Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, October 19th, 2021 https://isc.sans.edu/podcastdetail.html?id=7718, (Tue, Oct 19th)
Attackers have many ways to protect their C2 servers from unwanted connections. They can check some specific headers, the user-agent, the IP address location (GeoIP), etc.&#;x26;#;xc2;&#;x26;#;xa0;I spotted an interesting PowerShell sample that implements a client certificate authentication mechanism to access its C2 server. It&#;x26;#;39;s VT score is 9/56[1] (SHA256:6d3f45db0a991572a7ac8077e2fd8eec29aad99e7efa6cea5e54186ac1abc488).
Continue reading Malicious PowerShell Using Client Certificate Authentication, (Mon, Oct 18th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, October 18th, 2021 https://isc.sans.edu/podcastdetail.html?id=7716, (Mon, Oct 18th)
Johannes published a diary on this activity last week for an Apache 2.4.49 directory traversal vulnerability where the patch was made available on September 15, 2021. Apache released a new update on October 7, 2021, indicating their advisory for “Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) (CVE-2021-42013)“. The current patched version is 2.4.51.
Continue reading Apache is Actively Scan for CVE-2021-41773 & CVE-2021-42013, (Sat, Oct 16th)
I have been asked several times in recent months about addressing risks of warranty repair service of laptops/tablets. With each of these situations, the question boiled down to the same underlying issue: non-removable storage. âIt dependsâ has been my standard response, as there are many key factors to accurately framing the response. Organizational policies which defines their risk appetite and/or external regulations typically characterize what can be done.
Continue reading Warranty Repairs and Non-Removable Storage Risks, (Fri, Oct 15th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, October 15th, 2021 https://isc.sans.edu/podcastdetail.html?id=7714, (Fri, Oct 15th)
A feature that I use often is the port-forwarding capability implemented in the SSH protocol. It’s very convenient for pivoting inside a network or accessing a resource that is not directly reachable. Think about a management console that binds on the loopback interface of a server (which is good from a security point of view). How to access it remotely? SSH to the rescue!
Continue reading Port-Forwarding with Windows for the Win, (Thu, Oct 14th)
Recently, I am seeing a lot of identical failed login attempts against my mail server. Just today, about 130,000 of them. The vast majority (124k+) come from one subnet: 31.130.184.0/24
Continue reading Please fix your E-Mail Brute forcing tool!, (Wed, Oct 13th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, October 13th, 2021 https://isc.sans.edu/podcastdetail.html?id=7712, (Wed, Oct 13th)
This month we got patches for 81 vulnerabilities. Of these, 3 are critical, 3 were previously disclosed and 1 is being exploited according to Microsoft.
Continue reading Microsoft October 2021 Patch Tuesday, (Tue, Oct 12th)