Collaborate Disseminate
Microsoft today released patches for CVE-2021-34527, the vulnerability also known as “printnightmare.” Patches are now available for all affected versions of Windows (as long as they are still supported). Applying the update will also patch the older CVE-2021-1675 vulnerability.
Continue reading Microsoft Releases Patches for CVE-2021-34527, (Wed, Jul 7th)
They are many security tools that inject DLL into processes running on a Windows system. The classic examples are anti-virus products. They like to inject plenty of code that, combined with API hooking, implements security checks. If DLLs are injected into processes, they can be detected and it&#;x26;#;39;s a common anti-debugging or evasion technique implemented by many malware samples. If you&#;x26;#;39;re interested in such techniques, they are covered in the FOR610[1] training. The detection relies on a specific API call GetModuleFileName()[2]. The function expects the following parameters: A handle (pointer) to a process and the name of the DLL to check. Malware samples list all running processes, get a handle on them, and search for interesting DLL names. To get the handle, the OpenProcess()[3] API call must use the following access flag (0x0410 – PROCESS_VM_READ|PROCESS_QUERY_INFORMATION).
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, July 6th, 2021 https://isc.sans.edu/podcastdetail.html?id=7572, (Tue, Jul 6th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, July 5th, 2021 https://isc.sans.edu/podcastdetail.html?id=7570, (Sun, Jul 4th)
Thanks a lot to all of you who posted a comment on my diary entry “DIY CD/DVD Destruction“. They inspired me to try out some other methods.
Continue reading DIY CD/DVD Destruction – Follow Up, (Sun, Jul 4th)
In diary entry “CFBF Files Strings Analysis” I show how to extract strings from CFBF/ole files with my tool oledump.py.
Continue reading Finding Strings With oledump.py, (Sat, Jul 3rd)
We are aware that some MSSP&#;x26;#;39;s customers (Managed Security Services Providers) have been hit by a ransomware. It seems that four(4) MSSP&#;x26;#;39;s have been affected until now. The ransomware was spread through the remote management solution “VSA” provided by Kaseya[1]. This looks to be a brand new type of supply chain attack.
Continue reading Kaseya VSA Users Hit by Ransomware, (Fri, Jul 2nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, July 2nd, 2021 https://isc.sans.edu/podcastdetail.html?id=7568, (Fri, Jul 2nd)
“Inception” is a very nice SF movie in which, if you did not watch it,&#;x26;#;xc2;&#;x26;#;xa0;dreams are implemented in people&#;x26;#;39;s minds to help to get access to sensitive information from their memory. Then,&#;x26;#;xc2;&#;x26;#;xa0;a dream is implemented into another dream, etc… up to five levels[1]!&#;x26;#;xc2;&#;x26;#;xa0;If you are not paying attention to the movie, you can be quickly lost.&#;x26;#;xc2;&#;x26;#;xa0;
Continue reading “inception.py”… Multiple Base64 Encodings, (Fri, Jul 2nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, July 1st, 2021 https://isc.sans.edu/podcastdetail.html?id=7566, (Thu, Jul 1st)