Tag: SANS Internet Storm Center, InfoCON: green

From Perfctl to InfoStealer, (Wed, Oct 9th)

A few days ago, a new stealthy malware targeting Linux hosts made a lot of noise: perfctl[1]. The malware has been pretty well analyzed and I won&#x27t repeat what has been already disclosed. I found a copy of the “httpd”…

Microsoft Patch Tuesday – October 2024, (Tue, Oct 8th)

Microsoft today released patches for 117 vulnerabilities. Three additional vulnerabilities apply to Chromium/Edge. Another three vulnerabilities are rated critical. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Microsoft Patch Tuesday – October…

macOS Sequoia: System/Network Admins, Hold On!, (Mon, Oct 7th)

It's always tempting to install the latest releases of your preferred software and operating systems. After all, that's the message we pass to our beloved users: “Patch, patch, and patch again!”. Last week, I was teaching for SANS and decided…

Survey of CUPS exploit attempts, (Fri, Oct 4th)

It is about a week since the release of the four CUPS remote code execution vulnerabilities. After the vulnerabilities became known, I configured one of our honeypots that watches a larger set of IPs to specifically collect UDP packets to…

Security related Docker containers, (Wed, Oct 2nd)

Over the last 9 months or so, I've been putting together some docker containers that I find useful in my day-to-day malware analysis and forensicating. I have been putting them up on hub.docker.com and decided, I might as well let…

Tool update: mac-robber.py and le-hex-to-ip.py, (Mon, Sep 30th)

One of the problems I've had since I originally wrote mac-robber.py [1][2][3] seven years ago is that because of the underlying os.stat python library we couldn't get file creation times (B-times). Since the release of GNU coreutils 8.32 (or so),…