Collaborate Disseminate
Today, everything is âsmartâ or âintelligentâ. We have smartphones, smart cars, smart doorbells, etc. Being “smart” means performing actions depending on the context, the environment, or user actions.
Continue reading A Backdoor with Smart Screenshot Capability, (Thu, Feb 9th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, February 9th, 2023 https://isc.sans.edu/podcastdetail.html?id=8362, (Thu, Feb 9th)
Monday, I wrote about the use of IP lookup APIs by bots. It turns out that it is not just bots using these APIs, but phishing e-mails are also taking advantage of them.
Continue reading Simple HTML Phishing via Telegram Bot, (Wed, Feb 8th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, February 8th, 2023 https://isc.sans.edu/podcastdetail.html?id=8360, (Wed, Feb 8th)
The use of Bluetooth-enabled devices remains popular. New products (such as mobile phones, laptops and fitness trackers) still support this protocol and have even launched with more recent versions (e.g. Samsung S23 family of phones, iPhone 14 and 14 Pro, Apple Watch Series 8/SE/Ultra all shipped with Bluetooth 5.3). I had previously written about surveying the trend of Bluetooth vulnerabilities back in 2021 [1]. As roughly a year or so has passed, it was a timely moment to review how things may have evolved with respect to the vulnerabilities discovered. Compared to the previous diary, the current Bluetooth core specification has been bumped up to 5.3 (from 5.2 as compared to the previous diary) [2].
Continue reading A Survey of Bluetooth Vulnerabilities Trends (2023 Edition), (Tue, Feb 7th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, February 7th, 2023 https://isc.sans.edu/podcastdetail.html?id=8358, (Tue, Feb 7th)
Last night, Turkey and Syria were affected by a significant earthquake. Sadly, experience teaches us that disasters like this will often be abused. The most common scam involves fake donation websites. But you may also see malware disguised as a video or images from the affected region.
Continue reading Earthquake in Turkey and Syria: Be Aware of Possible Donation Scams, (Mon, Feb 6th)
Many of the bots I am observing attempt to detect the infected system&#;x26;#;39;s public (“WAN”) IP address. Most of these systems are assumed to be behind NAT. To detect the external IP address, these bots use various public APIs. It may be helpful to detect these requests. Many use unique host names. This will make detecting the request in DNS logs easy even if TLS is not intercepted.
Continue reading APIs Used by Bots to Detect Public IP address, (Mon, Feb 6th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, February 6th, 2023 https://isc.sans.edu/podcastdetail.html?id=8356, (Mon, Feb 6th)