ISC StormCast for Tuesday, December 15th 2015...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleSecurity Management vs Chaos: Understanding the Butterfly Effect to Manage...
And now for something completely different.">Python">Subtitle: Captain Obvious Applies Chaos Theory Introduction This diary breaks a bit from our expected norms todiscussmanaging possible...
View ArticleUpdates for Google Chrome (47.0.2526.106) & Mozilla Firefox (43) have...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleISC StormCast for Wednesday, December 16th 2015...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticlePlaying With Sandboxes Like a Boss, (Wed, Dec 16th)
Last week, Guy wrote a nice diary to explain how to easily deploy IRMA to analyze suspicious files. Having a good tool to work on files locally is always interesting for multiple reasons. You are doing...
View ArticleISC StormCast for Thursday, December 17th 2015...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleClik here to view.
When Hunting BeEF, Yara rules (Part 2), (Thu, Dec 17th)
This is a Guest Diary submitted by Pasquale Stirparo. In my previous diary [https://isc.sans.edu/forums/diary/When+Hunting+BeEF+Yara+rules/20395], we had a look at a phishing attack scenario, where we...
View ArticleTeslaCrypt ransomware sent using malicious spam, (Fri, Dec 18th)
Introduction Since late November 2015, malicious spam (malspam) distributing TelsaCrypt ransomware has surged in a recent attack offensive [1]. This offensive is on-going. Criminal groups are sending...
View ArticleISC StormCast for Friday, December 18th 2015...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleScreenOS vulnerability affects Juniper firewalls, (Fri, Dec 18th)
Earlier today, we were notified of a vulnerability in an operating system named ScreenOS used to manage firewalls sold by Juniper Networks. Yesterday, Juniper Networks announced that ScreenOS contains...
View ArticleActor using Rig EK to deliver Qbot, (Fri, Dec 18th)
Introduction On Thursday 2015-12-18 during a Rig exploit kit (EK) infection in my lab environment, I saw the same infection chain patterns from a criminal group I hadnt noticed in a long time. This...
View ArticleVMWare Security Advisory, (Sat, Dec 19th)
Today background: url(">VMWarehas released a security advisory background: url(">VMSA-2015-0009that address a critical background: url(">deserializationvulnerability.A background:...
View ArticleCritical Security Controls: Getting to know the unknown, (Mon, Dec 21st)
The Critical Security Controls (CSC) were recently updated, and quite some changes were made. What did not change, though, was the order of sequence of the first four critical controls, which are:...
View ArticleISC StormCast for Monday, December 21st 2015...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleToday 3pm ET, 12pm PT: Special Webcast "What you need to know about the...
--- Johannes B. Ullrich, Ph.D. STI|Twitter|LinkedIn (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleInfocon Yellow: Juniper Backdoor (CVE-2015-7755 and CVE-2015-7756), (Mon,...
Today 3pm ET, 12pm PT: Special Webcast What you need to know about the Juniper backdoor">https://www.sans.org/webcasts/101482 We decided to move to raise our Infocon to yellow over the backdoor in...
View ArticleFirst Exploit Attempts For Juniper Backdoor Against Honeypot, (Tue, Dec 22nd)
We are detecting numerous login attempts against our ssh honeypots using the ScreenOSbackdoor password. Our honeypot doesnt emulate ScreenOS beyond the login banner, so we do not know what the...
View ArticleISC StormCast for Tuesday, December 22nd 2015...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleThe other Juniper vulnerability - CVE-2015-7756, (Tue, Dec 22nd)
Almost completely lost in the hype of theJuniper unauthorized codebackdoor vulnerability (CVE-2015-7755) is the other vulnerability that was fixed as part of the same patch(CVE-2015-7756)....
View ArticleISC StormCast for Wednesday, December 23rd 2015...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View Article