Author Archives: SANS Internet Storm Center, InfoCON: green

Traditionally, I consider the Thanksgiving weekend of 2000 the “Birthday” of DShield. I coded the first version of DShield over that weekend and made it public soon after. My records aren&#;x26;#;39;t that great, but here is an early screenshot of DShield.org courtesy of archive.org. There are a couple earlier once, but they are a bit too embarassing to post here :). What is now the Internet Storm Center was known as incidents.org back then.

Continue reading Happy 22nd Birthday DShield.org!, (Fri, Nov 25th)→

Phishing campaigns are very common today, we receive many phishing attempts per day. Why attackers are still flooding our mailboxes with such emails? Because it sill works, and the “return on investment” of sending millions is reached even if only a few victims are lured. However, attackers are always looking for new techniques to make people confident that the message is legit. Many phishing campaigns are pretty well prepared, and the fake mail you receive looks exactly like an official one. Multiple times, I was pretty close to click on a link… Yes, we are all poor humans!

Continue reading Attackers Keep Phishing Victims Under Stress, (Thu, Nov 24th)→

Enjoy the second episode of Packet Tuesday. Staying with DNS for this episode (don&#;x26;#;39;t worry: Episode 3 will not be about DNS)

Continue reading Packet Tuesday: Episode 2 – Extended DNS Option Type 0 , (Tue, Nov 22nd)→

Almost one year later, Log4Shell attacks are still alive and making victims. Log4shell, as you may remember, was the name given to a remote code execution (RCE) vulnerability in the Apache Log4j Java library, first known on December 10^th, 2021.  Information on the zero-day (CVE-2021-44228) and malicious campaigns using it were covered here in SANS ISC in different diaries like here and here.

Continue reading Log4Shell campaigns are using Nashorn to get reverse shell on victim’s machines, (Mon, Nov 21st)→

Yesterday I received this email that my McAfee antivirus subscription is expired and that my computer is already infected with 5 viruses (how do they know?). The overall content of this email is simple and direct to the point and is similar to something Xavier posted earlier this year [1].

Continue reading McAfee Fake Antivirus Phishing Campaign is Back!, (Sat, Nov 19th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, November 18th, 2022 https://isc.sans.edu/podcastdetail.html?id=8264, (Fri, Nov 18th)→

A famous XKCD cartoon talks about the importance of the often taken for granted “8.8.8.8” Google DNS server. Like many, I use it often as a quick connectivity check. 8.8.8.8 is an anycast address that exists many times around the globe. I also started to use it for automatic failover on my OPNSense firewall/router.

Continue reading Lessons Learned from Automatic Failover: When 8.8.8.8 “disappears”. IPv6 to the Rescue?, (Thu, Nov 17th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, November 17th, 2022 https://isc.sans.edu/podcastdetail.html?id=8262, (Thu, Nov 17th)→

[This is a guest diary submitted by Gebhard. For feedback, you can connect with Gebhard via our DShield slack]

Continue reading Evil Maid Attacks – Remediation for the Cheap, (Wed, Nov 16th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, November 16th, 2022 https://isc.sans.edu/podcastdetail.html?id=8260, (Wed, Nov 16th)→