Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, June 10th 2020 https://isc.sans.edu/podcastdetail.html?id=7032, (Wed, Jun 10th)
This month we got patches for 130 vulnerabilities. Of these, 12 are critical and none of them was previously disclosed or is being exploited according to Microsoft.
Continue reading Microsoft June 2020 Patch Tuesday, (Tue, Jun 9th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, June 9th 2020 https://isc.sans.edu/podcastdetail.html?id=7030, (Tue, Jun 9th)
I often get requests for help with deobfuscating scripts. I have several tools that can help.
Continue reading Translating BASE64 Obfuscated Scripts, (Mon, Jun 8th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, June 8th 2020 https://isc.sans.edu/podcastdetail.html?id=7028, (Mon, Jun 8th)
Modern-day protests are as much about social media and voicing your opinions online, as they are about showing up “in person”. When attending a protest, it is important to keep some basic rules in mind to stay secure. Of course, it is always best to leave expensive electronics at home, but live streaming, posting to social media, and recording events at the protest is very much a part of modern protests. The other option is to only take a relatively cheap “burner phone” with you that does not have any of your personal data associated with it. But even a cheap, but reasonably functional phone will be too expensive for most.
Continue reading Cyber Security for Protests, (Fri, Jun 5th)
This past month, we&#;x26;#;39;ve seen some new and different scans targeting tcp ports between 8000 and 10,000. The first occurrence was on 30 April 2020 and originated from ip address %%ip:23.95.67.187%% and containing payload:
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, June 5th 2020 https://isc.sans.edu/podcastdetail.html?id=7026, (Fri, Jun 5th)
Yesterday, Peter from DNSFilter send us a message noting that many of the domains in our “Suspicious Domain” feed no longer resolved, and some of the feeds we used as input were no longer maintained. After investigating, I have to agree with him. The remaining feeds don&#;x26;#;39;t make a valuable service at this point. The idea of the “Suspicious Domain” list was to aggregate different lists, but with essentially only 1 or 2 lists left, that doesn&#;x26;#;39;t make sense and I decided to no longer maintain the feed until we find new inputs. The respective files will still be offered by they are empty to not break any existing scripts that use them (they are quite popular).
Continue reading Suspending Suspicious Domain Feed / Update to Researcher IP Feed, (Thu, Jun 4th)
Many modern malware samples implement defensive techniques. First of all, we have to distinguish sandbox-evasion and anti-debugging techniques. Today, sandboxes are an easy and quick way to categorize samples based on their behavior. Malware developers have plenty of tests to perform to detect the environment running their code. There are plenty of them, some examples: testing the disk size, the desktop icons, the uptime, processes, network interfaces MAC addresses, hostnames, etc.
Continue reading Anti-Debugging Technique based on Memory Protection, (Thu, Jun 4th)