Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, October 20th, 2023 https://isc.sans.edu/podcastdetail/8710, (Fri, Oct 20th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, October 19th, 2023 https://isc.sans.edu/podcastdetail/8708, (Thu, Oct 19th)
There are a variety of attacks seen from DShield honeypots [1]. Most of the time these commands are human readable. but every now and again they are obfuscated using base64 or hex encoding. A quick look for commands containing the “/x” delimiter give a lot of results encoded in hexadecimal.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, October 18th, 2023 https://isc.sans.edu/podcastdetail/8706, (Wed, Oct 18th)
Spam and phishing SMS messages (sometimes called “smishing”) have been problematic in recent years. These messages often bypass security controls and are more challenging to identify as malicious by users. Moreover, they can be just simply annoying.
Continue reading Changes to SMS Delivery and How it Effects MFA and Phishing, (Tue, Oct 17th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, October 17th, 2023 https://isc.sans.edu/podcastdetail/8704, (Tue, Oct 17th)
I was recently asked by a customer whether it still makes sense to cover âtyposâ as a potential indicator that an e-mail message may be malicious in the context of security awareness courses.
Continue reading Are typos still relevant as an indicator of phishing?, (Mon, Oct 16th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, October 16th, 2023 https://isc.sans.edu/podcastdetail/8702, (Mon, Oct 16th)
While reviewing my DShield honeypot logs, I noticed for the first time something strange in my list of Top Username &#;x26; Password where&#;xc2;&#;xa0;several domain name were use as password. Initially,&#;xc2;&#;xa0;I was under the impression this might be&#;xc2;&#;xa0;a parsing error by Logstash and&#;xc2;&#;xa0;decided to review the raw logs to make sure it was parsed correctly to confirm data integrity. Since username and passwords isn&#;x26;#;39;t something submitted to DShield, I reviewed my own raw logs to confirm the data was accurate and reviewed the&#;xc2;&#;xa0;capture rate of username/password combination&#;xc2;&#;xa0;for the past few weeks:
Continue reading Domain Name Used as Password Captured by DShield Sensor, (Sun, Oct 15th)
In this installment of “What&#;x26;#;39;s Normal”, I want to discuss MAC addresses. MAC addresses are used to identify devices on ethernet networks. They are six bytes in length and typically expressed in hexadecimal, separated by a colon or a dash. MAC addresses identify network interfaces on the local network. They must be locally unique and are, to some extent globally unique.
Continue reading What’s Normal: MAC Addresses, (Fri, Oct 13th)