Author Archives: SANS Internet Storm Center, InfoCON: green
Qakbot in a response to Full Disclosure post, (Tue, Feb 23rd)
Given its history, the Full Disclosure mailing list[1] is probably one of the best-known places on the internet where information about newly discovered vulnerabilities is may be published in a completely open way. If one wishes to inform the wider security community about a vulnerability one found in any piece of software, one only has to submit a post and after it is evaluated by the moderators, the information will be published to the list. Whatever your own thoughts on the issues of full or limited disclosure might be, the list can be an interesting source of information.
Continue reading Qakbot in a response to Full Disclosure post, (Tue, Feb 23rd)
ISC Stormcast For Tuesday, February 23rd, 2021 https://isc.sans.edu/podcastdetail.html?id=7384, (Tue, Feb 23rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, February 23rd, 2021 https://isc.sans.edu/podcastdetail.html?id=7384, (Tue, Feb 23rd)
Unprotecting Malicious Documents For Inspection, (Mon, Feb 22nd)
I wanted to take a look at Brad&#;x26;#;39;s malicious spreadsheet, using Excel inside a VM.
Continue reading Unprotecting Malicious Documents For Inspection, (Mon, Feb 22nd)
ISC Stormcast For Monday, February 22nd, 2021 https://isc.sans.edu/podcastdetail.html?id=7382, (Mon, Feb 22nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, February 22nd, 2021 https://isc.sans.edu/podcastdetail.html?id=7382, (Mon, Feb 22nd)
DDE and oledump, (Sun, Feb 21st)
I was asked if the DDE YARA rules I created work with oledump.py on the sample that Xavier wrote about in his diary entry “Dynamic Data Exchange (DDE) is Back in the Wild?“.
Quickie: Extracting HTTP URLs With tshark, (Sat, Feb 20th)
After I posted diary entry “Quickie: tshark & Malware Analysis“, someone asked me how to extract HTTP URLs from capture files with tshark.
Continue reading Quickie: Extracting HTTP URLs With tshark, (Sat, Feb 20th)
Dynamic Data Exchange (DDE) is Back in the Wild?, (Fri, Feb 19th)
DDE or “Dynamic Data Exchange” is&#;x26;#;xc2;&#;x26;#;xa0;a Microsoft technology for&#;x26;#;xc2;&#;x26;#;xa0;interprocess communication&#;x26;#;xc2;&#;x26;#;xa0;used in early versions of&#;x26;#;xc2;&#;x26;#;xa0;Windows&#;x26;#;xc2;&#;x26;#;xa0;and&#;x26;#;xc2;&#;x26;#;xa0;OS/2. DDE allows programs to manipulate objects provided by other programs, and respond to user actions affecting those objects. FOr a while, DDE was partially replaced by&#;x26;#;xc2;&#;x26;#;xa0;Object Linking and&#;x26;#;xc2;&#;x26;#;xa0;Embedding&#;x26;#;xc2;&#;x26;#;xa0;(OLE) but it&#;x26;#;39;s still available in the latest versions of the Microsoft operating system for backward compatibility reasons[1]. If fashion is known to be&#;x26;#;xc2;&#;x26;#;xa0;in a state of perpetual renewal, we could say the same in the cybersecurity landscape. Yesterday, I spotted a malicious Word document that abused this DDE technology.
Continue reading Dynamic Data Exchange (DDE) is Back in the Wild?, (Fri, Feb 19th)
ISC Stormcast For Friday, February 19th, 2021 https://isc.sans.edu/podcastdetail.html?id=7380, (Fri, Feb 19th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, February 19th, 2021 https://isc.sans.edu/podcastdetail.html?id=7380, (Fri, Feb 19th)
ISC Stormcast For Thursday, February 18th, 2021 https://isc.sans.edu/podcastdetail.html?id=7378, (Thu, Feb 18th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, February 18th, 2021 https://isc.sans.edu/podcastdetail.html?id=7378, (Thu, Feb 18th)