Author Archives: Xavier

[SANS ISC] Malicious Calendar Subscriptions Are Back?

Posted on by

I published the following diary on isc.sans.edu: “Malicious Calendar Subscriptions Are Back?“: Did this threat really disappear? This isn’t a brand new technique to deliver malicious content to mobile devices but it seems that attackers started new waves of spam campaigns based on malicious calendar subscriptions. Being a dad, you can imagine that

The post [SANS ISC] Malicious Calendar Subscriptions Are Back? appeared first on /dev/random.

Continue reading [SANS ISC] Malicious Calendar Subscriptions Are Back?→

[SANS ISC] Attackers Will Always Abuse Major Events in our Lifes

Posted on by

I published the following diary on isc.sans.edu: “Attackers Will Always Abuse Major Events in our Lifes“: All major events in our daily life are potential sources of revenue for attackers. When elections or major sports events are organized, attackers will surf on these waves and try to make some profit or

The post [SANS ISC] Attackers Will Always Abuse Major Events in our Lifes appeared first on /dev/random.

Continue reading [SANS ISC] Attackers Will Always Abuse Major Events in our Lifes→

[SANS ISC] Cryptocurrency Clipboard Swapper Delivered With Love

Posted on by

I published the following diary on isc.sans.edu: “Cryptocurrency Clipboard Swapper Delivered With Love“: Be careful if you’re a user of cryptocurrencies. My goal is not to re-open a debate about them and their associated financial risks. No, I’m talking here about technical risk. Wallet addresses are long strings of characters that

The post [SANS ISC] Cryptocurrency Clipboard Swapper Delivered With Love appeared first on /dev/random.

Continue reading [SANS ISC] Cryptocurrency Clipboard Swapper Delivered With Love→

[SANS ISC] Waiting for the C2 to Show Up

Posted on by

published the following diary on isc.sans.edu: “Waiting for the C2 to Show Up“: Keep this in mind: “Patience is key”. Sometimes when you are working on a malware sample, you depend on online resources. I’m working on a classic case: a Powershell script decodes then injects a shellcode into a process. There

The post [SANS ISC] Waiting for the C2 to Show Up appeared first on /dev/random.

Continue reading [SANS ISC] Waiting for the C2 to Show Up→

Public Message to IoT Manufacturers

Posted on by

Dear IoT manufacturers, Yes, I admit: I like your products and my Geekness does not help! I like to play with them. If some are “gadgets” that finally land in a drawer amongst others with cables and connectors, some of them are really useful and I use them daily. You

The post Public Message to IoT Manufacturers appeared first on /dev/random.

Continue reading Public Message to IoT Manufacturers→

[SANS ISC] Malicious Microsoft Word Remains A Key Infection Vector

Posted on by

I published the following diary on isc.sans.edu: “Malicious Microsoft Word Remains A Key Infection Vector“: Despite Microsoft’s attempts to make its Office suite more secure and disable many automatic features, despite the fact that users are warned that suspicious documents should not be opened, malicious Word documents remain a key

The post [SANS ISC] Malicious Microsoft Word Remains A Key Infection Vector appeared first on /dev/random.

Continue reading [SANS ISC] Malicious Microsoft Word Remains A Key Infection Vector→

[SANS ISC] Malicious Microsoft Word Remains A Key Infection Vector

Posted on by

I published the following diary on isc.sans.edu: “Malicious Microsoft Word Remains A Key Infection Vector“: Despite Microsoft’s attempts to make its Office suite more secure and disable many automatic features, despite the fact that users are warned that suspicious documents should not be opened, malicious Word documents remain a key

The post [SANS ISC] Malicious Microsoft Word Remains A Key Infection Vector appeared first on /dev/random.

Continue reading [SANS ISC] Malicious Microsoft Word Remains A Key Infection Vector→

[SANS ISC] Infected With a .reg File

Posted on by

I published the following diary on isc.sans.edu: “Infected With a .reg File“: Yesterday, I reported a piece of malware that uses archive.org to fetch its next stage. Today, I spotted another file that is also interesting: A Windows Registry file (with a “.reg” extension). Such files are text files created by exporting values

The post [SANS ISC] Infected With a .reg File appeared first on /dev/random.

Continue reading [SANS ISC] Infected With a .reg File→

[SANS ISC] Malicious Content Delivered Through archive.org

Posted on by

I published the following diary on isc.sans.edu: “Malicious Content Delivered Through archive.org“: archive.org, also known as the “way back machine” is a very popular Internet site that allows you to travel back in time and browse old versions of a website (like the ISC website). It works like regular search engines and

The post [SANS ISC] Malicious Content Delivered Through archive.org appeared first on /dev/random.

Continue reading [SANS ISC] Malicious Content Delivered Through archive.org→

[SANS ISC] Using Sudo with Python For More Security Controls

Posted on by

I published the following diary on isc.sans.edu: “Using Sudo with Python For More Security Controls“: I’m a big fan of the Sudo command. This tool, available on every UNIX flavor, allows system administrators to provide access to certain users/groups to certain commands as root or another user. This is performed with a

The post [SANS ISC] Using Sudo with Python For More Security Controls appeared first on /dev/random.

Continue reading [SANS ISC] Using Sudo with Python For More Security Controls→