Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, October 31st, 2023 https://isc.sans.edu/podcastdetail/8724, (Tue, Oct 31st)
The recent patch to iOS/macOS for CVE-2023-42846 made me think it is probably time to write up a reminder about the privacy impact of UPNP and multicast DNS. This is not a new issue, but it appears to have been forgotten a bit [vuln]. In particular, Apple devices are well-known for their verbose multicast DNS messages.
Continue reading Flying under the Radar: The Privacy Impact of multicast DNS, (Mon, Oct 30th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, October 30th, 2023 https://isc.sans.edu/podcastdetail/8722, (Mon, Oct 30th)
We are now at the end of the Cybersecurity Awareness month, it is important to remain digitally safe all year round [1][2][3].
Continue reading Spam or Phishing? Looking for Credentials & Passwords, (Sun, Oct 29th)
This week, I&#;x26;#;39;m teaching FOR610 in Manchester, and while my students are busy resolving some challenges, I&#;x26;#;39;m looking at my hunting results from the previous days. I found an interesting sample. The file was delivered via an email with a URL pointing to a well-known file-sharing service: hxxps://www[.]Mediafire[.]com/file/o3m15ydxnhlm9w0/New+Purchase+Order+pdf.tgz/file. The file is not available anymore, but I was able to find it back on VirusTotal: “New Purchase Order pdf.tgz” (SHA256:7f351b32e6209496ef59c511dffaf9312508b53e476b1e77171af3d433b94087[1]) with a low score of 3/54.
Continue reading Size Matters for Many Security Controls, (Sat, Oct 28th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, October 27th, 2023 https://isc.sans.edu/podcastdetail/8720, (Fri, Oct 27th)
It should be pretty easy to validate an IP address. IPv4 addresses are 32-bit unsigned integers, and IPv6 addresses are 128-bit unsigned integers. Things get “interesting” when developers attempt to validate IP addresses as a string. There have been a few interesting vulnerabilities around this issue (CVE-2021-28918, CVE-2021-29921, CVE-2021-29418).
Continue reading Adventures in Validating IPv4 Addresses, (Thu, Oct 26th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, October 26th, 2023 https://isc.sans.edu/podcastdetail/8718, (Thu, Oct 26th)
Apple released iOS, iPadOS, macOS, tvOS, and Safari updates today. The iOS/macOS updates go back two “generations”. This is particularly important for iOS 15, which now receives a patch for CVE-2023-32434, a vulnerability already exploited against earlier versions of iOS. This is also the only issue addressed for these earlier iOS versions.
I noticed many scans for “/server-info.action” showing up in our “First Seen URLs” report. This URL didn&#;x26;#;39;t ring a bell at first but may be associated with CVE-2023-22515, a recent vulnerability in Confluence Server and Data Center.