Author Archives: Xavier

[SANS ISC] Nicely Obfuscated JavaScript Sample

Posted on by

I published the following diary on isc.sans.org: “Nicely Obfuscated JavaScript Sample“. One of our readers sent us an interesting sample that was captured by his anti-spam. The suspicious email had an HTML file attached to it. By having a look at the file manually, it is heavily obfuscated and the payload

[The post [SANS ISC] Nicely Obfuscated JavaScript Sample has been first published on /dev/random]

Continue reading [SANS ISC] Nicely Obfuscated JavaScript Sample→

TROOPERS 2017 Day #4 Wrap-Up

Posted on by

I’m just back from Heidelberg so here is the last wrap-up for the TROOPERS 2017 edition. This day was a little bit more difficult due to the fatigue and the social event of yesterday. That’s why the wrap-up will be shorter…  The second keynote was presented by Mara Tam: “Magical

[The post TROOPERS 2017 Day #4 Wrap-Up has been first published on /dev/random]

Continue reading TROOPERS 2017 Day #4 Wrap-Up→

TROOPERS 2017 Day #2 Wrap-Up

Posted on by

This is my wrap-up for the 2nd day of “NGI” at TROOPERS. My first choice for today was “Authenticate like a boss” by Pete Herzog. This talk was less technical than expected but interesting. It focussed on a complex problem: Identification. It’s not only relevant for users but for anything

[The post TROOPERS 2017 Day #2 Wrap-Up has been first published on /dev/random]

Continue reading TROOPERS 2017 Day #2 Wrap-Up→

TROOPERS 2017 Day #1 Wrap-Up

Posted on by

I’m in Heidelberg (Germany) for the 10th edition of the TROOPERS conference. The regular talks are scheduled on Wednesday and Thursday. The two first days are reserved for some trainings and a pre-conference event called “NGI” for “Next Generation Internet” focusing on two hot topics: IPv6 and IoT. As said on

[The post TROOPERS 2017 Day #1 Wrap-Up has been first published on /dev/random]

Continue reading TROOPERS 2017 Day #1 Wrap-Up→

[SANS ISC] Searching for Base64-encoded PE Files

Posted on by

I published the following diary on isc.sans.org: “Searching for Base64-encoded PE Files“. When hunting for suspicious activity, it’s always a good idea to search for Microsoft Executables. They are easy to identify: They start with the characters “MZ” at the beginning of the file. But, to bypass classic controls, those

[The post [SANS ISC] Searching for Base64-encoded PE Files has been first published on /dev/random]

Continue reading [SANS ISC] Searching for Base64-encoded PE Files→

[SANS ISC Diary] Example of Multiple Stages Dropper

Posted on by

I published the following diary on isc.sans.org: “Example of Multiple Stages Dropper“. If some malware samples remain simple (see my previous diary), others try to install malicious files in a smooth way to the victim computers. Here is a nice example that my spam trap captured a few days ago. The

[The post [SANS ISC Diary] Example of Multiple Stages Dropper has been first published on /dev/random]

Continue reading [SANS ISC Diary] Example of Multiple Stages Dropper→

Keep Calm and Revoke Access

Posted on by

For the last 24 hours, the Twitter landscape has seen several official accounts hacked. The same Tweet was posted thousand times. It was about the political conflict between Turkey and Holland: Many other accounts were affected (like the one of the EU Commission). Usually, Twitter accounts are hijacked simply due

[The post Keep Calm and Revoke Access has been first published on /dev/random]

Continue reading Keep Calm and Revoke Access→

TROOPER 10 Ahead!

Posted on by

Next week, it’s already the 10th edition of the TROOPERS conference in Heidelberg, Germany. I’ll be present and cover the event via Twitter and daily wrap-ups. It will be my 3rd edition and since the beginning, I was impressed by the quality of the organization from the content point of view

[The post TROOPER 10 Ahead! has been first published on /dev/random]

Continue reading TROOPER 10 Ahead!→

[SANS ISC Diary] Retro Hunting!

Posted on by

I published the following diary on isc.sans.org: “Retro Hunting!“. For a while, one of the security trends is to integrate information from 3rd-party feeds to improve the detection of suspicious activities. By collecting indicators of compromize, other tools may correlate them with their own data and generate alerts on specific conditions.

[The post [SANS ISC Diary] Retro Hunting! has been first published on /dev/random]

Continue reading [SANS ISC Diary] Retro Hunting!→