Windows 7 – End of Life, (Thu, Jan 9th)
A quick reminder note today for everyone. Microsoft Windows 7 operating system is at End of Life on January 14, 2020. [1]
Author Archives: SANS Internet Storm Center, InfoCON: green
ISC Stormcast For Wednesday, January 8th 2020 https://isc.sans.edu/podcastdetail.html?id=6814, (Wed, Jan 8th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, January 8th 2020 https://isc.sans.edu/podcastdetail.html?id=6814, (Wed, Jan 8th)
A Quick Update on Scanning for CVE-2019-19781 (Citrix ADC / Gateway Vulnerability), (Tue, Jan 7th)
For the last week, I have been monitoring our honeypot logs for evidence of exploits taking advantage of CVE-2019-19781. Currently, I have not seen an actual “exploit” being used. But there is some evidence that people are scanning for vulnerable systems. Based on some of the errors made with these scans, I would not consider them “sophisticated.” There is luckily still no public exploit I am aware of. But other sources I consider credible have indicated that they were able to create a code execution exploit.
ISC Stormcast For Tuesday, January 7th 2020 https://isc.sans.edu/podcastdetail.html?id=6812, (Tue, Jan 7th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, January 7th 2020 https://isc.sans.edu/podcastdetail.html?id=6812, (Tue, Jan 7th)
SNMP service: still opened to the public and still queried by attackers, (Mon, Jan 6th)
Simple Network Management Protocol (SNMP) is a UDP service that runs on port 161/UDP. It is used for network management purposes and should be reachable only from known locations using secure channels.
Increase in Number of Sources January 3rd and 4th: spoofed, (Mon, Jan 6th)
Justin C alerted me in our Slack channel that GreyNoise, a commercial system similar to DShield, noted a large increase in the number of sources scanning. We do have these “Spikes” from time to time and had one for the last two days. Artifacts are usually not lasting that long, and we also did not have a notable change in the number of submitters. So I took a quick look at the data, and here is what I found:
Continue reading Increase in Number of Sources January 3rd and 4th: spoofed, (Mon, Jan 6th)
ISC Stormcast For Monday, January 6th 2020 https://isc.sans.edu/podcastdetail.html?id=6810, (Mon, Jan 6th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, January 6th 2020 https://isc.sans.edu/podcastdetail.html?id=6810, (Mon, Jan 6th)
etl2pcapng: Convert .etl Capture Files To .pcapng Format, (Sun, Jan 5th)
Over the holidays, I wanted to look into a packet capture file I created on Windows with a “netsh trace” command. Such an .etl file created with a “netsh trace” command can not be opened with Wireshark, you have to use Microsoft Message Analyzer.
Continue reading etl2pcapng: Convert .etl Capture Files To .pcapng Format, (Sun, Jan 5th)
KringleCon 2019, (Sat, Jan 4th)
The SANS Holiday Hack Challenge is an annual, free CTF.
CCPA – Quick Overview, (Fri, Jan 3rd)
It';s been quiet lately. Hopefully, it is not a calm before a storm if you will. I crawled out from under my rock and found that the State of California law that offers new consumer protection went into effect Jan 1, 2020. So I poked around the Interwebs to learn about what to expect. For what it';s worth, I am not a resident of California so I am not particularly entitled to these new protections today. I do think it is a sign of what is coming. Europe implemented the General Data Protection Regulation a couple of years ago. There are more states adopting more consumer protections each year. Let';s hope they have enough teeth to have an impact. I took some time to read through the law [1] to highlight it for you. Please note, I am not an attorney or even have interest in being one. Let';s take a look.