Multi Perimeter Device Exploit Mirai Version Hunting For Sonicwall, DLink, Cisco and more, (Tue, Jun 15th)

Vulnerable perimeter devices remain a popular target, and we do see consistent exploit attempts against them. This weekend, Guy wrote about some scans for Fortinet vulnerabilities [1], and Xavier notes that Crowdstrike observed attacks against EoL Sonicwalls [2]. Starting earlier this month, we did also observe a consistent trickle of requests looking for a relatively recent Sonicwall vulnerability:

Continue reading Multi Perimeter Device Exploit Mirai Version Hunting For Sonicwall, DLink, Cisco and more, (Tue, Jun 15th)→

Posted in Uncategorized

Update: mac-robber.py, (Sun, Jun 13th)

Almost 4 years ago, I wrote a python version of mac-robber. I use it fairly regularly at &#;x26;#;x24;dayjob. This past week, one of my co-workers was using it, but realized that it hashes large files a little too slowly. He decided to use mac-robber.py to collect the MAC times and do the hashing separately so he could limit the hashes to to files under a certain size. That sounded reasonable, so I&#;x26;#;39;ve added a switch (-s or --size). If hashing is turned on the new switch will limit the hashing to files under the given size.

Continue reading Update: mac-robber.py, (Sun, Jun 13th)→

Posted in Uncategorized

Fortinet Targeted for Unpatched SSL VPN Discovery Activity, (Sat, Jun 12th)

Over the past 60 days, I have observed scanning activity to discover FortiGate SSL VPN unpatched services. Fortinet has fixed several critical vulnerabilities in SSL VPN and web firewall this year from Remote Code Execution (RCE) to SQL Injection, Denial of Service (DoS) which impact the FortiProxy SSL VPN and FortiWeb Web Application Firewall (WAF) products [1][2]. Two weeks ago, US-CERT [4] released an alert re-iterating that APT actors are looking for Fortinet vulnerabilities to gain access to networks. Additional information to look for signs of this activity available here.

Continue reading Fortinet Targeted for Unpatched SSL VPN Discovery Activity, (Sat, Jun 12th)→

Posted in Uncategorized

Sonicwall SRA 4600 Targeted By an Old Vulnerability, (Fri, Jun 11th)

Devices and applications used to provide remote access are juicy targets. I&#;x26;#;39;ve already been involved in many ransomware cases and most of the time, the open door was an unpatched VPN device/remote access solution or weak credentials. A good example, the recent attack against the Colonial Pipeline that started with a legacy VPN profile[1].

Continue reading Sonicwall SRA 4600 Targeted By an Old Vulnerability, (Fri, Jun 11th)→

Posted in Uncategorized

Keeping an Eye on Dangerous Python Modules, (Fri, Jun 11th)

With Python getting more and more popular, especially on Microsoft Operating systems, it&#;x26;#;39;s common to find malicious Python scripts today. I already covered some of them in previous diaries[1][2]. I like this language because it is very powerful: You can automate boring tasks in a few lines. It can be used for offensive as well as defensive purposes, and… it has a lot of 3rd party “modules” or libraries that extend its capabilities. For example, if you would like to use Python for forensics purposes, you can easily access the registry and extract data:

Continue reading Keeping an Eye on Dangerous Python Modules, (Fri, Jun 11th)→

Posted in Uncategorized

Are Cookie Banners a Waste of Time or a Complete Waste of Time?, (Thu, May 20th)

Legislation, in particular in the European Union, has led to a proliferation of “Cookie Banners.” Warning banners that either ask you for blanket permission to set cookies or, in some cases, provide you with some control as to what cookies you do allow. These regulations emerged after advertisers made excessive use of HTTP Cookies to track users across different sites. But in my opinion, these measures are often implemented poorly. Changes in browsers have made cookies far less menacing than they have been in the past due to changes made in browsers. Other tracking technologies are bound to replace cookies and, in some cases, already have.

Continue reading Are Cookie Banners a Waste of Time or a Complete Waste of Time?, (Thu, May 20th)→

Posted in Uncategorized