CAD: .DGN and .MVBA Files, (Mon, Apr 26th)
Regularly I receive questions about MicroStation files, since I wrote a diary entry about AutoCAD drawings containing VBA code.
Author Archives: SANS Internet Storm Center, InfoCON: green
ISC Stormcast For Monday, April 26th, 2021 https://isc.sans.edu/podcastdetail.html?id=7472, (Mon, Apr 26th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, April 26th, 2021 https://isc.sans.edu/podcastdetail.html?id=7472, (Mon, Apr 26th)
Sysinternals: Procmon and Sysmon update, (Sun, Apr 25th)
New versions of Procmon and Sysmon were released.
Continue reading Sysinternals: Procmon and Sysmon update, (Sun, Apr 25th)
Wireshark 3.4.5 Released, (Sun, Apr 25th)
Wireshark version 3.4.5 was released.
Base64 Hashes Used in Web Scanning, (Sat, Apr 24th)
I have honeypot activity logs going back to May 2018 and I was curious what type of username:password combination was stored in the web traffic logs following either the Proxy-Authorization: Basic or Authorization: Basic in each logs. This graph illustrate an increase in web scanning activity for username:password over the past 3 years.
Continue reading Base64 Hashes Used in Web Scanning, (Sat, Apr 24th)
ISC Stormcast For Friday, April 23rd, 2021 https://isc.sans.edu/podcastdetail.html?id=7470, (Fri, Apr 23rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, April 23rd, 2021 https://isc.sans.edu/podcastdetail.html?id=7470, (Fri, Apr 23rd)
Malicious PowerPoint Add-On: “Small Is Beautiful”, (Fri, Apr 23rd)
Yesterday I spotted a DHL-branded phishing campaign that used a PowerPoint file to compromise the victim. The malicious attachment is a PowerPoint add-in. This technique is not new, I already analyzed such a sample in a previous diary[1]. The filename is “dhl-shipment-notification-6207428452.ppt” (SHA256:934df0be5a13def81901b075f07f3d1f141056a406204d53f2f72ae53f583341) and has a VT score of 18/60[2].
Continue reading Malicious PowerPoint Add-On: “Small Is Beautiful”, (Fri, Apr 23rd)
How Safe Are Your Docker Images?, (Thu, Apr 22nd)
Today, I don&#;x26;#;39;t know any organization that is not using Docker today. For only test and development only or to full production systems, containers are deployed everywhere! In the same way, most popular tools today have a “dockerized” version ready to use, sometimes maintained by the developers themselves, sometimes maintained by third parties. An example is the Docker container that I created with all Didier&#;x26;#;39;s tools[1]. Today, we are also facing a new threat: supply chain attacks (think about Solarwinds or, more recently, CodeCov[2]). Let&#;x26;#;39;s mix the attraction for container technologies and this threat, we realize that Docker images are a great way to compromise an organization!
Continue reading How Safe Are Your Docker Images?, (Thu, Apr 22nd)
ISC Stormcast For Thursday, April 22nd, 2021 https://isc.sans.edu/podcastdetail.html?id=7468, (Thu, Apr 22nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, April 22nd, 2021 https://isc.sans.edu/podcastdetail.html?id=7468, (Thu, Apr 22nd)
A Case for Lockdown and Isolation (and not the Covid kind), (Wed, Apr 21st)
A reader wrote in expressing concerns over a vendor software management platform that had 3rd party module vulnerabilities &#;x26;#;x5b;1&#;x26;#;x5d;. Reasonable risk assessment if you ask me. This comes along with the two “One Liners&#;x26;#;39;&#;x26;#;39; we posted yesterday &#;x26;#;x5b;2&#;x26;#;x5d; &#;x26;#;x5b;3&#;x26;#;x5d;. This sounds like a case for isolation and or lockdown. Considering 2021&#;x26;#;39;s climate, let&#;x26;#;39;s be clear here, Digital not Physical :).
Continue reading A Case for Lockdown and Isolation (and not the Covid kind), (Wed, Apr 21st)