Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, March 4th, 2022 https://isc.sans.edu/podcastdetail.html?id=7906, (Fri, Mar 4th)
In the last couple of days, some of our web honeypots detected scans for “LuCI,” LuCI is a user interface used by the widespread OpenWRT open-source router/firewall implementation. Scans for it are not specifically new. As with all perimeter security devices, they are significant targets, and simple vulnerabilities, as well as weak credentials, are often exploited.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, March 3rd, 2022 https://isc.sans.edu/podcastdetail.html?id=7904, (Thu, Mar 3rd)
When we think about “Cyberwar,” we often think about power stations blowing up and satellites deorbiting. So far, we have not seen much of this regarding the war in Ukraine. But as Russian troops close in on Kyiv, a “Cyberwar” plays out on social media and has a substantial impact. It can be argued that public opinion and aid for the government in Kyiv are shaped by social media posts of brave Ukrainians resisting insurmountable odds.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, March 2nd, 2022 https://isc.sans.edu/podcastdetail.html?id=7902, (Wed, Mar 2nd)
Given recent events, I&#;x26;#;39;ve gotten a flood of calls from clients who want to start blocking egress traffic to specific countries, or block ingress traffic from specific countries (or both). This seems like something the more “aware” organizations have tried quite a while back, and in many cases have tried it and given it up as not so effective. But just this last week we&#;x26;#;39;ve been seeing a flood of folks who are thinking about it as something they need to do NOW. In many cases, depending on your hardware and licensing it&#;x26;#;39;s as simple as a few tickboxes or lines in an ACL. Even freely available firewalls such as pfSense do a good job of this, using MaxMind (look at pfBlockerNG for pfSense)
Continue reading Geoblocking when you can’t Geoblock, (Tue, Mar 1st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, March 1st, 2022 https://isc.sans.edu/podcastdetail.html?id=7900, (Tue, Mar 1st)
In diary entry “TShark & jq“, I mention that a single packet can have more than one ip.src entry.
Continue reading TShark & Multiple IP Addresses, (Mon, Feb 28th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, February 28th, 2022 https://isc.sans.edu/podcastdetail.html?id=7898, (Mon, Feb 28th)
Xavier did a dynamic analysis of a malicious document with an equation editor exploit.
Continue reading Video: Quick & Dirty Shellcode Analysis – CVE-2017-11882, (Sun, Feb 27th)