Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, November 28th, 2023 https://isc.sans.edu/podcastdetail/8754, (Tue, Nov 28th)
Last week, ownCloud released an advisory disclosing a new vulnerability, CVE-2023-49103 [1]. The vulnerability will allow attackers to gain access to admin passwords. To exploit the vulnerability, the attacker will use the “graphapi” app to access the output of “phpinfo”. If the ownCloud install runs in a container, it will allow access to admin passwords, mail server credentials, and license keys.
Continue reading Scans for ownCloud Vulnerability (CVE-2023-49103), (Mon, Nov 27th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, November 27th, 2023 https://isc.sans.edu/podcastdetail/8752, (Mon, Nov 27th)
I had to figure out when a OVA file was published (for a virtual machine). The Open Virtualization Format (OVF) is the standard for these files.
About 10 days ago, new versions of Wireshark were released.
This is just an annual reminder that DShield, the engine behind the SANS Internet Storm Center,&#;x26;#;xc2;&#;x26;#;xa0;was originally coded over the Thanksgiving weekend in 2000 and made life shortly after. Below is an early screenshot (not the earliest one, but the earliest one I am not too embarrassed to post 🙂 ).&#;x26;#;xc2;&#;x26;#;xa0; The domain was registered a few months before I started coding the site (July 7th, so probably July 4th weekend), but I didn&#;x26;#;39;t get around to coding it before. The first “submission agent” was a one-liner shell script grepping logs from Syslog and piping them to sendmail to submit them&#;x26;#;xc2;&#;x26;#;xa0;:). There are not a lot of projects that have survived this long, and well, some of the early code (and certainly design decisions) may still live on today.
[This is a Guest Diary by Jonah Latimer, an ISC intern as part of the SANS.edu BACS program]
Continue reading CVE-2023-1389: A New Means to Expand Botnets, (Wed, Nov 22nd)
While reviewing one of my honeypots to convert some of the JSON data, I noticed some of my files were much larger than I expected. That leads to the question, how large should these files normally be and why are some of them so large? To help summarize this data a bit easier, it seemed like a good idea to make another python script.
Continue reading Overflowing Web Honeypot Logs, (Mon, Nov 20th)
SharpLoader is a very old project! I found repositories on Gitlab that are 8 years old[1]! Its purpose is to load and uncompress a C# payload from a remote web server or a local file to execute it. There exists also a Powershell version of this loader[2].
Continue reading Quasar RAT Delivered Through Updated SharpLoader, (Sat, Nov 18th)
Anti-analysis features in phishing pages – especially in those, which threat actors send out as e-mail attachments – are nothing new[1,2]. Nevertheless, sometimes the way that these mechanisms are implemented may still leave one somewhat mystified. This has happened to me a few weeks ago when I found what appeared to be a generic phishing message in one of my spam traps.
Continue reading Phishing page with trivial anti-analysis features, (Fri, Nov 17th)