Author Archives: SANS Internet Storm Center, InfoCON: green

Recently, I noticed some requests hitting our honeypots that appear to attempt to exploit jQuery-File-Upload. jQuery-File-Upload is a popular tool for implementing file uploads. It has been around for a while and has had a few vulnerabilities in the past, but nothing recent as far as I can tell [1]. Allowing users to upload files securely is tricky. And jQuery-File-Upload is tempting faith by allowing uploads into the document root. The walk-through by Kristian Bremberg explaining past jQuery-File-Upload vulnerabilities is an excellent summary of all the things that can go wrong [2].

Continue reading Attacker Scanning for jQuery-File-Upload, (Mon, May 23rd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, May 23rd, 2022 https://isc.sans.edu/podcastdetail.html?id=8018, (Mon, May 23rd)→

Yesterday, I analyzed a malicious archive for a customer. It was delivered to the mailbox of a user who, hopefully, was security-aware and reported it. The payload passed through the different security layers based on big players on the market!

Continue reading A ‘Zip Bomb’ to Bypass Security Controls & Sandboxes, (Fri, May 20th)→

Introduction

Continue reading Bumblebee Malware from TransferXL URLs, (Thu, May 19th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, May 20th, 2022 https://isc.sans.edu/podcastdetail.html?id=8016, (Fri, May 20th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, May 19th, 2022 https://isc.sans.edu/podcastdetail.html?id=8014, (Thu, May 19th)→

Cryptocurrency scams have become ubiquitous over the past few years, but from time to time, one still comes over an interesting or unusual one. And the one that recently made its way to us at the ISC certainly was interesting, as it was much more sophisticated than usual… Though, as you may see, one would not have guessed it from the less than believable initial e-mail message.

Continue reading Do you want 30 BTC? Nothing is easier (or cheaper) in this phishing campaign…, (Wed, May 18th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, May 18th, 2022 https://isc.sans.edu/podcastdetail.html?id=8012, (Wed, May 18th)→

Passwords… a so hot topic&#;x26;#;x21; Recently big players (Microsoft, Apple &#;x26; Google) announced that they would like to suppress (or, at least, reduce)&#;xc2;&#;xa0;the use of classic passwords&#;x5b;1&#;x5d;. In the meantime, they remain the most common way to authenticate users against many online services. Modern Browsers offer lightweight password management tools (“vaults”)&#;xc2;&#;xa0;that help users to save their passwords in a central repository. So they don&#;x26;#;39;t have to remember them, and they follow the golden rule that we, infosec people, are recommending for a long time: to not&#;xc2;&#;xa0;share passwords across services.&#;xc2;&#;xa0;But it is really safe?

Continue reading Use Your Browser Internal Password Vault… or Not?, (Tue, May 17th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, May 17th, 2022 https://isc.sans.edu/podcastdetail.html?id=8010, (Tue, May 17th)→