Author Archives: SANS Internet Storm Center, InfoCON: green

The Mirai[1] botnet is active for years. It was the first botnet targeting devices running Linux like camera recorders. Our first diary about it was in 2016![2]. Still today, my honeypot is hit by hundreds of Mirai requests every day! I found a Python script that generates a Mirai payload (SHA256:f56391e9645df1058847e28af6918c64ddc344d9f328b3dde9015213d5efdc7e[3]) and deploys networking services to serve it via FTP, HTTP, and TFTP. Nothing very fancy but it will give you a good idea about how Linux hosts are abused to deliver malicious payloads.

Continue reading Overview of a Mirai Payload Generator, (Sat, Mar 11th)→

In the FOR610[1] class, we learn how to perform malware analysis. The training focuses on Windows PE files but in the real world, malware samples use multiple technologies to perform malicious actions. I spotted a VBScript file (I don’t know where it’s coming from, probably a phishing campaign). The script has been flagged by only one(!) AV product on VT (SHA256: 81e4e91b8a841311b28b42951d53ec6ce471227480ca97c91c2aa1eeda6dad30[2]).

Continue reading Multi-Technology Script Leading to Browser Hijacking, (Fri, Mar 10th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, March 10th, 2023 https://isc.sans.edu/podcastdetail.html?id=8404, (Fri, Mar 10th)→

Grep is a command line tool I use every single day. Not much to it, I use:

Continue reading Today I Learned .. a new thing about GREP, (Thu, Mar 9th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, March 9th, 2023 https://isc.sans.edu/podcastdetail.html?id=8402, (Thu, Mar 9th)→

About three weeks ago, Joomla fixed a vulnerability in the Joomla content management system, patching a trivial to exploit access control vulnerability. The vulnerability allowed access to the Joomla username/password database.

Continue reading Increase in exploits agains Joomla (CVE-2023-23752), (Wed, Mar 8th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, March 8th, 2023 https://isc.sans.edu/podcastdetail.html?id=8400, (Wed, Mar 8th)→

[David Boyd, a SANS.edu undergraduate intern, submitted this post]

Continue reading Hackers Love This VSCode Extension: What You Can Do to Stay Safe, (Tue, Mar 7th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, March 7th, 2023 https://isc.sans.edu/podcastdetail.html?id=8398, (Tue, Mar 7th)→

We frequently see news of information leaks that occur in different companies due to having information in the cloud with the wrong permissions, allowing anyone access to potentially confidential information.

Continue reading Scanning s3 buckets, (Mon, Mar 6th)→