Author Archives: SANS Internet Storm Center, InfoCON: green

Here is an example of a simple but effective blocklist system that I&#;x26;#;39;m using on my pfSense firewalls. pfSense is a very modular firewall that can be expanded with many packages. About blocklists, there is a well-known one called pfBlocklist. Personally, I prefer to avoid installing extra packages on my firewalls because it increases the risk to face potential problems while upgrading (pfSense recommends to disable them before any upgrade). Some packages might also be developed by 3rd parties that have a light security mindset and, therefore, introduce bugs in a core element of the infrastructure.

Continue reading Simple Blocklisting with MISP & pfSense , (Thu, Jul 23rd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, July 23rd 2020 https://isc.sans.edu/podcastdetail.html?id=7092, (Thu, Jul 23rd)→

I know I am a bit late to the game, but a couple of weeks ago I responded to an incident resulting from an F5 compromise related to CVE-2020-5092. As I responded I captured a number if indicators of compromise. While I have not had a lot of time to dig into them, hopefully they will be of use to somebody.

Continue reading A few IoCs related to CVE-2020-5092, (Wed, Jul 22nd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, July 22nd 2020 https://isc.sans.edu/podcastdetail.html?id=7090, (Wed, Jul 22nd)→

It is nothing new that Covid-19 forced many organizations around the world to quickly adopt the “work from home†model, which in turn resulted in an increased number of machines offering remote access services and protocols accessible from the internet[1,2].

Continue reading Couple of interesting Covid-19 related stats, (Tue, Jul 21st)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, July 21st 2020 https://isc.sans.edu/podcastdetail.html?id=7088, (Tue, Jul 21st)→

Even though the Sextortion emails which began in the July of&#;x26;#;xc2;&#;x26;#;xa0;2018 are old news, and old hat, I am still tracking the BTC Addresses that were holding the money from the successful transactions.&#;x26;#;xc2;&#;x26;#;xa0; For those of you who don&#;x26;#;39;t want to know the end&#;x26;#;xc2;&#;x26;#;xa0;before reading the rest of the novel, here are the earlier diaries in this thread.

Continue reading Sextortion Update: The Final Final Chapter, (Mon, Jul 20th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, July 20th 2020 https://isc.sans.edu/podcastdetail.html?id=7086, (Mon, Jul 20th)→

In the past 36 hours, an increase in scanning activity to exploit and compromise ZeroShell Linux router began. This router software had several unauthenticated remote code execution released in the past several years, the last one was CVE-2019-12725. The router latest software version can be dowloaded here.

Continue reading Scanning Activity for ZeroShell Unauthenticated Access, (Sun, Jul 19th)→

In diary entry “Sysmon and Alternate Data Streams“, we reported that Sysmon records the content of small Alternate Data Streams (containing text) in the event log.

Continue reading Zone.Identifier: A Coupe Of Observations, (Sat, Jul 18th)→