SANS Internet Storm Center, InfoCON: green – Page 299

DShield Data Analysis: Taking a Look at Port 45740 Activity, (Thu, Jun 3rd)

Posted on June 3, 2021 by SANS Internet Storm Center, InfoCON: green

At the SANS Internet Storm Center (ISC), handlers frequently analyze data submitted from DShield participants to determine activity trends and potential attacks. A few days ago on May 31st, I observed a small anomaly for %%port:45740%% and decided to monitor it for the next 3 days or so. There was a huge spike in number of sources/day and reports/day recorded on May 31st as shown in Figure 1.

Continue reading DShield Data Analysis: Taking a Look at Port 45740 Activity, (Thu, Jun 3rd)→

ISC Stormcast For Thursday, June 3rd, 2021 https://isc.sans.edu/podcastdetail.html?id=7526, (Thu, Jun 3rd)

Posted on June 3, 2021 by SANS Internet Storm Center, InfoCON: green

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, June 3rd, 2021 https://isc.sans.edu/podcastdetail.html?id=7526, (Thu, Jun 3rd)→

Wireshark 3.4.6 (and 3.2.14) released, (Wed, Jun 2nd)

Posted on June 2, 2021 by SANS Internet Storm Center, InfoCON: green

A new version of wireshark is out, a couple of bugfixes including a QUIC TLK decryption issue. Also, the Windows version now comes with npcap 1.31 (updated from 1.10).

Continue reading Wireshark 3.4.6 (and 3.2.14) released, (Wed, Jun 2nd)→

ISC Stormcast For Wednesday, June 2nd, 2021 https://isc.sans.edu/podcastdetail.html?id=7524, (Wed, Jun 2nd)

Posted on June 2, 2021 by SANS Internet Storm Center, InfoCON: green

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, June 2nd, 2021 https://isc.sans.edu/podcastdetail.html?id=7524, (Wed, Jun 2nd)→

Guildma is now using Finger and Signed Binary Proxy Execution to evade defenses, (Mon, May 31st)

Posted on June 1, 2021 by SANS Internet Storm Center, InfoCON: green

Continue reading Guildma is now using Finger and Signed Binary Proxy Execution to evade defenses, (Mon, May 31st)→

ISC Stormcast For Tuesday, June 1st, 2021 https://isc.sans.edu/podcastdetail.html?id=7522, (Tue, Jun 1st)

Posted on June 1, 2021 by SANS Internet Storm Center, InfoCON: green

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, June 1st, 2021 https://isc.sans.edu/podcastdetail.html?id=7522, (Tue, Jun 1st)→

Quick and dirty Python: nmap, (Mon, May 31st)

Posted on May 31, 2021 by SANS Internet Storm Center, InfoCON: green

Continuing on from the “Quick and dirty Python: masscan” diary, which implemented a simple port scanner in Python using masscan to detect web instances on TCP ports 80 or 443. Masscan is perfectly good as a blunt instrument to quickly find open TCP ports across large address spaces, but for fine details it is better to use a scanner like nmap that, while much slower, is able to probe the port to get a better idea of what is running.

Continue reading Quick and dirty Python: nmap, (Mon, May 31st)→