VMWare Security Advisory – VMSA-2020-0010 – https://www.vmware.com/security/advisories/VMSA-2020-0010.html, (Tue, May 19th)
— Rick Wanner MSISE – rwanner at isc dot sans dot edu – http://namedeplume.blogspot.com/ – Twitter:namedeplume (Protected)
Author Archives: SANS Internet Storm Center, InfoCON: green
Wireshark Release – 2.6.17, 3.0.11 and 3.2.4 – https://www.wireshark.org/news/20200519.html, (Tue, May 19th)
— Rick Wanner MSISE – rwanner at isc dot sans dot edu – http://namedeplume.blogspot.com/ – Twitter:namedeplume (Protected)
What is up on Port 62234?, (Tue, May 19th)
Here at the ISC we provide access to a number of bits of data which can be used to dig into problems or even as an early warning system of unusual activity.&#;x26;#;xc2;&#;x26;#;xa0; Well today&#;x26;#;39;s data has revealed a confounding one.&#;x26;#;xc2;&#;x26;#;xa0; Port 62234, which traditionally has zero on near zero sources attempting to access it suddenly has hundreds of sources.
Cisco Advisories for FTD, ASA, Firepower 1000, (Tue, May 19th)
Cisco has released a number of advisories for Firepower and Adaptive Security Appliance (ASA).
Continue reading Cisco Advisories for FTD, ASA, Firepower 1000, (Tue, May 19th)
ISC Stormcast For Tuesday, May 19th 2020 https://isc.sans.edu/podcastdetail.html?id=7002, (Tue, May 19th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, May 19th 2020 https://isc.sans.edu/podcastdetail.html?id=7002, (Tue, May 19th)
Automating nmap scans, (Mon, May 18th)
With last week’s diary I left you with using a relatively basic nmap command to perform a relatively thorough scan of an IP range. That command was:
ISC Stormcast For Monday, May 18th 2020 https://isc.sans.edu/podcastdetail.html?id=7000, (Mon, May 18th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, May 18th 2020 https://isc.sans.edu/podcastdetail.html?id=7000, (Mon, May 18th)
Antivirus & Multiple Detections, (Sun, May 17th)
“When a file contains more than one signature, for example EICAR and a real virus, what will the antivirus report?”.
Continue reading Antivirus & Multiple Detections, (Sun, May 17th)
Scanning for Outlook Web Access (OWA) & Microsoft Exchange Control Panel (ECP), (Sat, May 16th)
This past two weeks my honeypot captured several probe for this URL /owa/auth/logon.aspx?url=https://1/ecp/ looking for the Exchange Control Panel. In the February 2020 patch Tuesday, Microsoft released a patch for ECP (CVE-2020-0688) for a remote code execution vulnerability affecting Microsoft Exchange server. Zero Day Initiative provided more details for this vulnerability here. Using CyberChef URL Decode, this is the output of the scan:
SHA3 Hashes (on Windows) – Where Art Thou?, (Fri, May 15th)
No sooner had posted on doing file and string hashes in PowerShell, when I (again) got asked by Jim – “What about SHA3&#;x26;#;x3f;&#;x26;#;xc2;&#;x26;#;xa0; Shouldn&#;x26;#;39;t we be using Quantum Safe algorithms if we have them&#;x26;#;x3f;”
Continue reading SHA3 Hashes (on Windows) – Where Art Thou?, (Fri, May 15th)