Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, August 6th, 2024 https://isc.sans.edu/podcastdetail/9084, (Tue, Aug 6th)
Threat actors like to make detection and analysis of any malicious code they create as difficult as possible â for obvious reasons. There are any number of techniques which they may employ in this area, nevertheless, the one approach, that is common to pretty much all threat actors, is the use of obfuscation.
Continue reading Script obfuscation using multiple instances of the same function, (Mon, Aug 5th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, August 5th, 2024 https://isc.sans.edu/podcastdetail/9082, (Mon, Aug 5th)
When I wrote about the internal file format of protected spreadsheets, I mentioned a simple 16-bit hash for .xls files in diary entry “16-bit Hash Collisions in .xls Spreadsheets” and a complex hash based on SHA256 for .xlsx files in diary entry “Protected OOXML Spreadsheets“.
Continue reading OOXML Spreadsheets Protected By Verifier Hashes, (Sat, Aug 3rd)
Secure boot has been a standard feature since at least Windows 8. As the name implies, the feature protects the boot process. The integrity of the boot process is ensured by digitally signing any software (“firmware”) used during the boot process. As with any digital signature, this process requires the use of certificates to verify the validity of the signatures.
Continue reading Even Linux users should take a look at this Microsoft KB article., (Fri, Aug 2nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, August 2nd, 2024 https://isc.sans.edu/podcastdetail/9080, (Fri, Aug 2nd)
Today, I saw a proxy scan that was a little bit different:
Continue reading Tracking Proxy Scans with IPv4.Games, (Thu, Aug 1st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, August 1st, 2024 https://isc.sans.edu/podcastdetail/9078, (Thu, Aug 1st)
As part of its extensive project portfolio, the Apache Foundation supports OFBiz, a Java-based framework for creating ERP (Enterprise Resource Planning) applications [1]. OFBiz appears to be far less prevalent than commercial alternatives [2]. However, just as with any other ERP system, organizations rely on it for sensitive business data, and the security of these ERP systems is critical.
Continue reading Increased Activity Against Apache OFBiz CVE-2024-32113, (Wed, Jul 31st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, July 31st, 2024 https://isc.sans.edu/podcastdetail/9076, (Wed, Jul 31st)