Author Archives: SANS Internet Storm Center, InfoCON: green

Over the last 9 months or so, I&#;x26;#;39;ve been putting together some docker containers that I find useful in my day-to-day malware analysis and forensicating. I have been putting them up on hub.docker.com and decided, I might as well let others know they were there. In a couple of cases, I just found it easier to create a docker container than try to remember to switch in and out of a Python virtualenv. In a couple of other cases, it avoids issues I&#;x26;#;39;ve had with conflicting version of installed packages. In every case, I&#;x26;#;39;m tracking new releases so I can update my containers when new releases come out and I usually do so within a couple of days of the new release. The ones that I have up at the moment are the following:

Continue reading Security related Docker containers, (Wed, Oct 2nd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, October 2nd, 2024 https://isc.sans.edu/podcastdetail/9162, (Wed, Oct 2nd)→

For a few years now, October has been “National Cyber Security Awareness Month”. This year, it is a good opportunity for a refresher on some scams that tend to happen around disasters like Hurricane Helene. The bigger the disaster, the more attractive it is to scammers.

Continue reading Hurricane Helene Aftermath – Cyber Security Awareness Month, (Tue, Oct 1st)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, October 1st, 2024 https://isc.sans.edu/podcastdetail/9160, (Tue, Oct 1st)→

One of the problems I&#;x26;#;39;ve had since I originally wrote mac-robber.py [1][2][3] seven years ago is that because of the underlying os.stat python library we couldn&#;x26;#;39;t get file creation times (B-times). Since the release of GNU coreutils 8.32 (or so), the statx() call has been available on Linux to provide the B-time, but Python out of the box doesn&#;x26;#;39;t yet support that call. Recently, though, I did some searches and discovered that for several years there has actually bin a pip package called pystatx that exposes the statx() call and allows us to get the B-time. So, I updated the script. It now tries to import statx and if it succeeds (probably only on relatively recent Linux distros where the pip package has been installed) it can now provide B-times. I also adjusted the formatting so the script will now give microsecond instead of millisecond resolution. I will probably write a python version of mactime at some point so that we can actually take advantage of the additional resolution.

Continue reading Tool update: mac-robber.py and le-hex-to-ip.py, (Mon, Sep 30th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, September 30th, 2024 https://isc.sans.edu/podcastdetail/9158, (Mon, Sep 30th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, September 27th, 2024 https://isc.sans.edu/podcastdetail/9156, (Fri, Sep 27th)→

These last two days, a lot has been talked about a “Doomsday 9.9 RCE bug&#;x26;#;39;” in Linux [1]. We now have some additional details from Simone Margaritelli, who discovered and reported the vulnerabilities.

Continue reading Patch for Critical CUPS vulnerability: Don’t Panic, (Thu, Sep 26th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, September 26th, 2024 https://isc.sans.edu/podcastdetail/9154, (Thu, Sep 26th)→

[This is a Guest Diary by Thomas Spangler, an ISC intern as part of the SANS.edu BACS program]

Continue reading OSINT – Image Analysis or More Where, When, and Metadata [Guest Diary], (Wed, Sep 25th)→