Author Archives: SANS Internet Storm Center, InfoCON: green

Phew, this was a really bad week for Microsoft (and a lot of reading for all of us). And just when we thought that the fiasco with the SAM hive was over, a new vulnerability popped up, which is much, much more dangerous unfortunately &#;xe2;&#;x80;&#;x93; it allows a user to completely take over a Windows domain that has the ADCS service running. And those are probably running in majority of enterprises.

Continue reading Active Directory Certificate Services (ADCS – PKI) domain admin vulnerability, (Sat, Jul 24th)→

A few days ago, I found an interesting file delivered by email (why change a winning combination?). The file has a nice extension: “.daa” (Direct Access Archive). We already reported such files in 2019 and Didier wrote a diary[1] about them. Default Windows installation, can’t process “.daa” files, you need a specific tool to open them (like PowerISO). I converted the archive into an ISO file and extracted the PE file inside it.

Continue reading Agent.Tesla Dropped via a .daa Image and Talking to Telegram, (Sat, Jul 24th)→

Today&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x99;s diary revisits hunting for dodgy domains via Hurricane Electric&#;x26;#;39;s BGP Toolkit [1]. This was previously done in an earlier diary [2], and I plan to do this occasionally to share potential or identified threats so that readers can be aware of them.

Continue reading Uncovering Shenanigans in an IP Address Block via Hurricane Electric’s BGP Toolkit (II), (Fri, Jul 23rd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, July 23rd, 2021 https://isc.sans.edu/podcastdetail.html?id=7598, (Fri, Jul 23rd)→

As we already got a number of notes from readers: Currently, Akamai&#;x26;#;39;s DNS service appears to experience an outage that affects numerous other large websites.

Continue reading Lost in the Cloud: Akamai DNS Outage, (Thu, Jul 22nd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, July 22nd, 2021 https://isc.sans.edu/podcastdetail.html?id=7596, (Thu, Jul 22nd)→

[UPDATE] Microsoft updated its article late yesterday (Wed July 21st). It now includes a list of vulnerable systems. Most notably, Windows Server, version 20H2 (Server Core Installation) and Windows Server, version 2004 (Server Core installation), Window Server 2019 (Server Core Installation, and “not Core). are affected. Earlier notes did not include any server operating systems.

Continue reading “Summer of SAM”: Microsoft Releases Guidance for CVE-2021-36934, (Wed, Jul 21st)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, July 21st, 2021 https://isc.sans.edu/podcastdetail.html?id=7594, (Wed, Jul 21st)→

If you opened Twitter today you were probably flooded with news about the latest security issue with Windows. For those that have ISC as their home page (yay!) the issue is the following: apparently starting with Windows 10 1809 (hey, that’s a version from 2018) Microsoft messed up permissions on the SAM and SYSTEM hives which became readable for any user on the system.

Continue reading Summer of SAM – incorrect permissions on Windows 10/11 hives, (Tue, Jul 20th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, July 20th, 2021 https://isc.sans.edu/podcastdetail.html?id=7592, (Tue, Jul 20th)→