Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, January 31st, 2024 https://isc.sans.edu/podcastdetail/8832, (Wed, Jan 31st)
We use Cowrie to emulate an SSH and Telnet server for our honeypots. Cowrie is great software maintained by Michel Oosterhof [1]. The honeypot is a reasonable emulation of such a server, easy to maintain, and very feature-rich for even more advanced analysis. We only use it in its simplest form for our DShield sensor.
Continue reading What did I say to make you stop talking to me?, (Tue, Jan 30th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, January 30th, 2024 https://isc.sans.edu/podcastdetail/8830, (Tue, Jan 30th)
Last October, Atlassian released a patch for %%cve:2023-22515%% [1]. This vulnerability allowed attackers to create new admin users in Confluence. Today, I noticed a bit a “flare up” in a specific exploit variant.
Continue reading Exploit Flare Up Against Older Altassian Confluence Vulnerability, (Mon, Jan 29th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, January 29th, 2024 https://isc.sans.edu/podcastdetail/8828, (Mon, Jan 29th)
Windows batch files (.bat) are often seen by people as very simple but they can be pretty complex or.. contain interesting encoded payloads! I found one that contains multiple payloads decoded and used by a Powershell process. The magic is behind how comments can be added to such files. The default (or very common way) is to use the “REM” keyword. But you can also use a double-colon:
Continue reading A Batch File With Multiple Payloads, (Fri, Jan 26th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, January 26th, 2024 https://isc.sans.edu/podcastdetail/8826, (Fri, Jan 26th)
These days, many pieces of malware are flagged as âinfostealersâ because, once running on the victim’s computer, they search for interesting data and exfiltrate them. Classic collected data are:
Continue reading Facebook AdsManager Targeted by a Python Infostealer, (Thu, Jan 25th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, January 25th, 2024 https://isc.sans.edu/podcastdetail/8824, (Thu, Jan 25th)
User interface design is one of those often overlooked aspects in software design in general. A bad user interface can quickly become a vulnerability regarding security. Even though I do not remember actual CVE&#;x26;#;39;s assigned to bad user-interface design, there probably should be some. One of the more famous user interface design issues was the “Therac-25” radiation treatment device. A bad user interface has been blamed for contributing to some deadly accidents [1].
Continue reading How Bad User Interfaces Make Security Tools Harmful, (Wed, Jan 24th)