Author Archives: Xavier

[SANS ISC Diary] The Side Effect of GeoIP Filters

Posted on by

I published the following diary on isc.sans.org: “The Side Effect of GeoIP Filters“. IP location, GeoIP or Geolocalization are terms used to describe techniques to assign geographic locations to IP addresses.  Databases are built and maintained to link the following details to IP addresses: Country Region City Postal code Internet Service Provider Coordinates

[The post [SANS ISC Diary] The Side Effect of GeoIP Filters has been first published on /dev/random]

Continue reading [SANS ISC Diary] The Side Effect of GeoIP Filters→

[SANS ISC Diary] Not All Malware Samples Are Complex

Posted on by

I published the following diary on isc.sans.org: “Not All Malware Samples Are Complex“. Everyday we hear about new pieces of malware which implement new techniques to hide themselves and defeat analysts. But they are still people who write simple code that just “do the job”. The sample that I’m reviewing today had a very

[The post [SANS ISC Diary] Not All Malware Samples Are Complex has been first published on /dev/random]

Continue reading [SANS ISC Diary] Not All Malware Samples Are Complex→

[SANS ISC Diary] How your pictures may affect your website reputation

Posted on by

I published the following diary on isc.sans.org: “How your pictures may affect your website reputation“. In a previous diary, I explained why the automatic processing of IOC’s (“Indicator of Compromise”) could lead to false positives. Here is a practical example found yesterday. I captured the following malicious HTML page (MD5:

[The post [SANS ISC Diary] How your pictures may affect your website reputation has been first published on /dev/random]

Continue reading [SANS ISC Diary] How your pictures may affect your website reputation→

[SANS ISC Diary] Analysis of a Simple PHP Backdoor

Posted on by

I published the following diary on isc.sans.org: “Analysis of a Simple PHP Backdoor“. With the huge surface attack provided by CMS like Drupal or WordPress, webshells remain a classic attack scenario. A few months ago, I wrote a diary about the power of webshells. A few days ago, a friend

[The post [SANS ISC Diary] Analysis of a Simple PHP Backdoor has been first published on /dev/random]

Continue reading [SANS ISC Diary] Analysis of a Simple PHP Backdoor→

Am I Affected by Cloudbleed?

Posted on by

Yesterday, Cloudflare posted an incident report on their blog about an issue discovered in their HTML parser. A very nice report which is worth a read! As usual, in our cyber world, this vulnerability quickly received a nice name and logo: “Cloudbleed“. I’ll not explain in details the vulnerability here,

[The post Am I Affected by Cloudbleed? has been first published on /dev/random]

Continue reading Am I Affected by Cloudbleed?→

Integrating OpenCanary & DShield

Posted on by

Being a volunteer for the SANS Internet Storm Center, I’m a big fan of the DShield service. I think that I’m feeding DShield with logs for eight or nine years now. In 2011, I wrote a Perl script to send my OSSEC firewall logs to DShield. This script has been

[The post Integrating OpenCanary & DShield has been first published on /dev/random]

Continue reading Integrating OpenCanary & DShield→

[SANS ISC Diary] How was your stay at the Hotel La Playa?

Posted on by

I published the following diary on isc.sans.org: “How was your stay at the Hotel La Playa?“. I made the following demo for a customer in the scope of a security awareness event. When speaking to non-technical people, it’s always difficult to demonstrate how easily attackers can abuse of their devices and

[The post [SANS ISC Diary] How was your stay at the Hotel La Playa? has been first published on /dev/random]

Continue reading [SANS ISC Diary] How was your stay at the Hotel La Playa?→

Think Twice before Posting Data on Pastebin!

Posted on by

Pastebin.com is one of my favourite playground. I’m monitoring the content of all pasties posted on this website. My goal is to find juicy data like configurations, database dumps, leaks of credentials. Sometimes you can find also malicious binary files. For sure, I knew that I’m not the only one

[The post Think Twice before Posting Data on Pastebin! has been first published on /dev/random]

Continue reading Think Twice before Posting Data on Pastebin!→

[SANS ISC Diary] Analysis of a Suspicious Piece of JavaScript

Posted on by

I published the following diary on isc.sans.org: “Analysis of a Suspicious Piece of JavaScript“. What to do on a cloudy lazy Sunday? You go hunting and review some alerts generated by your robots. Pastebin remains one of my favourite playground and you always find interesting stuff there. In a recent

[The post [SANS ISC Diary] Analysis of a Suspicious Piece of JavaScript has been first published on /dev/random]

Continue reading [SANS ISC Diary] Analysis of a Suspicious Piece of JavaScript→

[SANS ISC Diary] Many Malware Samples Found on Pastebin

Posted on by

I published the following diary on isc.sans.org: “Many Malware Samples Found on Pastebin“. pastebin.com is a wonderful website. I’m scrapping all posted pasties (not only from pastebin.com) and pass them to a bunch of regular expressions. As I said in a previous diary, it is a good way to perform

[The post [SANS ISC Diary] Many Malware Samples Found on Pastebin has been first published on /dev/random]

Continue reading [SANS ISC Diary] Many Malware Samples Found on Pastebin→