Collaborate Disseminate
I did record a video for my diary entry “Strings Analysis: VBA & Excel4 Maldoc“, showing how to use CyberChef to analyze a maldoc.
Continue reading Video: Strings Analysis: VBA & Excel4 Maldoc, (Sat, Sep 25th)
Malware analysis is difficult.
Continue reading 
Strings Analysis: VBA & Excel4 Maldoc, (Sat, Sep 25th)
Today, smartphones are everywhere and became our best friends for many tasks. Probably your users already access their corporate mailbox via a mobile device. If it&#;x26;#;39;s not yet the case, you probably have many requests to implement this. They are two ways to achieve this: you provide corporate devices to all users. From a risk perspective, it&#;x26;#;39;s the best solution: you select the models and control them. But it&#;x26;#;39;s very expensive and people don&#;x26;#;39;t like to carry two devices (a personal and a corporate one). Hopefully, if you use a Microsoft Exchange platform, there are ways to authorize personal devices to access corporate emails with a software component called ActiveSync[1]. ActiveSync allows deploying basic security policies like forcing the device to be locked with a password, force a minimum password length, etc. However, it&#;x26;#;39;s not a real MDM (“Mobile Device Management”).
Continue reading Keep an Eye on Your Users Mobile Devices (Simple Inventory), (Fri, Sep 24th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, September 24th, 2021 https://isc.sans.edu/podcastdetail.html?id=7686, (Fri, Sep 24th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, September 23rd, 2021 https://isc.sans.edu/podcastdetail.html?id=7684, (Thu, Sep 23rd)
Microsoft Excel supports two types of macros. The legacy format is known as âExcel4 macroâ and the new (but already used for a while) is based on VBA. We already cover both formats in many diaries[1][2]. Yesterday, I spotted an interesting sample that implements⦠both!
Continue reading Excel Recipe: Some VBA Code with a Touch of Excel4 Macro, (Thu, Sep 23rd)
A Twitter follower sent me a link to an interesting maldoc on Malware Bazaar (thanks).
Continue reading An XML-Obfuscated Office Document (CVE-2021-40444), (Wed, Sep 22nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, September 22nd, 2021 https://isc.sans.edu/podcastdetail.html?id=7682, (Wed, Sep 22nd)
One of the notable additions to iOS 15, which was officially released yesterday, is its “Private Relay” feature [;1];. Unlike a “simple” VPN, the private relay does appear to be more of a proxy service for HTTP, and it uses two hops with distinct entities to not allow one entity to become the new single-point-of-privacy-failure.
Continue reading A First Look at Apple’s iOS 15 “Private Relay” feature., (Tue, Sep 21st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, September 21st, 2021 https://isc.sans.edu/podcastdetail.html?id=7680, (Tue, Sep 21st)