Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, April 12th, 2022 https://isc.sans.edu/podcastdetail.html?id=7960, (Tue, Apr 12th)
Our “First Seen URL” page did show attempts to access&#;x26;#;xc2;&#;x26;#;xa0;/actuator/gateway/routes this weekend. So I dug in a bit deeper to see what these scans are all about. The scans originate from &#;x26;#;x25;&#;x26;#;x25;ip:45.155.204.146&#;x26;#;x25;&#;x26;#;x25; and have been going on for a few days already, but our first-seen list doesn&#;x26;#;39;t display them until they hit a threshold to consider the scans significant. We also see scans from a couple of our IPs, but at a much lower level.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, April 11th, 2022 https://isc.sans.edu/podcastdetail.html?id=7958, (Mon, Apr 11th)
I recorded a video for yesterday&#;x26;#;39;s diary tentry “Method For String Extraction Filtering“.
Continue reading Video: Method For String Extraction Filtering, (Sun, Apr 10th)
In diary entry “XLSB Files: Because Binary is Stealthier Than XML“, Xavier shows how to extract strings (URLs) from binary files that make up an Excel spreadsheet.
Continue reading Method For String Extraction Filtering, (Sat, Apr 9th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, April 8th, 2022 https://isc.sans.edu/podcastdetail.html?id=7956, (Fri, Apr 8th)
Earlier this week, I talked about how Phishing is still a huge problem and how compromised WordPress installs and free file hosting services are abused. But the root cause why Phishing works is more “human”: Phishing works because it is hard to figure out if an email or a website is authentic. Over the years, many technical solutions have been implemented to make it easier to recognize valid senders or a valid website. TLS helps, but not if the attacker comes up with a decent look-alike domain or can obscure the hostname with lengthy prefixes. DKIM and SPF help, but they again do nothing against look-alike domains.
Continue reading What is BIMI and how is it supposed to help with Phishing., (Thu, Apr 7th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, April 7th, 2022 https://isc.sans.edu/podcastdetail.html?id=7954, (Thu, Apr 7th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, April 6th, 2022 https://isc.sans.edu/podcastdetail.html?id=7952, (Wed, Apr 6th)
Looking through my honeypot logs for some Spring4Shell exploits (I didn&#;x26;#;39;t find anything interesting), I came across this attempt to exploit an older WebLogic vulnerability (likely %%cve:2020-14882%% or %%cve:2020-14883%%). The exploit itself is “run of the mill,” but the script downloaded is going through an excessively long list of competitors to disable and disabled cloud monitoring tools, likely to make detecting and response more difficult. Many organizations will not notice that they do not receive any more alerts 😉