Author Archives: Xavier

Archive.org Abused to Deliver Phishing Pages

Posted on by

The Internet Archive is a well-known website and more precisely for its “WaybackMachine” service. It allows you to search for and display old versions of websites. The current Alexa ranking is 262 which makes it a “popular and trusted” website. Indeed, like I explained in a recent SANS ISC diary, whitelists

[The post Archive.org Abused to Deliver Phishing Pages has been first published on /dev/random]

Continue reading Archive.org Abused to Deliver Phishing Pages→

[SANS ISC] DNS Query Length… Because Size Does Matter

Posted on by

I published the following diary on isc.sans.org: “DNS Query Length… Because Size Does Matter“. In many cases, DNS remains a goldmine to detect potentially malicious activity. DNS can be used in multiple ways to bypass security controls. DNS tunnelling is a common way to establish connections with remote systems. It is

[The post [SANS ISC] DNS Query Length… Because Size Does Matter has been first published on /dev/random]

Continue reading [SANS ISC] DNS Query Length… Because Size Does Matter→

[SANS ISC] Hunting for Malicious Excel Sheets

Posted on by

I published the following diary on isc.sans.org: “Hunting for Malicious Excel Sheets“. Recently, I found a malicious Excel sheet which contained a VBA macro. One particularity of this file was that useful information was stored in cells. The VBA macro read and used them to download the malicious PE file.

[The post [SANS ISC] Hunting for Malicious Excel Sheets has been first published on /dev/random]

Continue reading [SANS ISC] Hunting for Malicious Excel Sheets→

HITB Amsterdam 2017 Day #2 Wrap-Up

Posted on by

After a nice evening with some beers and an excellent dinner with infosec peers, here is my wrap-up for the second day. Coffee? Check! Wireless? Check! Twitter? Check! As usual, the day started with a keynote. Window Snyder presented “All Fall Down: Interdependencies in the Cloud”. Window is the CSO

[The post HITB Amsterdam 2017 Day #2 Wrap-Up has been first published on /dev/random]

Continue reading HITB Amsterdam 2017 Day #2 Wrap-Up→

HITB Amsterdam 2017 Day #1 Wrap-Up

Posted on by

I’m back in Amsterdam for the 8th edition of the security conference Hack in the Box. Last year, I was not able to attend but I’m attending it for a while (you can reread all my wrap-up’s here). What to say? It’s a very strong organisation, everything running fine, a

[The post HITB Amsterdam 2017 Day #1 Wrap-Up has been first published on /dev/random]

Continue reading HITB Amsterdam 2017 Day #1 Wrap-Up→

[SANS ISC] Tracking Website Defacers with HTTP Referers

Posted on by

I published the following diary on isc.sans.org: “Tracking Website Defacers with HTTP Referers”. In a previous diary, I explained how pictures may affect your website reputation. Although a suggested recommendation was to prevent cross-linking by using the HTTP referer, this is a control that I do not implement on my personal blog,

[The post [SANS ISC] Tracking Website Defacers with HTTP Referers has been first published on /dev/random]

Continue reading [SANS ISC] Tracking Website Defacers with HTTP Referers→

[SANS ISC] Whitelists: The Holy Grail of Attackers

Posted on by

I published the following diary on isc.sans.org: “Whitelists: The Holy Grail of Attackers“. As a defender, take the time to put yourself in the place of a bad guy for a few minutes. You’re writing some malicious code and you need to download payloads from the Internet or hide your

[The post [SANS ISC] Whitelists: The Holy Grail of Attackers has been first published on /dev/random]

Continue reading [SANS ISC] Whitelists: The Holy Grail of Attackers→

[SANS ISC] Pro & Con of Outsourcing your SOC

Posted on by

I published the following diary on isc.sans.org: “Pro & Con of Outsourcing your SOC“. I’m involved in a project to deploy a SIEM (“Security Information &Event Management“) / SOC (“Security Operation Center“) for a customer. The current approach is to outsource the services to an external company also called a

[The post [SANS ISC] Pro & Con of Outsourcing your SOC has been first published on /dev/random]

Continue reading [SANS ISC] Pro & Con of Outsourcing your SOC→

Posted in SBN

[SANS ISC] Diverting built-in features for the bad

Posted on by

I published the following diary on isc.sans.org: “Diverting built-in features for the bad“. Sometimes you may find very small pieces of malicious code. Yesterday, I caught this very small Javascript sample with only 2 lines of code… [Read more]  

[The post [SANS ISC] Diverting built-in features for the bad has been first published on /dev/random]

Continue reading [SANS ISC] Diverting built-in features for the bad→

[SANS ISC] Logical & Physical Security Correlation

Posted on by

I published the following diary on isc.sans.org: “Logical & Physical Security Correlation“. Today, I would like to review an example how we can improve our daily security operations or, for our users, how to help in detecting suspicious content. Last week, I received the following email in my corporate mailbox.

[The post [SANS ISC] Logical & Physical Security Correlation has been first published on /dev/random]

Continue reading [SANS ISC] Logical & Physical Security Correlation→