Collaborate Disseminate
Web applications are a wide world that is currently the object of numerous cyberattacks, mostly seeking to compromise the information directly in the clients that use them.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, April 6th, 2023 https://isc.sans.edu/podcastdetail.html?id=8442, (Thu, Apr 6th)
There have been other diaries &#;x26;#;x5b;1&#;x26;#;x5d;&#;x26;#;x5b;2&#;x26;#;x5d; showing how to explore JSON data with jq &#;x26;#;x5b;3&#;x26;#;x5d;. We&#;x26;#;39;ll review some options to understand unfamiliar JSON data and ways to filter that information. Using tools like Security Information and Event Management (SIEM) systems can help aggregate data and make it more easily searched and visualized. There are still times where being able to quickly search JSON data can be useful, especially if a SIEM option is not immediately available.
Continue reading Exploration of DShield Cowrie Data with jq, (Wed, Apr 5th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, April 5th, 2023 https://isc.sans.edu/podcastdetail.html?id=8440, (Wed, Apr 5th)
Yesterday, I wrote about efile.com serving malicious ake “Browser Updates” to some of its users. This morning, efile.com finally removed the malicious code from its site. The attacker reacted a bit faster and removed some of the additional malware. But luckily, I was able to retrieve some of the malware last evening before it was removed.
Continue reading Analyzing the efile.com Malware “efail”, (Tue, Apr 4th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, April 4th, 2023 https://isc.sans.edu/podcastdetail.html?id=8438, (Tue, Apr 4th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, April 4th, 2023 https://isc.sans.edu/podcastdetail.html?id=8438, (Tue, Apr 4th)
[Added an update at the end with more details regarding the “update.exe” file. I think it is safe to say at this point, that efile.com has been compromised.]
If you live in the US, you are likely aware that we are entering the last phase of the tax filing season. Returns are due April 15th, and scammers know that last-minute filing stress makes people less careful. Tax filings typically include sensitive PII like social security numbers, addresses, and other details. The IRS has, in recent years, tried to reduce fraud, but there are still several scams that are hard to eradicate. One of the significant risks is phishing, and one of the hooks that may be used is offers to file taxes for free. Legitimate providers of tax filing services do offer free services for simple returns. The IRS set up a specific site to find a provider for free filing services:
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, April 3rd, 2023 https://isc.sans.edu/podcastdetail.html?id=8436, (Mon, Apr 3rd)