Author Archives: SANS Internet Storm Center, InfoCON: green

With what is (or was by now?) hurricane Idalia crossing past my house today, I decided to write a quick summary of what I usually do in cases like this to prepare. This is for a home office or a small business, assuming you have the resources for a typical home. Unlike natural disasters like Earthquakes, Hurricanes are somewhat predictable, and you typically have a couple of days warning. If you live in a hurricane-prone area like Florida, you are likely familiar with nhc.noaa.gov. The site provides “raw data” about current storm activity and avoids some of the hype added by some news outlets.

Continue reading Home Office / Small Business Hurricane Prep, (Mon, Aug 28th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, August 30th, 2023 https://isc.sans.edu/podcastdetail/8638, (Wed, Aug 30th)→

Many, many years ago we (SANS Internet Storm Center) published some interesting research about survival time of new machines connected to the Internet. Back then, when Windows XP was the most popular operating system, it was enough to connect your new machine to the Internet and get compromised before you managed to download and install patches. Microsoft changed this with Windows XP SP2, which introduced the host based firewall that was (finally) enabled by default, so a new user had a better chance of surviving the Internet.

Continue reading Survival time for web sites, (Tue, Aug 29th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, August 29th, 2023 https://isc.sans.edu/podcastdetail/8636, (Tue, Aug 29th)→

My tool zipdump.py can be used to analyse the latest exploits of vulnerability CVE-2023-38831 in WinRAR.

Continue reading Analysis of RAR Exploit Files (CVE-2023-38831), (Mon, Aug 28th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, August 28th, 2023 https://isc.sans.edu/podcastdetail/8634, (Mon, Aug 28th)→

When you must investigate suspicious behavior or work on an actual incident, you could be asked to determine who’s behind a network connection. From a pure network point of view, your firewall or any network security control device/app will tell you that the source is the connection is host « A », « B » or « C ». But investigating further how to discover who or which process is the source of the connection (now, at the operating system level).

Continue reading macOS: Who?s Behind This Network Connection?, (Sat, Aug 26th)→

For modern malware, having access to its C2 (Command and control) is a crucial point. There are many ways to connect to a C2 server using tons of protocols, but today, HTTP remains very common because HTTP is allowed on most networks…

Continue reading Python Malware Using Postgresql for C2 Communications, (Fri, Aug 25th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, August 25th, 2023 https://isc.sans.edu/podcastdetail/8632, (Fri, Aug 25th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, August 24th, 2023 https://isc.sans.edu/podcastdetail/8630, (Thu, Aug 24th)→