Author Archives: SANS Internet Storm Center, InfoCON: green

Reader Bob submitted a malicious Word document.

Continue reading Analyzing a Phishing Word Document, (Sun, Apr 24th)→

I have noticed in the past several weeks random scans specifically for Roku streaming devices (and likely other types) captured by my honeypot. If they can be compromised, what can be gain? Settings like stored payment information, personal information (email/password), subscription, App selected, etc. Like any other devices, it is important to keep the OS and Apps up-to-date.

Continue reading Are Roku Streaming Devices Safe from Exploitation?, (Sat, Apr 23rd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, April 22nd, 2022 https://isc.sans.edu/podcastdetail.html?id=7976, (Fri, Apr 22nd)→

Last week, I was in Amsterdam to attend the FIRST TC 2022 where I talked about Python used for malicious purposes in the Windows ecosystem&#;x26;#;x5b;1&#;x26;#;x5d;. Amongst multiple examples,&#;x26;#;xc2;&#;x26;#;xa0;I mentioned a sample of Python code that tries to steal cryptocurrencies. It&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x99;s not the first time that I found a piece of code that monitors the clipboard and swap the BTC address found with the attacker&#;x26;#;39;s one. This time, the script that I found supports a lot of cryptocurrencies!

Continue reading Multi-Cryptocurrency Clipboard Swapper, (Thu, Apr 21st)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, April 21st, 2022 https://isc.sans.edu/podcastdetail.html?id=7974, (Thu, Apr 21st)→

Chain of Events

Continue reading “aa” distribution Qakbot (Qbot) infection with DarkVNC traffic, (Wed, Apr 20th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, April 20th, 2022 https://isc.sans.edu/podcastdetail.html?id=7972, (Wed, Apr 20th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, April 20th, 2022 https://isc.sans.edu/podcastdetail.html?id=7972, (Wed, Apr 20th)→

Recently, I went shopping on eBay again. While I do not recommend using used equipment from eBay for production, surplus equipment can be a great opportunity to supplement a home lab. This time, I picked up a Netoptics Director including inline modules for about $100. Overall a pretty nice deal. Of course, equipment like this usually comes with no warranty, and vendor support can be spotty in particular as Netoptics now only exists as a part of IXIA and IXIA has been purchased by Keysight. I am not sure how long ago the Director line of equipment went “EOL” and was only able to find manuals on 3rd party websites. But making equipment like that work is part of the fun.

Continue reading Resetting Linux Passwords with U-Boot Bootloaders, (Tue, Apr 19th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, April 19th, 2022 https://isc.sans.edu/podcastdetail.html?id=7970, (Tue, Apr 19th)→