Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, June 10th, 2021 https://isc.sans.edu/podcastdetail.html?id=7536, (Thu, Jun 10th)
In my last diary, we went over the impact of different Base encodings on the ability of anti-malware tools to detect malicious code[1]. Since results of our tests showed (among other things) that AV tools in general still struggle significantly more with detecting 64-bit malicious code then 32-bit malicious code, I thought it might be interesting to discuss another factor that might impact the ability of AVs to detect malware â specifically the choice of a compiler.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, June 9th, 2021 https://isc.sans.edu/podcastdetail.html?id=7534, (Wed, Jun 9th)
This month we got patches for 50 vulnerabilities. Of these, 5 are critical, 2 were previously disclosed and 6 is already being exploited according to Microsoft.
Continue reading Microsoft June 2021 Patch Tuesday, (Tue, Jun 8th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, June 8th, 2021 https://isc.sans.edu/podcastdetail.html?id=7532, (Tue, Jun 8th)
Later this week (tomorrow?), Amazon will enable its new Sidewalk feature. The feature has already gotten a lot of bad press. Much of this comes from the fact that existing devices are automatically used as Sidewalk Gateways, and users will have to opt out. New devices may require a specific opt-in during setup.
Continue reading Amazon Sidewalk: Cutting Through the Hype, (Mon, Jun 7th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, June 7th, 2021 https://isc.sans.edu/podcastdetail.html?id=7530, (Mon, Jun 7th)
Similar to Yee Ching&#;x26;#;39;s diary on Thursday, I noticed an oddity in the Dshield data last weekend (which I had hoped to discuss in a diary on Wednesday, but life got in the way) and thought it was worth asking around to see if anyone knows what is going on. As soon as I saw it, I reconfigured my honeypots to try to capture the traffic, but wasn&#;x26;#;39;t able to. I&#;x26;#;39;m always very interested when I see some of the legacy ports and protocols pop up. In this case, %%port:37%% is the time protocol which operates on both TCP and UDP and is one of the many services that frequently ran on the low ports of Unix machines I administered back in the 1980s and 1990s. In recent years, most operating systems have disabled these services since they only seemed to be used for DDoS purposes. On Thursday, I took another look at the graph.
Continue reading Strange goings on with port 37, (Thu, Jun 3rd)
We received an interesting sample from one of our readers (thanks Henry&#;x26;#;x21;) and we like this. If you find something interesting, we are always looking for fresh meat&#;x26;#;x21; Henry&#;x26;#;39;s sample was delivered in a password-protected ZIP archive and the file was a VBS script called “presentation_37142.vbs” (SHA256:2def8f350b1e7fc9a45669bc5f2c6e0679e901aac233eac63550268034942d9f). I uploaded a copy of the file on MalwareBazaar[1].
Continue reading Russian Dolls VBS Obfuscation, (Fri, Jun 4th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, June 4th, 2021 https://isc.sans.edu/podcastdetail.html?id=7528, (Fri, Jun 4th)