Phishing ZIP With Malformed Filename, (Sun, Oct 24th)
The output of my zipdump.py tool analyzing diary entry “Reader Malware: ZIP/HTML Phish” ZIP file is a bit strange:
Continue reading Phishing ZIP With Malformed Filename, (Sun, Oct 24th)
Author Archives: SANS Internet Storm Center, InfoCON: green
Reader Malware: ZIP/HTML Phish, (Sat, Oct 23rd)
Reader Henry submitted a malicious email attachment: a ZIP file.
Continue reading Reader Malware: ZIP/HTML Phish, (Sat, Oct 23rd)
YARA Release v4.1.3, (Sat, Oct 23rd)
This new release of YARA is just a bug fix release.
October 2021 Contest: Forensic Challenge, (Fri, Oct 22nd)
ISC Stormcast For Friday, October 22nd, 2021 https://isc.sans.edu/podcastdetail.html?id=7724, (Fri, Oct 22nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, October 22nd, 2021 https://isc.sans.edu/podcastdetail.html?id=7724, (Fri, Oct 22nd)
ISC Stormcast For Thursday, October 21st, 2021 https://isc.sans.edu/podcastdetail.html?id=7722, (Thu, Oct 21st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, October 21st, 2021 https://isc.sans.edu/podcastdetail.html?id=7722, (Thu, Oct 21st)
“Stolen Images Evidence” campaign pushes Sliver-based malware, (Thu, Oct 21st)
Thanks to COVID-19, New Types of Documents are Lost in The Wild, (Wed, Oct 20th)
In many countries, citizens are vaccinated and authorities are now implementing new rules when you need to attend some events or travels. For example, in Brussel (BE), you must prove that you&#;x26;#;39;re completely vaccinated by showing your “COVID Safe Ticket” to go to a restaurant or a bar. The document name changes across countries but it&#;x26;#;39;s basically the same document for everybody with a QR-code.
Continue reading Thanks to COVID-19, New Types of Documents are Lost in The Wild, (Wed, Oct 20th)
ISC Stormcast For Wednesday, October 20th, 2021 https://isc.sans.edu/podcastdetail.html?id=7720, (Wed, Oct 20th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, October 20th, 2021 https://isc.sans.edu/podcastdetail.html?id=7720, (Wed, Oct 20th)
Can you make the Great Chinese Firewall work for you?, (Tue, Oct 19th)
The “Great Chinese Firewall” has been well documented for its ability to block content from reaching users in China [1][2]. The firewall is implemented using various tools, inspecting traffic for blocked keywords or, in some cases, even scanning images or outright blocking specific sites.
One persistent rumor has it that it is possible to block traffic from China by embedding blocked keywords in traffic. I wanted to test this using my home mail server. As part of the server banner, I added a few banned words:
Continue reading Can you make the Great Chinese Firewall work for you?, (Tue, Oct 19th)