Collaborate Disseminate
I have a friend who wants to doctor her transcripts for university applications because they misspelled her name (and the university is closed for Christmas holidays and cannot reissue a new transcript before the application … Continue reading Will forged transcripts in PDF be detected? [on hold]
Is there something that all kernel exploits have in common?
Sure, they all exploit the kernel, but I’m more interested in the underlying mechanisms or the result. At the moment my interest goes mostly in the direction of mem… Continue reading How can you detect kernel exploits?
Is there something that all kernel exploits have in common?
Sure, they all exploit the kernel, but I’m more interested in the underlying mechanisms or the result. At the moment my interest goes mostly in the direction of memory forensics…. Continue reading How can you detect kernel exploits?
I have some HTML that was detected by one of my scripts firewall detections, it looks like this:
<!—
HTTP 1.1
Status Code: 403
HTTP Headers: {‘Content-Length’: ‘1233’, ‘X-Powered-By’: ‘ASP.NET’, ‘Server’: ‘Microsoft-IIS… Continue reading Trying to detect a firewall
Considering the scenario when the attacker is able to exfiltrate sensitive data from compromised system to external network or Internet, but there are only limited ways to achieve this because the outbound connection is confi… Continue reading What is good metric for detecting data exfiltration on covert channel?
Considering the scenario when the attacker is able to exfiltrate sensitive data from compromised system to external network or Internet, but there are only limited ways to achieve this because the outbound connection is confi… Continue reading What is good metric for detecting data exfiltration on covert channel?
Phishing attacks are nothing new, but we are noticing a new trend for polymorphism, both in the wrapping document and in the dropped executable. In samples that are literally minutes old, we see the control server is re-obfuscating and updating the malware faster than anti-virus programs are updating their awareness. The changes made are more […]
The post Phishing Trojan Campaign Picks Up Pace, Morphing at Scale to Defeat Legacy Detection appeared first on Bromium.
The post Phishing Trojan Campaign Picks Up Pace, Morphing at Scale to Defeat Legacy Detection appeared first on Security Boulevard.
Phishing attacks are nothing new, but we are noticing a new trend for polymorphism, both in the wrapping document and in the dropped executable. In samples that are literally minutes old, we see the control server is re-obfuscating and updating the malware faster than anti-virus programs are updating their awareness. The changes made are more […]
The post Phishing Trojan Campaign Picks Up Pace, Morphing at Scale to Defeat Legacy Detection appeared first on Bromium.
The post Phishing Trojan Campaign Picks Up Pace, Morphing at Scale to Defeat Legacy Detection appeared first on Security Boulevard.
Detection-based IT security solutions have never worked, and will never work. More security layers is not the answer, but smarter layers can work. Shift your mindset from “prevent, detect, and respond” to “isolate, contain, and control.” Layer after layer of security is not stopping breaches. We can’t keep the bad guys out. Oddly enough, 80+ years […]
The post A Fresh Approach to Perimeter Protection: Application Isolation appeared first on Bromium.
The post A Fresh Approach to Perimeter Protection: Application Isolation appeared first on Security Boulevard.
Continue reading A Fresh Approach to Perimeter Protection: Application Isolation
This is probably a noobie question…
I had nethogs open, and I’ve got the following output
3001 nabil /opt/google/chrome/chrome wlp6s0 0.602 0.163 KB/sec
? root 192.168.1.2:59844-… Continue reading How to find which process communicated with a certain ip at a certain time?