

Read the original article: CAD: .DGN and .MVBA Files, (Mon, Apr 26th) Regularly I receive questions about MicroStation files, since I wrote a diary entry about AutoCAD drawings containing VBA code. Read the original article: CAD: .DGN and .MVBA Files,…

Base64 Hashes Used in Web Scanning, (Sat, Apr 24th)

Read the original article: Base64 Hashes Used in Web Scanning, (Sat, Apr 24th) I have honeypot activity logs going back to May 2018 and I was curious what type of username:password combination was stored in the web traffic logs following…

How Safe Are Your Docker Images?, (Thu, Apr 22nd)

Read the original article: How Safe Are Your Docker Images?, (Thu, Apr 22nd) Today, I don't know any organization that is using Docker today. For only test and development only or to full production systems, containers are deployed everywhere! In…

PulseSecure Out of Cycle Advisory: https://kb.pulsesecure.net/articles/Pulse_Secure_Article/SA44784/, (Tue, Apr 20th)

Read the original article: PulseSecure Out of Cycle Advisory: https://kb.pulsesecure.net/articles/Pulse_Secure_Article/SA44784/, (Tue, Apr 20th) This post doesn’t have text content, please click on the link below to view the original article. Read the original article: PulseSecure Out of Cycle Advisory: https://kb.pulsesecure.net/articles/Pulse_Secure_Article/SA44784/,…

Decoding Cobalt Strike Traffic, (Sun, Apr 18th)

Read the original article: Decoding Cobalt Strike Traffic, (Sun, Apr 18th) In diary entry “Example of Cleartext Cobalt Strike Traffic (Thanks Brad)” I share a capture file I found with unencrypted Cobalt Strike traffic. The traffic is unencrypted since the…

HTTPS Support for All Internal Services, (Fri, Apr 16th)

Read the original article: HTTPS Support for All Internal Services, (Fri, Apr 16th) SSL/TLS has been on stage for a while with deprecated protocols[1], free certificates for everybody[2]. The landscape is changing to force more and more people to switch…

Microsoft April 2021 Patch Tuesday, (Tue, Apr 13th)

Read the original article: Microsoft April 2021 Patch Tuesday, (Tue, Apr 13th) This month's score includes 114 Vulnerabilities. There are 19 Criticals this month with 4 previously disclosed and 1 being exploited. Read the original article: Microsoft April 2021 Patch…

WiFi IDS and Private MAC Addresses, (Wed, Apr 7th)

Read the original article: WiFi IDS and Private MAC Addresses, (Wed, Apr 7th) I recently came across “nzyme” [1], a WiFi Intrusion Detection System (IDS). Nzyme does focus on WiFi-specific attacks, so it does not care about payload but inspects…

YARA and CyberChef: ZIP, (Sun, Apr 4th)

Read the original article: YARA and CyberChef: ZIP, (Sun, Apr 4th) When processing the result of “unzip” in CyberChef, for example with YARA rules, all files contained inside the ZIP file, are concatenated together.   Become a supporter of IT…

Video: YARA and CyberChef, (Sat, Apr 3rd)

Read the original article: Video: YARA and CyberChef, (Sat, Apr 3rd) In diary entry “YARA and CyberChef”, I explain how to use YARA rules together with CyberChef.   Become a supporter of IT Security News and help us remove the…

C2 Activity: Sandboxes or Real Victims?, (Fri, Apr 2nd)

Read the original article: C2 Activity: Sandboxes or Real Victims?, (Fri, Apr 2nd) In my last diary[1], I mentioned that I was able to access screenshots exfiltrated by the malware sample. During the first analysis, there were approximately 460 JPEG…

April 2021 Forensic Quiz, (Thu, Apr 1st)

Read the original article: April 2021 Forensic Quiz, (Thu, Apr 1st) Introduction   Become a supporter of IT Security News and help us remove the ads. Read the original article: April 2021 Forensic Quiz, (Thu, Apr 1st)

Jumping into Shellcode, (Mon, Mar 29th)

Read the original article: Jumping into Shellcode, (Mon, Mar 29th) Malware analysis is exciting because you never know what you will find. In previous diaries[1], I already explained why it's important to have a look at groups of interesting Windows API…