Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, September 30th 2019 https://isc.sans.edu/podcastdetail.html?id=6686, (Mon, Sep 30th)
Reader Chad submitted a malicious Office document, delivered as an email attachment. The maldoc was encrypted, and the password was mentioned in the email: PETROFAC.
Continue reading Encrypted Maldoc, Wrong Password, (Sun, Sep 29th)
One of my honeypots detected a&#;x26;#;xc2;&#;x26;#;xa0;nice scan&#;x26;#;xc2;&#;x26;#;xa0;yesterday. A bot was looking for Polycom master provisioning files. Such&#;x26;#;xc2;&#;x26;#;xa0;files are&#;x26;#;xc2;&#;x26;#;xa0;called by default &#;x26;#;39;000000000000.cfg’ and contain&#;x26;#;xc2;&#;x26;#;xa0;interesting information to perform provisioning of&#;x26;#;xc2;&#;x26;#;xa0;VoIP phones. Normally, this file is renamed with the MAC address of the phone (ex: a1b2c3d4e5f6.cfg) but the name can be left intact and, if the phone can’t find his own MAC address-based&#;x26;#;xc2;&#;x26;#;xa0;configuration, it will pull the default file.
Continue reading New Scans for Polycom Autoconfiguration Files, (Fri, Sep 27th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, September 27th 2019 https://isc.sans.edu/podcastdetail.html?id=6684, (Fri, Sep 27th)
Our reader Marc reports a vulnerability posted by Cisco yesterday: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-ios-gos-auth
Continue reading Vulnerability on specific Cisco Industrial / Grid router models, (Thu, Sep 26th)
So often when we&#;x26;#;39;re working an incident on the network side, we quickly end up at Layer 2, working with MAC Addresses.
MAC addresses are 48 bit (6 bytes, or 12 hex characters) values, and are commonly split by a colons, dashes or dots (all are equally valid):
Continue reading Mining MAC Address and OUI Information, (Thu, Sep 26th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, September 26th 2019 https://isc.sans.edu/podcastdetail.html?id=6682, (Thu, Sep 26th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, September 25th 2019 https://isc.sans.edu/podcastdetail.html?id=6680, (Wed, Sep 25th)
I&#;x26;#;39;m keeping an eye on the certificate transparency logs[1] using automated scripts. The goal is to track domain names (and their variations) of my customers, sensitive services in Belgium, key Internet players and some interesting keywords. Yesterday I detected a peak of events related to the domain &#;x26;#;39;remotewebaccess.com&#;x26;#;39;. This domain, owned by Microsoft, is used to provide temporary remote access to Windows computers[2]. Microsoft allows you to use your own domain but provides also (for more convenience?) a list of available domains. Once configured, you are able to access the computer from a browser: