VMware Security Update – https://www.vmware.com/security/advisories/VMSA-2021-0030.html, (Sat, Dec 18th)
———–
Guy Bruneau IPSS Inc.
My Handler Page
Twitter: GuyBruneau
gbruneau at isc dot sans dot edu
Author Archives: SANS Internet Storm Center, InfoCON: green
DR Automation – Using Public DNS APIs, (Fri, Dec 17th)
If you have a Disaster Recovery site (cloudy or otherwise), and your DR plan involves changing public addresses when you “declare”, you might want to consider automating your DNS changes.
Continue reading DR Automation – Using Public DNS APIs, (Fri, Dec 17th)
ISC Stormcast For Friday, December 17th, 2021 https://isc.sans.edu/podcastdetail.html?id=7800, (Fri, Dec 17th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, December 17th, 2021 https://isc.sans.edu/podcastdetail.html?id=7800, (Fri, Dec 17th)
How the “Contact Forms” campaign tricks people, (Thu, Dec 16th)
ISC Stormcast For Thursday, December 16th, 2021 https://isc.sans.edu/podcastdetail.html?id=7798, (Thu, Dec 16th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, December 16th, 2021 https://isc.sans.edu/podcastdetail.html?id=7798, (Thu, Dec 16th)
Simple but Undetected PowerShell Backdoor, (Wed, Dec 15th)
For a while, most security people agree on the fact that antivirus products are not enough for effective protection against malicious code. If they can block many threats, some of them remain undetected by classic technologies. Here is another example with a simple but effective PowerShell backdoor that I spotted yesterday. The file has been uploaded on VT (SHA256:4cd82b6cbd3e20fc8a9a0aa630d2a866d32cfb60e76b032191fda5d48720a64d) and received a score of … 0/57! [1].
Continue reading Simple but Undetected PowerShell Backdoor, (Wed, Dec 15th)
ISC Stormcast For Wednesday, December 15th, 2021 https://isc.sans.edu/podcastdetail.html?id=7796, (Wed, Dec 15th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, December 15th, 2021 https://isc.sans.edu/podcastdetail.html?id=7796, (Wed, Dec 15th)
Log4j 2.15.0 and previously suggested mitigations may not be enough, (Tue, Dec 14th)
Microsoft December 2021 Patch Tuesday, (Tue, Dec 14th)
Amidst the unfolding of the Log4Shell vulnerability, more updates have just arrived with Decembers&#;x26;#;39; Microsoft Patch Tuesday. This month we got patches for 83 vulnerabilities. Of these, 7 are critical, 6 were previously disclosed and 1 is being exploited according to Microsoft.
Continue reading Microsoft December 2021 Patch Tuesday, (Tue, Dec 14th)
Log4j: Getting ready for the long haul (CVE-2021-44228), (Tue, Dec 14th)
Friday (Dec. 10th), we moved our Infocon to “Yellow” for the first time in about two years. We saw an immediate need to get the word out as the log4shell vulnerability ( %%cve:2021-44228%%) was actively exploited and affected various widely used products. Patches and workarounds were not readily available at the time. Our Infocon indicates “change,” not “steady-state.” By now, everybody in infosec knows about log4shell. This morning I noticed that even cnn.com had log4j/log4shell mentioned at the top of the page. Once CNN covers an infosec topic like this: It should be old news for anybody “in the field.”
Continue reading Log4j: Getting ready for the long haul (CVE-2021-44228), (Tue, Dec 14th)