Your SSH Server On Port 8080 Is No Longer "Hidden" Or...
I am seeing some scanning for SSH servers on port 8080 in web server logs for web servers that listen on this port. So far, I dont see any scans like this for web servers listening on port 80. In web...
View ArticleISC StormCast for Tuesday, August 4th 2015...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleWhatever Happened to tmUnblock.cgi ("Moon Worm"), (Tue, Aug 4th)
Last year, we wrote about the Moon Worm, a bitcoin mining piece of malware that infected Linksys routers. Ever since then, I have seen lots and lots of hits to the vulnerable cgi script...
View ArticleNuclear EK traffic patterns in August 2015, (Wed, Aug 5th)
Introduction About two weeks ago, Nuclear exploit kit (EK)changed its URL patterns. Now it looks a bit likeAngler EK. Kafeine originally announced the change on 2015-07-21 [1], and we collected...
View ArticleISC StormCast for Wednesday, August 5th 2015...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleAugust OUCH Newsletter - Backup & Recovery:...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleISC StormCast for Thursday, August 6th 2015...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleSigcheck and virustotal-search, (Thu, Aug 6th)
In my last diary entry I mentioned offline use of Sysinternal tools with my tool virustotal-search. So you want to use sigcheck but you cant connect the machine to the Internet. Then you can use...
View ArticleISC StormCast for Friday, August 7th 2015...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleCritical Firefox Update Today, (Fri, Aug 7th)
The good folks at Firefox have released their latest version, 39.0.3, in response to vulnerability ">, which has been seen in the wild and allows an attacker to read and steal sensitive local files....
View ArticleISC StormCast for Monday, August 10th 2015...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleWhat Was Old is New Again: Honeypots!, (Mon, Aug 10th)
Here at the ISC, we operate a number of honeypots. So it is nice to see how honeypots in different shapes are starting to become popular again, with even a couple of startups specializing in honeypot...
View ArticleClik here to view.
.COM.COM Used For Malicious Typo Squatting, (Mon, Aug 10th)
Today, our reader Jeff noted how domains ending in .com.com are being redirected to what looks like malicious content.Back in 2013, A blog by Whitehat Security pointed out that the famous com.com...
View ArticleISC StormCast for Tuesday, August 11th 2015...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleAugust 2015 Microsoft Patch Tuesday, (Tue, Aug 11th)
Overview of the August 2015 Microsoft patches and their status. # Affected Contra Indications - KB Known Exploits Microsoft rating(**) ISC rating(*) clients servers MS15-079 Cumulative Security Update...
View ArticleMore patch tuesday: adobe released security update for adobe flash player,...
Adobe released today bulletin APSB15-19, which address the following vulnerabilities found in Adobe Flash Player: CVE-2015-3107, CVE-2015-5124, CVE-2015-5125, CVE-2015-5127, CVE-2015-5128,...
View ArticleISC StormCast for Wednesday, August 12th 2015...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleWindows Service Accounts - Why They're Evil and Why Pentesters Love them!,...
Windows Service Accounts have been one of those enterprise neccessary evils - things that you have to have, but nobody ever talks about or considers to be a problem. All too often, these service...
View ArticleWireshark 1.12.7 is released, multiple fixes. Find the release notes at:...
=============== Rob VandenBrink Metafore (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleYes Virginia, Stored XSS's Do Exist!, (Wed, Aug 12th)
When you go through website security, Cross Site Scripting (XSS) is almost always discussed. Almost exclusively, Reflected XSS is the main topic, and it almost always covers the lions share of the...
View Article