Collaborate Disseminate
This week I discovered a CyberChef operation I didn&#;x26;#;39;t know existed, but I&#;x26;#;39;m quite familiar with the algorythm: “Microsoft Script Decoder” (it&#;x26;#;39;s been there at least since 2017).
Continue reading Quickie: CyberChef & Microsoft Script Decoding, (Sat, Oct 29th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, October 28th, 2022 https://isc.sans.edu/podcastdetail.html?id=8234, (Fri, Oct 28th)
Some here may still remember Heartbleed. Heartbleed was a critical OpenSSL vulnerability that surprised many organizations, and patching the issue was a major undertaking. Heartbleed caused OpenSSL and other open-source projects to rethink how they address security issues and communicate with their users. OpenSSL started to pre-announce any security updates about a week ahead of time.
Continue reading Upcoming Critical OpenSSL Vulnerability: What will be Affected?, (Thu, Oct 27th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, October 27th, 2022 https://isc.sans.edu/podcastdetail.html?id=8232, (Thu, Oct 27th)
My cat, Gluon, is having a problem. Last year, a new cat, Einstein, invaded her property, and since then, she has no longer ventured outside after some unfortunate encounters with Einstein. Gluon now spends most of her time inside doing cat stuff like grooming and sleeping; unfortunately, she has gained an unhealthy amount of weight. To help, we got her an automated cat feeder to better control her food intake. The cat feeder is sporting not just the obligatory WiFi and Cloud/App connectivity but also a camera, so it was immediately moved to our “IoT” network.
Continue reading Why is My Cat Using Baidu? And Other IoT DNS Oddities, (Wed, Oct 26th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, October 26th, 2022 https://isc.sans.edu/podcastdetail.html?id=8230, (Wed, Oct 26th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, October 25th, 2022 https://isc.sans.edu/podcastdetail.html?id=8228, (Tue, Oct 25th)
A quick summary of Apple&#;x26;#;39;s pretty massive patch day today. With the release of a new version of macOS, and updates for all operating systems Apple publishes, we got a total of 106 vulnerabilities. As before with Apple, the rating (critical/important) is our own and not based on a CVSS score, as Apple publishes non. I typically rate privilege escalation, like flaws, as important and code execution flaws as critical. Let me know if you disagree with the rating. “other” just means that I didn&#;x26;#;39;t get around to rate the particular issue or that it affects multiple vulnerabilities.
Continue reading Apple Patches Everything: October 2022 Edition, (Tue, Oct 25th)
Most malware implements communication with their C2 server over HTTP(S). Why? Just because it works! But they are multiple ways to implement C2 communications: DNS, P2P, Layer 7 (Twitter), … Another one that has become less popular with time is SMTP (email communications). I spotted a malicious Python script that exchanges information with its C2 server through emails.
Continue reading C2 Communications Through outlook.com, (Mon, Oct 24th)