Collaborate Disseminate
A review of all inbound connection over the past 3 weeks against my honeypot shows the top 2 targeted servicesÂ; ;were no surprise; a large amount of SSH (22, 2222) activity followed by Telnet (23) which Shodan still identifies over 2.7M hosts exposed to the Internet.
Continue reading 10 Most Popular Targeted Ports in the Past 3 Weeks, (Sun, Jan 16th)
Our network of web application honeypots delivered some odd new URLs in the last 24 hrs:
Continue reading Use of Alternate Data Streams in Research Scans for index.jsp., (Fri, Jan 14th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, January 14th, 2022 https://isc.sans.edu/podcastdetail.html?id=7836, (Fri, Jan 14th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, January 13th, 2022 https://isc.sans.edu/podcastdetail.html?id=7834, (Thu, Jan 13th)
Quick summary: There has been relatively little news after the vulnerability was released. I think a couple of things are happening: (1) This is a relatively straightforward Windows patch. Unlike for example log4j, inventory is less of an issue here. Enterprises tend to have a reasonably good handle on patching Windows. (2) Just like prior http.sys vulnerabilities, this one is likely not that easy to exploit. We will see what happens and there could still be a surprise out there. So keep patching. There is one unverified exploit claim so far.
Continue reading A Quick CVE-2022-21907 FAQ, (Wed, Jan 12th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, January 12th, 2022 https://isc.sans.edu/podcastdetail.html?id=7832, (Wed, Jan 12th)
Microsoft fixed 126 different CVEs with this month&#;x26;#;39;s update (this includes the Chromium issues patched in Edge). Six of the issues were publicly disclosed, and nine are rated critical.
Continue reading Microsoft Patch Tuesday – January 2022 , (Tue, Jan 11th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, January 11th, 2022 https://isc.sans.edu/podcastdetail.html?id=7830, (Tue, Jan 11th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, January 10th, 2022 https://isc.sans.edu/podcastdetail.html?id=7828, (Mon, Jan 10th)