Author Archives: SANS Internet Storm Center, InfoCON: green

It was the day (or two days actually) before Christmas when Niels Teusing published a blog post about a back door in various Zyxel products &#;x26;#;x5b;1&#;x26;#;x5d;. Niels originally found the vulnerability in Zyxel&#;x26;#;39;s USG40 security gateway, but it of course affects all Zyxel devices using the same firmware. According to Zyxel, the password was used “to deliver automatic firmware updates to connected access points through FTP” &#;x26;#;x5b;2&#;x26;#;x5d;. So in addition to using a fixed password, it appears the password was also sent in the clear over FTP.

Continue reading Scans for Zyxel Backdoors are Commencing., (Wed, Jan 6th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, January 6th, 2021 https://isc.sans.edu/podcastdetail.html?id=7316, (Wed, Jan 6th)→

[This is a guest diary by Yee Ching Tok (personal website here (https://poppopretn.com)). Feedback welcome either via comments or our contact page (https://isc.sans.edu/contact.html)]

Continue reading Netfox Detective: An Alternative Open-Source Packet Analysis Tool , (Tue, Jan 5th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, January 5th, 2021 https://isc.sans.edu/podcastdetail.html?id=7314, (Tue, Jan 5th)→

Since another year went by, I’ve decided to once again check all of the malicious files, which were caught in my e-mail quarantine during its course. Last year, when I went through the batch of files from 2019, I found couple of very large samples[1] and I wanted to see whether Iɽ find something similar in the 2020 batch.

Continue reading From a small BAT file to Mass Logger infostealer, (Mon, Jan 4th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, January 4th 2021 https://isc.sans.edu/podcastdetail.html?id=7312, (Mon, Jan 4th)→

Because of COVID, 2020 saw a major shift from working at the “office” to working at home which led to shift the attacks to the user @home. Everything points that 2020 was a year for ransomware and COVID-19 themed campaigns. Without exceptions, phishing emails have been the most prolific initial attack vector targeting organizations and home users. This will likely get worse and more disruptive this coming year.

Continue reading Protecting Home Office and Enterprise in 2021, (Sat, Jan 2nd)→

This year, for my diary entries with malware analysis, I will check each time if a malware sample can be analyzed with the strings command (or a variant). And if it does, I&#;x26;#;39;ll write-up a second analysis with the strings command.

Continue reading Strings 2021, (Fri, Jan 1st)→

Introduction

Continue reading End of Year Traffic Analysis Quiz, (Thu, Dec 31st)→

TLS 1.3 has been with us for couple of years now[1]. It has brought significant security improvements over previous TLS versions (as well as couple of slightly controversial ideas, such as the 0-RTT) and although its adoption is far from universal as of now, the number of servers which support it seems to be slowly increasing.

Continue reading TLS 1.3 is now supported by about 1 in every 5 HTTPS servers, (Wed, Dec 30th)→