Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, July 13th 2020 https://isc.sans.edu/podcastdetail.html?id=7076, (Mon, Jul 13th)
An anonymous reader asked if the malicious document Brad discussed in his latest diary entry, was “purged”. VBA purging means that the compiled VBA code (PerformanceCache) is missing.
Continue reading Maldoc: VBA Purging Example, (Sun, Jul 12th)
In the past 45 days, I noticed a surge of activity in my honeypot logs for home router exploitation. This is a summary of the various hosts and IP addresses with potential exploit packages available for download. What is also interesting is the fact that most URL were only IP based, no hostname associated with them. Some of the URL were improperly configured, they still contained the default private IP and a few other contained: YOURIPHERE.
Continue reading Scanning Home Internet Facing Devices to Exploit, (Sat, Jul 11th)
———–
Guy Bruneau IPSS Inc.
My Handler Page
Twitter: GuyBruneau
gbruneau at isc dot sans dot edu
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, July 10th 2020 https://isc.sans.edu/podcastdetail.html?id=7074, (Fri, Jul 10th)
I just can&#;x26;#;39;t get away from vulnerabilities in perimeter security devices. In the last couple of days, I spent a lot of time with our F5 BigIP honeypot. But looks like I have to revive the Citrix honeypot again. As of today, my F5 honeypot is getting hit by attempts to exploit two of the Citrix vulnerabilities disclosed this week [1]. Details with proof of concept code snippets were released yesterday [2].
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, July 9th 2020 https://isc.sans.edu/podcastdetail.html?id=7072, (Thu, Jul 9th)
I&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x99;m teaching FOR610&#;x26;#;x5b;1&#;x26;#;x5d; this week and today&#;x26;#;xc2;&#;x26;#;xa0;is dedicated to malicious web and document files. That&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x99;s a good opportunity to share with you a Windows Script that uses a nice obfuscation technique. The attacker&#;x26;#;39;s&#;x26;#;xc2;&#;x26;#;xa0;idea is to use a big array containing the second stage payload and interesting strings:
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, July 8th 2020 https://isc.sans.edu/podcastdetail.html?id=7070, (Wed, Jul 8th)