Author Archives: SANS Internet Storm Center, InfoCON: green

IPv6 adoption is growing. Around 30%; of the Alexa Top 1000 websites support IPv6. Comcast, the ISP I am using, rolled out IPv6 to every customer, and according to some statistics, around 70%; are actually using it [;1];. About 35%; of traffic reaching Google uses IPv6 [;2];. I have been using IPv6 myself for probably over a decade by now. Initially via Hurricane Electric tunnels, and later as Comcast made IPv6 available, I used the allocation provided by Comcast. So why stop using it now?

Continue reading Why I Gave Up on IPv6. And no, it is not because of security issues., (Tue, Sep 7th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, September 7th, 2021 https://isc.sans.edu/podcastdetail.html?id=7660, (Tue, Sep 7th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, September 3rd, 2021 https://isc.sans.edu/podcastdetail.html?id=7658, (Fri, Sep 3rd)→

All major events in our daily life are potential sources of revenue for attackers. When elections or major sports events are organized, attackers will surf&#;x26;#;xc2;&#;x26;#;xa0;on these waves and try to make some profit or collect interesting data (credentials). It&#;x26;#;39;s the same with major&#;x26;#;xc2;&#;x26;#;xa0;meteorological phenomena. The hurricane “Ida” was the second most intense hurricane to hit the state of Louisiana on record, only behind “Katrina”[1].

Continue reading Attackers Will Always Abuse Major Events in our Lifes, (Thu, Sep 2nd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, September 2nd, 2021 https://isc.sans.edu/podcastdetail.html?id=7656, (Thu, Sep 2nd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, September 1st, 2021 https://isc.sans.edu/podcastdetail.html?id=7654, (Wed, Sep 1st)→

Introduction

Continue reading STRRAT: a Java-based RAT that doesn’t care if you have Java, (Wed, Sep 1st)→

In a previous diary entry, I had written about the increasing trend of Bluetooth vulnerabilities being reported in the recent years [1]. Today, the Automated Systems SEcuriTy (ASSET) Research Group from the Singapore University of Technology and Design (SUTD) revealed the BrakTooth family of vulnerabilities in commercial Bluetooth (BT) Classic stacks for various System-on-Chips (SoC) [2]. In this diary, I will be giving a brief background on BrakTooth, highlight affected products and also discuss next steps affected users/vendors could consider.

Continue reading BrakTooth: Impacts, Implications and Next Steps, (Tue, Aug 31st)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, August 31st, 2021 https://isc.sans.edu/podcastdetail.html?id=7652, (Tue, Aug 31st)→

Be careful if you&#;x26;#;39;re a user of cryptocurrencies. My goal is not to re-open a debate about them and their associated financial risks. No, I&#;x26;#;39;m talking here about technical risk. Wallet addresses are long strings of characters that are pretty impossible to use manually. It means that you&#;x26;#;39;ll use your clipboard to copy/paste your wallets to perform payments. But some malware monitors your clipboard for “interesting data” (like wallet addresses) and tries to replace it with another one. If you perform a payment operation, it means that you will transfer some BTC or XMR to the wrong wallet, owned by the attacker.

Continue reading Cryptocurrency Clipboard Swapper Delivered With Love , (Mon, Aug 30th)→