Collaborate Disseminate
To better detect any exploit attempts taking advantage of the recent Realtek vulnerability, I experimented with the open source VoIP server Asterisk. I just set it up, listening for inbound connections. The server had no existing accounts configured or connected to an upstream VoIP service. Using it for actual phone calls was impossible, but it would respond.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, August 17th, 2022 https://isc.sans.edu/podcastdetail.html?id=8134, (Wed, Aug 17th)
I was asked for help with this maldoc sample: 394c97cc9d567e556a357f129aea03f737cbd2a1761df32146ef69d93afc73dc.
Continue reading VBA Maldoc & UTF7 (APT-C-35), (Tue, Aug 16th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, August 16th, 2022 https://isc.sans.edu/podcastdetail.html?id=8132, (Tue, Aug 16th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, August 15th, 2022 https://isc.sans.edu/podcastdetail.html?id=8130, (Mon, Aug 15th)
On Friday, Octavio Gianatiempo &#;x26; Octavio Galland released details about a vulnerability in Realtek&#;x26;#;39;s eCos SDK. The release came as part of their talk at Defcon. Realtek patched the vulnerability they spoke about in March. But this patch may not do you much good. The vulnerability affects Realtek&#;x26;#;39;s SDK. Various vendors use this SDK as part of the equipment that uses Realtek&#;x26;#;39;s RTL819x SoCs. Affected vendors need to release patched firmware to mitigate this vulnerability. Many affected vendors have not yet released updates.
I have been seeing this form of phishing in Microsoft Office 365 for several weeks. The email comes in as an attachment like this with a phone icon preceding it:
Continue reading Phishing HTML Attachment as Voicemail Audio Transcription, (Sat, Aug 13th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, August 12th, 2022 https://isc.sans.edu/podcastdetail.html?id=8128, (Fri, Aug 12th)
If sudo[1] is a well known tool used daily by most UNIX system administrators, NSudo[2] remains less below the radar. This is a tool running on Microsoft Windows which allows you to execute processes with different access tokens and privileges like:
Continue reading InfoStealer Script Based on Curl and NSudo, (Thu, Aug 11th)