Collaborate Disseminate
If you have been following developments on Twitter and various other security sources, by now you have undoubtedly heard about the latest vulnerability in the very popular Apache log4j library.
Continue reading RCE in log4j, Log4Shell, or how things can get bad quickly, (Fri, Dec 10th)
My hunting rules detected a niece&#;x26;#;xc2;&#;x26;#;xa0;piece of Python code. It&#;x26;#;39;s interesting to see how the code is simple, not deeply obfuscated, and with a very low VT score: 2/56![1]. I see more and more malicious Python code targeting the Windows environments. Thanks to the library ctypes[2], Python is able to use any native API calls provided by DLLs.
Continue reading Python Shellcode Injection From JSON Data, (Fri, Dec 10th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, December 10th, 2021 https://isc.sans.edu/podcastdetail.html?id=7790, (Fri, Dec 10th)
With the recent conclusion of Cyber Monday and the arrival of the Christmas season, many people would be on the lookout for great deals. Cybercriminals and organized digital crime groups are also likely to target unsuspecting users of digital platforms, especially those that have been growing in popularity due to COVID-19. I was recently alerted to a phishing Direct Message (DM) that was sent via Discord, purporting about some leftover Nitro (an additional paid subscription for Discord).
Continue reading Phishing Direct Messages via Discord, (Thu, Dec 9th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, December 9th, 2021 https://isc.sans.edu/podcastdetail.html?id=7788, (Thu, Dec 9th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, December 8th, 2021 https://isc.sans.edu/podcastdetail.html?id=7786, (Wed, Dec 8th)
I recently started experimenting with a new page to analyze our web honeypot data. This page lists all URLs not seen before. (see https://isc.sans.edu/weblogs/firstseen.html ). So far, this has been useful in finding some new or exciting data.
Continue reading Webshells, Webshells everywhere! , (Tue, Dec 7th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, December 7th, 2021 https://isc.sans.edu/podcastdetail.html?id=7784, (Tue, Dec 7th)
Out-of-band (or “OoB”)&#;x26;#;xc2;&#;x26;#;xa0;networks are usually dedicated to management tasks. Many security appliances and&#;x26;#;xc2;&#;x26;#;xa0;servers have dedicated management interfaces that are used to set up, control, and monitor the device. A best practice is to connect those management interfaces to a dedicated network that is not directly connected to the network used to carry applications/users&#;x26;#;39; data. If a physically separated network is always best, a dedicated VLAN could do the job in most cases (if properly configured). What we typically find on OoB networks are:
Continue reading The Importance of Out-of-Band Networks, (Mon, Dec 6th)