Collaborate Disseminate
In recent weeks, you probably heard a lot about the “Covid19 Tracing Apps” that Google, Apple, and others. These news reports usually mention the privacy aspects of such an app, but of course, don&#;x26;#;39;t cover the protocols in sufficient depth to address how the privacy challenges are being solved.
Continue reading Privacy Preserving Protocols to Trace Covid19 Exposure, (Wed, Apr 29th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, April 29th 2020 https://isc.sans.edu/podcastdetail.html?id=6974, (Wed, Apr 29th)
While going over malicious e-mails caught by our company gateway in March, I noticed that several of those, that carried ACE file attachments, appeared to be from the same sender. That would not be that unusual, but and after going through the historical logs, I found that e-mails from the same address with similar attachments were blocked by the gateway as early as March 2019.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, April 28th 2020 https://isc.sans.edu/podcastdetail.html?id=6972, (Tue, Apr 28th)
An interesting obfuscation technique to store a malicious payload in a PowerShell script: In a PSCredential object!
Continue reading Powershell Payload Stored in a PSCredential Object, (Mon, Apr 27th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, April 27th 2020 https://isc.sans.edu/podcastdetail.html?id=6970, (Mon, Apr 27th)
In diary entry “Obfuscated with a Simple 0x0A“, Xavier discovers that a .docm file is a malformed ZIP file.
Continue reading Video: Malformed .docm File, (Sun, Apr 26th)
When we publish diary entries covering malware, we almost always share the hash of the malware sample.
For a few weeks, we see a bunch of Excel documents spread in the wild with Macro V4[1]. But VBA macros remain a classic way to drop the next stage of the attack on the victim’s computer. The attacker has many ways to fetch the next stage. He can download it from a compromised server or a public service like pastebin.com, dropbox.com, or any other service that allows sharing content. The problem is, in this case, that it generates more noise via new network flows and the attack depends on the reactivity of the other party to clean up the malicious content. If this happens, the macro won’t be able to fetch the data and the infection will fail. The other approach is to store the payload in the document metadata, the document itself or appended to it.
Continue reading Malicious Excel With a Strong Obfuscation and Sandbox Evasion, (Fri, Apr 24th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, April 24th 2020 https://isc.sans.edu/podcastdetail.html?id=6968, (Fri, Apr 24th)