Collaborate Disseminate
I woke up this morning to the long anticipated news that Bluekeep exploitation is happening in the wild. As some of you may recall, back in August I wrote a diary demonstrating a way to scan for Bluekeep vulnerable devices. So the next thing I did was check my Bluekeep scan results and was presented with this graph.
Continue reading Bluekeep exploitation causing Bluekeep vulnerability scan to fail, (Tue, Nov 5th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, November 4th 2019 https://isc.sans.edu/podcastdetail.html?id=6736, (Mon, Nov 4th)
Last week, Askar from Shells.Systems published two remote code execution (RCE) vulnerabilities in rConfig [1]. The blog post included details about these vulnerabilities and proof of concept code. Both vulnerabilities are trivially exploited by adding shell commands to specific URLs, and one of the vulnerabilities does not require authentication.
Last week, Guy wrote a diary entry “Unusual Activity with Double Base64 Encoding” describing unusual scanning activity he sees on his honeypot.
Continue reading You Too? “Unusual Activity with Double Base64 Encoding”, (Sun, Nov 3rd)
Jan Kopriva&#;x26;#;39;s interesting diary entry “EML attachments in O365 – a recipe for phishing” reminded me of another use of EML files for malicious purposes.
I guess many of you use a password manager.
Continue reading Tip: Password Managers and 2FA, (Fri, Nov 1st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, November 1st 2019 https://isc.sans.edu/podcastdetail.html?id=6734, (Fri, Nov 1st)
I’ve recently come across interesting behavior of Office 365 when EML files are attached to e-mail messages, which can be useful for any red teamers out there but which can potentially also make certain types of phishing attacks more successful.
Continue reading EML attachments in O365 – a recipe for phishing, (Thu, Oct 31st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, October 31st 2019 https://isc.sans.edu/podcastdetail.html?id=6732, (Thu, Oct 31st)
BEC or “Business Email Compromize” is a trending thread for a while. The idea is simple: a corporate mailbox (usually from a C-level member)&#;x26;#;xc2;&#;x26;#;xa0;is compromized to send legitimate emails to other employees or partners. That&#;x26;#;39;s the very first step of a fraud that could have huge impacts.
Continue reading Keep an Eye on Remote Access to Mailboxes, (Wed, Oct 30th)