Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, September 6th, 2023 https://isc.sans.edu/podcastdetail/8646, (Wed, Sep 6th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, September 5th, 2023 https://isc.sans.edu/podcastdetail/8644, (Tue, Sep 5th)
Based on reader feedback, I decided to take a&#;x26;#;xc2;&#;x26;#;xa0;look at usernames submitted to honeypots. The usernames that are seen on a daily basis look very familiar.&#;x26;#;xc2;&#;x26;#;xa0;They tend to come from default user accounts, such as “administrator” on Windows systems or&#;x26;#;xc2;&#;x26;#;xa0;”root” on Linux systems. The knowledge of a default user account can help in brute force attacks. If the username is already known, only&#;x26;#;xc2;&#;x26;#;xa0;the password needs to be guessed. This shouldn&#;x26;#;39;t be too much of a problem to users as long as strong passwords are chosen&#;x26;#;xc2;&#;x26;#;xa0;or other authentication methods such as&#;x26;#;xc2;&#;x26;#;xa0;public key authentication is used. Setting up public key authentication is also referenced in our DShield setup instructions for a Raspberry Pi [2].&#;x26;#;xc2;&#;x26;#;xa0;
Continue reading Common usernames submitted to honeypots, (Tue, Sep 5th)
I wrote a blog post “Quickpost: Analysis of PDF/ActiveMime Polyglot Maldocs” on how to analyse PDF/ActiveMime polyglot malicious document files and also developed a YARA rule to detect them.
Continue reading Creating a YARA Rule to Detect Obfuscated Strings, (Mon, Sep 4th)
A reader submitted a suspicious PDF file. TLDR: it&#;x26;#;39;s a defective phishing PDF.
Continue reading Analysis of a Defective Phishing PDF, (Sun, Sep 3rd)
We use passwords just about everywhere in our daily lives. It&#;x26;#;39;s difficult to think of an online service where we don&#;x26;#;39;t have a need to enter some kind of credentials to access our content. DShield honeypots collect a variety of data, including passwords, that are submitted from SSH and telnet attacks.
Continue reading What is the origin of passwords submitted to honeypots?, (Sat, Sep 2nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, September 1st, 2023 https://isc.sans.edu/podcastdetail/8642, (Fri, Sep 1st)
[This is a Guest Diary by James Turner, an ISC intern as part of the SANS.edu BACS program]
Continue reading Potential Weaponizing of Honeypot Logs [Guest Diary], (Thu, Aug 31st)
Those of us who teach security awareness courses are often asked âWhy would someone target ME?â or âWhy would someone target OUR organization?â. Though these sentiments aren’t nearly as common as they used to be, since even mainstream media seem to cover cyber-attacks on at least a weekly basis, and â as a result â even non-IT specialists are becoming aware of the ubiquity of cyber-attacks, such questions still come up, both when teaching âregularâ employees as well as when it comes to board-level security trainings.
Continue reading The low, low cost of (committing) cybercrime, (Thu, Aug 31st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, August 31st, 2023 https://isc.sans.edu/podcastdetail/8640, (Thu, Aug 31st)