Collaborate Disseminate
Hello from Vienna where I’m at the DeepSec conference. Initially, I was scheduled to give my OSSEC training but it was canceled due to a lack of students. Anyway, the organizers proposed to me to join (huge thanks to them!). So, here is a wrap-up of the first day! After
[The post DeepSec 2019 Wrap-Up Day #1 has been first published on /dev/random]
I published the following diary on isc.sans.edu: “My Little DoH Setup“: “DoH”, this 3-letters acronym is a buzzword on the Internet in 2019! It has been implemented in Firefox, Microsoft announced that Windows will support it soon. They are pro & con about encrypting DNS requests in HTTPS but it’s not the
[The post [SANS ISC] My Little DoH Setup has been first published on /dev/random]
I published the following diary on isc.sans.edu: “Abusing Web Filters Misconfiguration for Reconnaissance“: Yesterday, an interesting incident was detected while working at a customer SOC. They use a “next-generation” firewall that implements a web filter based on categories. This is common in many organizations today: Users’ web traffic is allowed/denied based on an
[The post [SANS ISC] Abusing Web Filters Misconfiguration for Reconnaissance has been first published on /dev/random]
Continue reading [SANS ISC] Abusing Web Filters Misconfiguration for Reconnaissance
I published the following diary on isc.sans.edu: “Microsoft Apps Diverted from Their Main Use“: This week, the CERT.eu organized its yearly conference in Brussels. Across many interesting presentations, one of them covered what they called the “cat’n’mouse” game that Blue and Red teams are playing continuously. When the Blue team has
[The post [SANS ISC] Microsoft Apps Diverted from Their Main Use has been first published on /dev/random]
Continue reading [SANS ISC] Microsoft Apps Diverted from Their Main Use
This month was the “Cyber Security Month” and I had the idea to post a security tip on Twitter for the first day. Don’t ask me why. Then, I wrote a second one and decided to tweet something every day. We are now at the end of the day and
[The post Cyber Security Month Wrap-Up has been first published on /dev/random]
I published the following diary on isc.sans.edu: “Generating PCAP Files from YAML“: BEC or “Business Email Compromize” is a trending thread for a while. The idea is simple: a corporate mailbox (usually from a C-level member) is compromized to send legitimate emails to other employees or partners. That’s the very first
[The post [SANS ISC] Keep an Eye on Remote Access to Mailboxes has been first published on /dev/random]
Continue reading [SANS ISC] Keep an Eye on Remote Access to Mailboxes
I published the following diary on isc.sans.edu: “Generating PCAP Files from YAML“: The PCAP file format is everywhere. Many applications generate PCAP files based on information collected on the network. Then, they can be used as evidence, as another data source for investigations and much more. There exist plenty of
[The post [SANS ISC] Generating PCAP Files from YAML has been first published on /dev/random]
After the MISP Summit on Monday, hack.lu, here is a quick review of the third event I’m attending in my crazy week in Luxembourg: BSides Luxembourg! It was already the 3rd edition (and the 2nd for me). The message is clear: this event focus on the “blue team” side, don’t
[The post BSides Luxembourg 2019 Wrap-Up has been first published on /dev/random]
And here is my third and last wrap-up for the 2019 edition of hack.lu! The last day is always harder for many people after the social event but I was on time to follow the first talk: “Beyond Windows Forensics with Built-in Microsoft Tooling” by Thomas Fischer. Thomas’s goal was
[The post Hack.lu 2019 Day #3 Wrap-Up has been first published on /dev/random]
After a short night playing the CTF and a lot of morning coffee, I was ready for the second day… It started with a hot-topic: “Sensor & Logic Attack Surface of Driverless Vehicles” presented by Zoz. Even if not yet common on our roads today, self-driving cars (or cars with
[The post Hack.lu 2019 Day #2 Wrap-Up has been first published on /dev/random]