Author Archives: Xavier

[SANS ISC Diary] Example of Targeted Attack Through a Proxy PAC File

Posted on by

I published the following diary on isc.sans.org: “Example of Targeted Attack Through a Proxy PAC File“. Yesterday, I discovered a nice example of targeted attack against a Brazilian bank. It started with an email sample like this … [Read more]

[The post [SANS ISC Diary] Example of Targeted Attack Through a Proxy PAC File has been first published on /dev/random]

Continue reading [SANS ISC Diary] Example of Targeted Attack Through a Proxy PAC File→

[SANS ISC Diary] Voice Message Notifications Deliver Ransomware

Posted on by

I published the following diary on isc.sans.org: “Voice Message Notifications Deliver Ransomware“. Bad guys need to constantly find new ways to lure their victims. If billing notifications were very common for a while, not all people in a company are working with such kind of documents. Which types of notification

[The post [SANS ISC Diary] Voice Message Notifications Deliver Ransomware has been first published on /dev/random]

Continue reading [SANS ISC Diary] Voice Message Notifications Deliver Ransomware→

[SANS ISC Diary] Data Classification For the Masses

Posted on by

I published the following diary on isc.sans.org: “Data Classification For the Masses“. Data classification isn’t a brand new topic. For a long time, international organizations or military are doing “data classification”. It can be defined as: “A set of processes and tools to help the organization to know what data

[The post [SANS ISC Diary] Data Classification For the Masses has been first published on /dev/random]

Continue reading [SANS ISC Diary] Data Classification For the Masses→

[SANS ISC Diary] Analyze of a Linux botnet client source code

Posted on by

I published the following diary on isc.sans.org: “Analyze of a Linux botnet client source code“. I like to play active-defense. Every day, I extract attacker’s IP addresses from my SSH honeypots and perform a quick Nmap scan against them. The goal is to gain more knowledge about the compromised hosts. Most

[The post [SANS ISC Diary] Analyze of a Linux botnet client source code has been first published on /dev/random]

Continue reading [SANS ISC Diary] Analyze of a Linux botnet client source code→

[SANS ISC Diary] Name All the Things!

Posted on by

I published the following diary on isc.sans.org: “Name All the Things!“. With our more and more complex environments and processes, we have to handle a huge amount of information on a daily basis. To improve the communication with our colleagues, peers, it is mandatory to speak the same language and

[The post [SANS ISC Diary] Name All the Things! has been first published on /dev/random]

Continue reading [SANS ISC Diary] Name All the Things!→

[SANS ISC Diary] The Power of Web Shells

Posted on by

I published the following diary on isc.sans.org: “The Power of Web Shells“. Web shells are not new in the threats landscape. A web shell is a script (written in PHP, ASL, Perl, … – depending on the available environment) that can be uploaded to a web server to enable remote administration.

[The post [SANS ISC Diary] The Power of Web Shells has been first published on /dev/random]

Continue reading [SANS ISC Diary] The Power of Web Shells→

RMLL Security Track 2016 Wrap-Up

Posted on by

I’m in the train from Paris where I attended the RMLL Security Track version 2016. The RMLL or “Rencontres Mondiales du Logiciel Libre” is an annual event around free software. Amongst multiple tracks, there is always one dedicated to information security (around free software of course). The global event was

[The post RMLL Security Track 2016 Wrap-Up has been first published on /dev/random]

Continue reading RMLL Security Track 2016 Wrap-Up→

Book Review: Sécurité Informatique et Malwares

Posted on by

In 2013, Paul Rascagnères (aka “@r00tbsd“) wrote a book titled “Malware: Identification, analyse et éradication“. Paul being a friend but especially a renowned security researcher in the field of malware analysis and incident investigations, I bought the first edition of his book which was a very good introduction to malware.

[The post Book Review: Sécurité Informatique et Malwares has been first published on /dev/random]

Continue reading Book Review: Sécurité Informatique et Malwares→