Look Alike Accounts Used in Ukraine Donation Scam impersonating Olena Zelenska, (Mon, Mar 14th)
Earlier, I saw the following account being flagged on Twitter:
Author Archives: SANS Internet Storm Center, InfoCON: green
Apple Updates Everything: MacOS 12.3, XCode 13.3, tvOS 15.4, watchOS 8.5, iPadOS 15.4 and more, (Mon, Mar 14th)
Apple today released one of its massive “surprise” updates for all of its operating systems. This includes updates for Safari as well as stand-alone security updates for older operating systems like macOS Big Sur and Catalina. As so often, this also includes feature updates for the respective operating systems.
Curl on Windows, (Mon, Mar 14th)
It&#;x26;#;39;s about 2 years ago that Xavier wrote a diary entry (“Keep an Eye on Command-Line Browsers“) mentioning that curl was now build into Windows.
ISC Stormcast For Monday, March 14th, 2022 https://isc.sans.edu/podcastdetail.html?id=7918, (Mon, Mar 14th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, March 14th, 2022 https://isc.sans.edu/podcastdetail.html?id=7918, (Mon, Mar 14th)
YARA 4.2.0 Released, (Sun, Mar 13th)
YARA 4.2.0 is released. It includes many updates and fixes. Inlcuding the console module we wrote about for the release candidate.
ICMP Messages: Original Datagram Field, (Sat, Mar 12th)
I received a couple of private messages regarding my diary entry “TShark & Multiple IP Addresses” and video “Video: TShark & Multiple IP Addresses“.
Continue reading ICMP Messages: Original Datagram Field, (Sat, Mar 12th)
ICMP Messages: Original Datagram Field, (Sat, Mar 12th)
I received a couple of private messages regarding my diary entry “TShark & Multiple IP Addresses” and video “Video: TShark & Multiple IP Addresses“.
Continue reading ICMP Messages: Original Datagram Field, (Sat, Mar 12th)
Keep an Eye on WebSockets, (Fri, Mar 11th)
It has been a while that I did not spot WebSockets used by malware. Yesterday I discovered an interesting piece of Powershell. Very small and almost undetected according to its Virustotal score (2/54)&#;x26;#;x5b;1&#;x26;#;x5d;. A quick reminder for those that don&#;x26;#;39;t know what a “WebSocket” is. When you perform a classic HTTP request to a server, it replies with some data and closes the connection. WebSockets make the client/server push messages at any time without any relation to a previous request. Compared to HTTP, they allow bi-directional protocols, full-duplex and, over a single TCP connection.
ISC Stormcast For Friday, March 11th, 2022 https://isc.sans.edu/podcastdetail.html?id=7916, (Fri, Mar 11th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, March 11th, 2022 https://isc.sans.edu/podcastdetail.html?id=7916, (Fri, Mar 11th)
Credentials Leaks on VirusTotal, (Thu, Mar 10th)
A few weeks ago, researchers published some information about stolen credentials that were posted on Virustotal[1]. I’m keeping an eye on VT for my customers and searching for data related to them. For example, I looking for their domain name(s) inside files posted on VT. I may confirm what researchers said, there are a lot of passwords leaks shared on VTI but yesterday, there was a peak of files uploaded on this platform.
Continue reading Credentials Leaks on VirusTotal, (Thu, Mar 10th)