ISC StormCast for Monday, October 6th 2014...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleSpoofed packets with Window Size 6667: Anybody else seeing this?, (Mon, Oct...
Thanks to Tim for providing some packet captures. Anybody else seeing "weird" TCP packets? In particular we are interested if you see them OUTBOUND. We are looking for the likely broken tool that may...
View ArticleShellshock: More details released about CVE-2014-6277 and CVE-2014-6278....
Michal Zalewski did publish more details about the two vulnerability he discovered in the aftermath of Shellshock. He used a fuzzer to discover both vulnerabilities, and now published PoC exploits for...
View ArticleCSAM: Patch and get pw0ned (not OR)., (Mon, Oct 6th)
"Patch as fast as you can" appears to be yet another common security practice leading to network doom. Bricked machines can't be hacked easily, so this may help a bit with "security". But then again,...
View ArticleISC StormCast for Tuesday, October 7th 2014...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleConfusion over SSL and 1024 bit keys, (Tue, Oct 7th)
Yesterday and today, a post on reddit.org caused quite a bit of uncertainty about the security of 1024 bit RSA keys if used with OpenSSL. The past referred to a presentation given at a cryptography...
View ArticleBelkin Router Apocalypse: heartbeat.belkin.com outage taking routers down,...
According ot various reports, many users of Belkin routers are havingproblems connecting to the internet as of last night. It appears that the router will occasionally ping">heartbeat.belkin.com to...
View ArticleCSAM: Scary ports and firewall remote administration, (Sat, Jan 1st)
Have you ever done a quick vulnerability check only to discover that someone found that vulnerability before you did and already had the system compromised? During the early stages of a vulnerability...
View ArticleISC StormCast for Wednesday, October 8th 2014...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleCSAM Month of False Positives - Our ISP Says We're Hosting a BotNet!, (Wed,...
Its a note that many of us have received. If were unlucky, its a note that your (not-a-packet-expert) boss has received and weve had to explain it.">We recently received 1 complaint(s) regarding the...
View ArticleISC StormCast for Thursday, October 9th 2014...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleCSAM: My servers started speaking IRC, and that is when I started to...
Hassan submitted this story: While reviewing our IDS logs, we noticed an alert for IRC botnet traffic coming from multiple servers in a specific VLAN. Ouch! One thing I keep saying in our IDS Class: If...
View ArticleISC StormCast for Friday, October 10th 2014...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleMicrosoft Security Bulletin Advance Notification for October 2014, (Fri, Oct...
Microsoft have announced the heads-up for this month security patches. With nine bulletins three are rated as critical, one as moderate and five as important....
View ArticleCSAM: Month of False Positives - Breach Emails?, (Fri, Oct 10th)
With all the high profile breaches pretty much every one of us has received a breach notification email in the recent past. But how many of you could tell if it was legitimate? Take this email from...
View ArticleISC StormCast for Monday, October 13th 2014...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleFor or Against: Port Security for Network Access Control, (Mon, Oct 13th)
I had an interesting discussion tonight with fellow handler Manuel on the pros and cons on port security as it relates to Network Access Control. I thought it would be interesting to see where others...
View ArticleCSAM: Be Wary of False Beacons, (Mon, Oct 13th)
[This is a guest diary published on behalf of Chris Sanders] Hunting for evil in network traffic depends on the analysts ability to locate patterns and variances in oceans of data. This can be an...
View ArticleISC StormCast for Tuesday, October 14th 2014...
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View ArticleAdobe October 2014 Bulletins for Flash Player and Coldfusion, (Tue, Oct 14th)
Adobe published two security bulletins today: APSB-22[1] : fixes 3 vulnerabilities in Adobe Flash Player as well as in Adobe Air. The vulnerabilities are rated with a priority of 1 for Flash...
View Article