Collaborate Disseminate
ZIP archives store compressed files including their metadata (filesize, date/time, …). When a contained file is password protected, the compressed data is encrypted, but the metadata is not.
Continue reading Friendly Reminder: ZIP Metadata is Not Encrypted, (Mon, Oct 2nd)
In my blog post “Quickpost: Analysis of PDF/ActiveMime Polyglot Maldocs” I explain how to search through MIME files with my tool emldump.py to find suspicious/malicious content:
Continue reading Analyzing MIME Files: a Quick Tip, (Sun, Oct 1st)
Why reinvent the wheel&#;x26;#;x3f; We are all lazy and, if we have a tool that offers some interesting capabilities, why not use it&#;x26;#;x3f; I spotted a simple maliciouis Python script targeting Windows hosts. The file (SHA256:d706d94981bc53ab1458519f224b9602152325fc2a18f3df9d9da8f562b99044) is flagged by 16 antivirus products on VirusTotal&#;x26;#;x5b;1&#;x26;#;x5d;. Nothing very exciting&#;x26;#;xc2;&#;x26;#;xa0;with the script, it&#;x26;#;39;s a bot that uses a Discord channel for C2 communications.&#;x26;#;xc2;&#;x26;#;xa0;
Continue reading Simple Netcat Backdoor in Python Script, (Sat, Sep 30th)
“Infostealer” malware have&#;x26;#;xc2;&#;x26;#;xa0;been in the wild for a long time now. Once the computer&#;x26;#;39;s victim is infected, the goal is to steal “juicy” information like passwords, cookies, screenshots, keystrokes, and more. Yesterday, I spotted an interesting sample. It&#;x26;#;39;s delivered through an FTP connection. The file (SHA256:2bf9a44bd546e0fd1448521669136220dc49146b0f3a5cd7863698ac79b5e778) is unknown on VirusTotal.
Continue reading Are You Still Storing Passwords In Plain Text Files?, (Fri, Sep 29th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, September 29th, 2023 https://isc.sans.edu/podcastdetail/8680, (Fri, Sep 29th)
If you look at the XML EventData of Windows events like 1002 (DHCP error), you will see something like this:
Continue reading IPv4 Addresses in Little Endian Decimal Format, (Thu, Sep 28th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, September 28th, 2023 https://isc.sans.edu/podcastdetail/8678, (Thu, Sep 28th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, September 27th, 2023 https://isc.sans.edu/podcastdetail/8676, (Wed, Sep 27th)
As expected, Apple today released macOS Sonoma (14.0). This update, in addition to new features, provides patches for about 60 different vulnerabilities. Older MacOS versions received updates addressing these vulnerabilities last week with the MacOS 13.6. When these updates were released, the security content was not made public, but with today&#;x26;#;39;s release of macOS 14, Apple revealed the security content of these prior updates.
Continue reading Apple Releases MacOS Sonoma Including Numerous Security Patches, (Tue, Sep 26th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, September 26th, 2023 https://isc.sans.edu/podcastdetail/8674, (Tue, Sep 26th)