Collaborate Disseminate
I’m just back from the second day of hack.lu. The day started early with Patrice Auffret about Metabrik! Patrice is a Perl addict and developed lot of CPAN modules like Net::Packet or Net:Frame. That’s why he had the idea to write a new UNIX shell working like a Perl interpreter.
[The post Hack.lu 2016 Wrap-Up Day #2 has been first published on /dev/random]
I’m back to Luxembourg for a new edition of hack.lu. In fact, I arrived yesterday afternoon to attend the MISP summit. It was a good opportunity to meet MISP users and to get fresh news about the project. This first official day started later and in a classic way: with
[The post Hack.lu 2016 Wrap-Up Day #1 has been first published on /dev/random]
I published the following diary on isc.sans.org: “Another Day, Another Malicious Behaviour“. Every day, we are spammed with thousands of malicious emails and attackers always try to find new ways to bypass the security controls. Yesterday, I detected a suspicious HTTP GET request: … [Read more]
[The post [SANS ISC Diary] Another Day, Another Malicious Behaviour has been first published on /dev/random]
Continue reading [SANS ISC Diary] Another Day, Another Malicious Behaviour
I published the following diary on isc.sans.org: “SNMP Pwn3ge“. Sometimes getting access to company assets is very complicated. Sometimes it is much easier (read: too easy) than expected. If one of the goals of a pentester is to get juicy information about the target, preventing the IT infrastructure to run
[The post [SANS ISC Diary] SNMP Pwn3ge has been first published on /dev/random]
What do security analysts when they aren’t on fire? They hunt for malicious activity on networks and servers! A few days ago, some suspicious traffic was detected. It was an HTTP GET request to a URL like hxxp://xxxxxx.xx/south/fragment/subdir/… Let’s try to access this site from a sandbox. Too bad, I
[The post Go Hunt for Malicious Activity! has been first published on /dev/random]
During the last edition of the Troopers security conference in March, I attended a talk about “JustMetaData”. It’s a tool developed by Chris Truncer to perform open source intelligence against IP addresses. Since then, I used this tool on a regular basis. Often when you’re using a tool, you have ideas to improve
[The post IP Address Open Source Intelligence for the Win has been first published on /dev/random]
Continue reading IP Address Open Source Intelligence for the Win
I published the following diary on isc.sans.org: “Collecting Users Credentials from Locked Devices“. It’s a fact: When a device can be physically accessed, you may consider it as compromised. And if the device is properly hardened, it’s just a matter of time. The best hacks are the ones which use
[The post [SANS ISC Diary] Collecting Users Credentials from Locked Devices has been first published on /dev/random]
Continue reading [SANS ISC Diary] Collecting Users Credentials from Locked Devices
I published the following diary on isc.sans.org: “Malware Delivered via ‘.pub’ Files“. While searching for new scenarios to deliver their malwares[1][2], attackers launched a campaign to deliver malicious code embedded in Microsoft Publisher[3] (.pub) files. The tool Publisher is less known than Word or Excel. This desktop publishing tool was released in 1991 (version
[The post [SANS ISC Diary] Malware Delivered via ‘.pub’ Files has been first published on /dev/random]
Continue reading [SANS ISC Diary] Malware Delivered via ‘.pub’ Files
I published the following diary on isc.sans.org: “Maxmind.com (Ab)used As Anti-Analysis Technique“. A long time ago I wrote a diary[1] about malware samples which use online geolocalization services. Such services are used to target only specific victims. If the malware detects that it is executed from a specific area, it
[The post [SANS ISC Diary] Maxmind.com (Ab)used As Anti-Analysis Technique has been first published on /dev/random]
Continue reading [SANS ISC Diary] Maxmind.com (Ab)used As Anti-Analysis Technique
Getting useful info from log file should be piece of cake …if the file is properly formatted! Usually, one event is written on a single line with useful info delimited by a separator or extractable using regular expressions. But it’s not always the case, welcome to the log hell… Sometimes,
[The post Getting Useful Info From the Log Hell with Awk has been first published on /dev/random]
Continue reading Getting Useful Info From the Log Hell with Awk