Scanning Activity for NVMS-9000 Digital Video Recorder, (Sun, Oct 20th)

Since the beginning of October, my honeypot has been capturing numerous scans for DVR model NVMS-9000 which a PoC was released last year describing a "Stack Overflow in Base64 Authorization"[1].

What Assumptions Are You Making?, (Sat, Oct 19th)

If my security agents were not working correctly, then I would get an alert. Since no one said there is a problem with my security agents, then everything must be ok with them. These are just a couple of the assumptions that we make as cybersecurity practitioners each day about the security agents that serve to protect our respective organizations. While it is preferable to think that everything is ok, it is much better to validate that assumption regularly. 

Quick Malicious VBS Analysis, (Fri, Oct 18th)

Let’s have a look at a VBS sample found yesterday. It started as usual with a phishing email that contained a link to a malicious ZIP archive. This technique is more and more common to deliver the first stage via a URL because it reduces the risk to have the first file blocked by classic security controls. The link was:

ISC Stormcast For Friday, October 18th 2019 https://isc.sans.edu/podcastdetail.html?id=6714, (Fri, Oct 18th)

Phishing e-mail spoofing SPF-enabled domain, (Thu, Oct 17th)

On Monday, I found what looked like a run-of-the-mill phishing e-mail in my malware quarantine. The "hook" it used was quite a common one – it was a fake DHL delivery notification inserted as an image into the body of the e-mail in an attempt to make user open its attachments.

ISC Stormcast For Thursday, October 17th 2019 https://isc.sans.edu/podcastdetail.html?id=6712, (Thu, Oct 17th)

When MacOS Catalina Comes to Life: The First Few Minutes of Network Traffic From MacOS 10.15., (Mon, Oct 14th)

This post is continuing a series I started in April about network traffic from Windows 10. When dealing with network traffic, it is always good to know what is normal. As part of this series, I will investigate the first few minutes of network traffic from current operating systems. With macOS 10.15 Catalina just being released, I figured this might be an excellent next operating system to investigate.

New VMware security advisory: https://www.vmware.com/security/advisories/VMSA-2019-0016.html | Oracle quarterly patches bundle: https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html, (Wed, Oct 16th)

Xavier Mertens (@xme)

Security Monitoring: At Network or Host Level?, (Wed, Oct 16th)

Today, to reach a decent security maturity, the keyword remains "visibility". There is nothing more frustrating than being blind about what's happening on a network or starting an investigation without any data (logs, events) to process. The question is: how to efficiently keep an eye on what's happening on your network? There are three key locations to collect data:

ISC Stormcast For Wednesday, October 16th 2019 https://isc.sans.edu/podcastdetail.html?id=6710, (Wed, Oct 16th)

ISC Stormcast For Tuesday, October 15th 2019 https://isc.sans.edu/podcastdetail.html?id=6708, (Tue, Oct 15th)

YARA's XOR Modifier, (Mon, Oct 14th)

YARA searches for strings inside files. Strings to search for are defined with YARA rules.

ISC Stormcast For Monday, October 14th 2019 https://isc.sans.edu/podcastdetail.html?id=6706, (Mon, Oct 14th)

YARA v3.11.0 released, (Sat, Oct 12th)

A new version of YARA was released: v3.11.0.

ISC Stormcast For Friday, October 11th 2019 https://isc.sans.edu/podcastdetail.html?id=6704, (Fri, Oct 11th)

Mining Live Networks for OUI Data Oddness, (Thu, Oct 10th)

My last story was a short script that takes MAC addresses in, and returns the OUI portion of that, along with the vendor who corresponds to that OUI.  (https://isc.sans.edu/diary/Mining+MAC+Address+and+OUI+Information/25360) Today we'll port that to PowerShell as a function and use that on a live network for some "hunting" to look for odd things.

ISC Stormcast For Thursday, October 10th 2019 https://isc.sans.edu/podcastdetail.html?id=6702, (Thu, Oct 10th)

ISC Stormcast For Wednesday, October 9th 2019 https://isc.sans.edu/podcastdetail.html?id=6700, (Wed, Oct 9th)

What data does Vidar malware steal from an infected host?, (Wed, Oct 9th)

Introduction

Microsoft October 2019 Patch Tuesday, (Tue, Oct 8th)

This month we got patches for 59 vulnerabilities total. None of them have been previously disclosed nor are being exploited according to Microsoft. 

ISC Stormcast For Tuesday, October 8th 2019 https://isc.sans.edu/podcastdetail.html?id=6698, (Tue, Oct 8th)

ISC Stormcast For Monday, October 7th 2019 https://isc.sans.edu/podcastdetail.html?id=6696, (Mon, Oct 7th)

visNetwork for Network Data, (Sun, Oct 6th)

DFIR Redefined Part 3 - Deeper Functionality for Investigators with R series continued

Buffer overflows found in libpcap and tcpdump, (Thu, Oct 3rd)

It is always a bit worrisome when vulnerabilities are found in our favorite tools, but our tools are software like any other software and can have bugs, too. One of the feeds I have in my RSS reader is NIST National Vulnerability Database (NVD) feed. Earlier today, I noticed a bunch of CVEs show up there for libpcap and tcpdump. I hadn't noticed any major announcements of new versions or any automatic updates of those tools on any of my linux boxes, so I decided to head straight to the source, www.tcpdump.org. It turns out, there were new versions of both libpcap (new version is 1.9.1) and tcpdump (version 4.9.3) released on Monday. And, there under latest releases, it notes that this release "addresses a large number of vulnerabilities." It should also be noted, this is the first release in over 2 years. Quite of few of the vulnerabilities have CVEs dating from 2018. In all, this update addresses 33 CVEs. Hopefully, the major linux distros will roll out updates over the next few days or weeks. I haven't seen any indication that folks have tried to craft traffic to exploit any of these vulnerabilities, but that is always a concern when a tool like tcpdump or wireshark or the like has buffer overflows in their protocol parsers/decoders/dissectors. So, if you use tcpdump and/or any libpcap-based tools in your toolbox for network monitoring or network forensics, be on the lookout for updates from your linux distro or tool vendor or just go ahead and build your own copy from source.

ISC Stormcast For Friday, October 4th 2019 https://isc.sans.edu/podcastdetail.html?id=6694, (Fri, Oct 4th)

"Lost_Files" Ransomware, (Thu, Oct 3rd)

Are good old malware still used by attackers today? Probably not running the original code but malware developers are… developers! They don’t reinvent the wheel and re-use code published here and there. I spotted a ransomware which looked like an old one.

ISC Stormcast For Thursday, October 3rd 2019 https://isc.sans.edu/podcastdetail.html?id=6692, (Thu, Oct 3rd)

ISC Stormcast For Wednesday, October 2nd 2019 https://isc.sans.edu/podcastdetail.html?id=6690, (Wed, Oct 2nd)

A recent example of Emotet malspam, (Wed, Oct 2nd)

Shown below is an example of malicious spam (malspam) pushing Emotet malware.  It has an attached Word document with macros designed to install Emotet on a vulnerable Windows host.

A Quick Look at Some Current Comment Spam, (Tue, Oct 1st)

As pretty much everybody else allowing comments, our site is getting its fair share of spam. Over the years, we implemented a number of countermeasures, so it is always interesting to see what makes it past these countermeasures. There are a number of recurring themes when it comes to spam:

ISC Stormcast For Tuesday, October 1st 2019 https://isc.sans.edu/podcastdetail.html?id=6688, (Tue, Oct 1st)


Maldoc, PowerShell & BITS, (Mon, Sep 30th)

The sample we analyze today is a malicious Office document, using PowerShell to download its payload via BITS.

ISC Stormcast For Monday, September 30th 2019 https://isc.sans.edu/podcastdetail.html?id=6686, (Mon, Sep 30th)

Encrypted Maldoc, Wrong Password, (Sun, Sep 29th)

Reader Chad submitted a malicious Office document, delivered as an email attachment. The maldoc was encrypted, and the password was mentioned in the email: PETROFAC.

New Scans for Polycom Autoconfiguration Files, (Fri, Sep 27th)

One of my honeypots detected a nice scan yesterday. A bot was looking for Polycom master provisioning files. Such files are called by default '000000000000.cfg’ and contain interesting information to perform provisioning of VoIP phones. Normally, this file is renamed with the MAC address of the phone (ex: a1b2c3d4e5f6.cfg) but the name can be left intact and, if the phone can’t find his own MAC address-based configuration, it will pull the default file.

ISC Stormcast For Friday, September 27th 2019 https://isc.sans.edu/podcastdetail.html?id=6684, (Fri, Sep 27th)

Vulnerability on specific Cisco Industrial / Grid router models, (Thu, Sep 26th)

Our reader Marc reports a vulnerability posted by Cisco yesterday: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-ios-gos-auth

Mining MAC Address and OUI Information, (Thu, Sep 26th)

So often when we're working an incident on the network side, we quickly end up at Layer 2, working with MAC Addresses.

ISC Stormcast For Thursday, September 26th 2019 https://isc.sans.edu/podcastdetail.html?id=6682, (Thu, Sep 26th)

ISC Stormcast For Wednesday, September 25th 2019 https://isc.sans.edu/podcastdetail.html?id=6680, (Wed, Sep 25th)

Malspam pushing Quasar RAT, (Wed, Sep 25th)

Introduction

Huge Amount of remotewebaccess.com Sites Found in Certificate Transparency Logs, (Tue, Sep 24th)

I'm keeping an eye on the certificate transparency logs[1] using automated scripts. The goal is to track domain names (and their variations) of my customers, sensitive services in Belgium, key Internet players and some interesting keywords. Yesterday I detected a peak of events related to the domain 'remotewebaccess.com'. This domain, owned by Microsoft, is used to provide temporary remote access to Windows computers[2]. Microsoft allows you to use your own domain but provides also (for more convenience?) a list of available domains. Once configured, you are able to access the computer from a browser:

ISC Stormcast For Tuesday, September 24th 2019 https://isc.sans.edu/podcastdetail.html?id=6678, (Tue, Sep 24th)

YARA XOR Strings: an Update, (Sun, Sep 22nd)

Almost a year ago, I reported on a new feature in YARA version 3.8.0: YARA XOR Strings. The new YARA xor keyword allows for the search of strings that are XOR-encoded with a one-byte key.

ISC Stormcast For Monday, September 23rd 2019 https://isc.sans.edu/podcastdetail.html?id=6676, (Mon, Sep 23rd)

Video: Encrypted Sextortion PDFs, (Sun, Sep 22nd)

In this video, I show how to use my PDF tools together with QPDF and Poppler to deal with encrypted PDFs, like the sextortion PDFs that were submitted recently.

Wireshark 3.0.5 Release: Potential Windows Crash when Updating, (Sat, Sep 21st)

Wireshark 3.0.5 was just released.

Blacklisting or Whitelisting in the Right Way, (Thu, Sep 19th)

It's Friday today, I'd like to talk about something else. Black (or white) lists are everywhere today. Many security tools implement a way to allow/deny accesses or actions on resources based on "lists" bsides the automated processing of data. The approach to implement them is quite different:

ISC Stormcast For Friday, September 20th 2019 https://isc.sans.edu/podcastdetail.html?id=6674, (Fri, Sep 20th)

Agent Tesla Trojan Abusing Corporate Email Accounts, (Thu, Sep 19th)

The trojan 'Agent Tesla' is not brand new, discovered in 2018, it is written in VisualBasic and has plenty of interesting features. Just have a look at the MITRE ATT&CK overview of its TTP[1].

ISC Stormcast For Thursday, September 19th 2019 https://isc.sans.edu/podcastdetail.html?id=6672, (Thu, Sep 19th)