Author Archives: Xavier

[SANS ISC] A VBScript with Obfuscated Base64 Data

Posted on by

I published the following diary on isc.sans.org: “A VBScript with Obfuscated Base64 Data“. A few months ago, I posted a diary to explain how to search for (malicious) PE files in Base64 data. Base64 is indeed a common way to distribute binary content in an ASCII form. There are plenty

[The post [SANS ISC] A VBScript with Obfuscated Base64 Data has been first published on /dev/random]

Continue reading [SANS ISC] A VBScript with Obfuscated Base64 Data→

BSides Athens 2017 Wrap-Up

Posted on by

The second edition of BSides Athens was planned this Saturday. I already attended the first edition (my wrap-up is here) and I was happy to be accepted as a speaker for the second time!  This edition moved to a new location which was great. Good wireless, air conditioning and food. The

[The post BSides Athens 2017 Wrap-Up has been first published on /dev/random]

Continue reading BSides Athens 2017 Wrap-Up→

[SANS ISC] Obfuscating without XOR

Posted on by

I published the following diary on isc.sans.org: “Obfuscating without XOR“. Malicious files are generated and spread over the wild Internet daily (read: “hourly”). The goal of the attackers is to use files that are: not know by signature-based solutions not easy to read for the human eye That’s why many

[The post [SANS ISC] Obfuscating without XOR has been first published on /dev/random]

Continue reading [SANS ISC] Obfuscating without XOR→

[SANS ISC] Systemd Could Fallback to Google DNS?

Posted on by

I published the following diary on isc.sans.org: “Systemd Could Fallback to Google DNS?“. Google is everywhere and provides free services to everyone. Amongst the huge list of services publicly available, there are the Google DNS, well known as 8.8.8.8, 8.8.4.4 (IPv4) and 2001:4860:4860::8888, 2001:4860:4860::8844 (IPv6)… [Read more]  

[The post [SANS ISC] Systemd Could Fallback to Google DNS? has been first published on /dev/random]

Continue reading [SANS ISC] Systemd Could Fallback to Google DNS?→

SSTIC 2017 Wrap-Up Day #3

Posted on by

Here is my wrap-up for the last day. Hopefully, after the yesterday’s social event, the organisers had the good idea to start later… The first set of talks was dedicated to presentation tools. The first slot was assigned to Florian Maury, Sébastien Mainand: “Réutilisez vos scripts d’audit avec PacketWeaver”. When you

[The post SSTIC 2017 Wrap-Up Day #3 has been first published on /dev/random]

Continue reading SSTIC 2017 Wrap-Up Day #3→

SSTIC 2017 Wrap-Up Day #2

Posted on by

Here is my wrap-up for the second day. From my point of view, the morning sessions were quite hard with a lot of papers based on hardware research. Anaïs Gantet started with “CrashOS : recherche de vulnérabilités système dans les hyperviseurs”. The motivations behind this research are multiple: virtualization of computers

[The post SSTIC 2017 Wrap-Up Day #2 has been first published on /dev/random]

Continue reading SSTIC 2017 Wrap-Up Day #2→

SSTIC 2017 Wrap-Up Day #1

Posted on by

I’m in Rennes, France to attend my very first edition of the SSTIC conference. SSTIC is an event organised in France, by and for French people. The acronym means “Symposium sur la sécurité des technologies de l’information et des communications“. The event has a good reputation about its content but

[The post SSTIC 2017 Wrap-Up Day #1 has been first published on /dev/random]

Continue reading SSTIC 2017 Wrap-Up Day #1→

[SANS ISC] Phishing Campaigns Follow Trends

Posted on by

I published the following diary on isc.sans.org: “Phishing Campaigns Follow Trends“. Those phishing emails that we receive every day in our mailboxes are often related to key players in different fields (…) But the landscape of online services is ever changing and new actors (and more precisely their customers) become

[The post [SANS ISC] Phishing Campaigns Follow Trends has been first published on /dev/random]

Continue reading [SANS ISC] Phishing Campaigns Follow Trends→

[SANS ISC] Sharing Private Data with Webcast Invitations

Posted on by

I published the following diary on isc.sans.org: “Sharing Private Data with Webcast Invitations“. Last week, at a customer, we received a forwarded email in a shared mailbox. It was somebody from another department that shared an invitation for a webcast “that could be interesting for you, guys!”. This time, no phishing

[The post [SANS ISC] Sharing Private Data with Webcast Invitations has been first published on /dev/random]

Continue reading [SANS ISC] Sharing Private Data with Webcast Invitations→

HTTP… For the Good or the Bad

Posted on by

Tonight, I was invited by the OWASP Belgium Chapter (thank you again!) to present “something“. When I accepted the invitation, I did not really have an idea so I decided to compile the findings around my research about webshells. They are common tools used by bad guys: Once they compromized

[The post HTTP… For the Good or the Bad has been first published on /dev/random]

Continue reading HTTP… For the Good or the Bad→