Collaborate Disseminate
Apple today release updates for tvOS, Xcode, macOS (Bug Sur, Monterery and Cataline), iOS, iPadOS and WatchOS. In addition to new features, the updates patch a total of 86 vulnerabilities. One of the vulnerabilities, a privilege escalation vulnerability, is already actively exploited (%%cve:2022-222675%%).
Last night, I noticed a lot of requests to one of our honeypots for “/ocsp.srf” and “/itcom2020/ocsp.srf”. The requests all looked very similar:
Continue reading Why is my Honeypot a Russian Certificate Authority?, (Mon, May 16th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, May 16th, 2022 https://isc.sans.edu/podcastdetail.html?id=8008, (Mon, May 16th)
Reader Robert submitted a phishing email (msg file).
Continue reading Quick Analysis Of Phishing MSG, (Sat, May 14th)
We all know vulnerabilities have a lifecycle. First, they start as closely held secrets, hopefully known to the company producing the vulnerable software. After becoming publically known, there is often a “mad dash” to a public exploit. During this phase, security companies often show their skills by hinting at privately developed exploits first until the exploit is publically known. Once a public exploit is available, the next race starts among adversaries to collect the largest possible market share of vulnerable devices. In this stage, some nation-states may attempt to expand their attack network, while at the same time, kids in basements and North Korea are looking for coin mining bots. Oddly enough, they often do not patch the vulnerability, and you end up with devices being exploited repeatedly. In the end, you have the crustaceans among the attackers picking apart the crumbs or looking for web shells dropped by others. Finally, Iran and Mirai try to see if anything is left for them.
Continue reading From 0-Day to Mirai: 7 days of BIG-IP Exploits, (Fri, May 13th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, May 13th, 2022 https://isc.sans.edu/podcastdetail.html?id=8006, (Fri, May 13th)
In my last story (https://isc.sans.edu/forums/diary/Finding&#;x26;#;x2b;the&#;x26;#;x2b;Real&#;x26;#;x2b;Last&#;x26;#;x2b;Patched&#;x26;#;x2b;Day&#;x26;#;x2b;Interim&#;x26;#;x2b;Version/28610/) , I talked about pulling patch descriptions from the MS portal using Get-WebRequest.&#;x26;#;xc2;&#;x26;#;xa0; This worked great on my test machine (said every developer ever), but the next day when I tried it on a different client&#;x26;#;39;s domain, I got this error for every call of Get-WebRequest:
Continue reading When Get-WebRequest Fails You, (Thu, May 12th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, May 12th, 2022 https://isc.sans.edu/podcastdetail.html?id=8004, (Thu, May 12th)