Author Archives: SANS Internet Storm Center, InfoCON: green

archive.org[1], also known as the “way back machine” is a very popular Internet site that allows you to travel back in time and browse old versions of a website (like the ISC website[2]). It works like regular search engines and continuously crawls the internet via bots. But there is another way to store content on archive.org: You may create an account and upload some content by yourself.

Continue reading Malicious Content Delivered Through archive.org, (Thu, Jul 29th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, July 29th, 2021 https://isc.sans.edu/podcastdetail.html?id=7606, (Thu, Jul 29th)→

E-mails claiming that their author has recorded the recipient through a webcam while they were “in flagrante delicto” enjoying a visit to some pornographic site, and will publish the recording unless the recipient pays them, have been with us for quite a while now. Over time, these messages haven’t changed much. It is no wonder – since the “hook” they use is fairly timeless and nearly universal in nature, the same messages can be effective for a long time without any substantial modifications.

Continue reading A sextortion e-mail from…IT support?!, (Wed, Jul 28th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, July 28th, 2021 https://isc.sans.edu/podcastdetail.html?id=7604, (Wed, Jul 28th)→

Apple has released another update (previous update was only about 5 days ago) to address CVE-2021-30807 that was discovered by an anonymous researcher. This update resolves an issue with IOMobileFrameBuffer which could allow an application to execute arbitrary code with kernel privileges [1], [2]. This issue may have been actively exploited.

Continue reading Apple Patches for CVE-2021-30807, (Tue, Jul 27th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, July 27th, 2021 https://isc.sans.edu/podcastdetail.html?id=7602, (Tue, Jul 27th)→

Jan&#;x26;#;39;s diary entry “One way to fail at malspam – give recipients the wrong password for an encrypted attachment” got my attention: it&#;x26;#;39;s an opportunity for me to do some password cracking 🙂 I asked Jan for the sample.

Continue reading Failed Malspam: Recovering The Password, (Mon, Jul 26th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, July 26th, 2021 https://isc.sans.edu/podcastdetail.html?id=7600, (Mon, Jul 26th)→

Wireshark version 3.4.7 was released.

Continue reading Wireshark 3.4.7 Released, (Sun, Jul 25th)→

Phew, this was a really bad week for Microsoft (and a lot of reading for all of us). And just when we thought that the fiasco with the SAM hive was over, a new vulnerability popped up, which is much, much more dangerous unfortunately &#;xe2;&#;x80;&#;x93; it allows a user to completely take over a Windows domain that has the ADCS service running. And those are probably running in majority of enterprises.

Continue reading Active Directory Certificate Services (ADCS – PKI) domain admin vulnerability, (Sat, Jul 24th)→