Is buying Cyber Insurance a Must Now?, (Sat, Mar 26th)
“Cyber attacks are organizational risks that businesses can be exposed to with just an errant click of a mouse.“[2]
Continue reading Is buying Cyber Insurance a Must Now?, (Sat, Mar 26th)
Author Archives: SANS Internet Storm Center, InfoCON: green
XLSB Files: Because Binary is Stealthier Than XML, (Fri, Mar 25th)
In one of his last diaries&#;x26;#;x5b;1&#;x26;#;x5d;, Brad mentioned an Excel sheet named with a .xlsb extension. Now, it was my turn to find one… What&#;x26;#;39;s the magic behind this file extension? “XLS” means that we are facing an Excel sheet and “B” means that we have a binary workbook file. Within the current Microsoft office files format, data are stored in XML. In this case, they are stored in binary. For Microsoft Office, to open a normal or binary file is the same… but for an attacker, the plus-value is the increased level of obfuscation! Indeed, it&#;x26;#;39;s more difficult to extract interesting information like… strings!
Continue reading XLSB Files: Because Binary is Stealthier Than XML, (Fri, Mar 25th)
ISC Stormcast For Friday, March 25th, 2022 https://isc.sans.edu/podcastdetail.html?id=7936, (Fri, Mar 25th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, March 25th, 2022 https://isc.sans.edu/podcastdetail.html?id=7936, (Fri, Mar 25th)
Malware Delivered Through Free Sharing Tool, (Thu, Mar 24th)
File sharing is a classic operation performed by many people on a daily basis. If you can share files using big players like Dropbox or all the *Drive (“One”, “Google”, etc), there exists a lot of free alternatives that help to easily share files with peers. Because, still today, many organizations do not provide an “official” (read: promoted, supported, and monitored) service, users are always looking for alternatives. There are plenty of tools available like Lufi[1] or transfer.sh[2] (they are plenty of others). The sample that I spotted yesterday was delivered through the second one.
Continue reading Malware Delivered Through Free Sharing Tool, (Thu, Mar 24th)
ISC Stormcast For Thursday, March 24th, 2022 https://isc.sans.edu/podcastdetail.html?id=7934, (Thu, Mar 24th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, March 24th, 2022 https://isc.sans.edu/podcastdetail.html?id=7934, (Thu, Mar 24th)
ISC Stormcast For Wednesday, March 23rd, 2022 https://isc.sans.edu/podcastdetail.html?id=7932, (Wed, Mar 23rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, March 23rd, 2022 https://isc.sans.edu/podcastdetail.html?id=7932, (Wed, Mar 23rd)
Arkei Variants: From Vidar to Mars Stealer, (Wed, Mar 23rd)
Statement by President Biden: What you need to do (or not do), (Tue, Mar 22nd)
Yesterday, President Biden released a statement warning of a possible escalation of cyberattacks from Russia. The statement does not offer a lot of specifics. But it does link to two valuable documents:
Continue reading Statement by President Biden: What you need to do (or not do), (Tue, Mar 22nd)
ISC Stormcast For Tuesday, March 22nd, 2022 https://isc.sans.edu/podcastdetail.html?id=7930, (Tue, Mar 22nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, March 22nd, 2022 https://isc.sans.edu/podcastdetail.html?id=7930, (Tue, Mar 22nd)
Maldoc Cleaned by Anti-Virus, (Mon, Mar 21st)
About a month ago, I received a Twitter message for an interesting maldoc sample: 0f609e43fa76afd4e2e916acb2ab54cc8fce64750ec372f716b42f34db3da0ce.
Continue reading Maldoc Cleaned by Anti-Virus, (Mon, Mar 21st)