AT&T Cybersecurity Blog

> Have you ever had to debug a "blackbox" before, Application code or hardware that you had really nothing to do with and had to figure out how in the hell it works? I suppose so, yes, but probably not to the extent required in some of these challenges. I just read through https://cybersecurity.att.com/blogs/security-essentials/capture-the-fl… and some of the accompanying write ups[0] on Github which was very insightful. [0]: https://github.com/1337pwnie/ctf-writeups/tree/master/2017/UIUCTF

> HTTPS is unnecessary for this site. The Great Cannon enjoys your continued support. https://cybersecurity.att.com/blogs/labs-research/the-great-cannon-has…

Original source is down - coincidence? https://cybersecurity.att.com/blogs/labs-research/the-great-cannon-has…

It's unlikely that companies would pay for such data, as it is shared for free in places like FB ThreatExchange or https://cybersecurity.att.com/open-threat-exchange (and some others that are more secret) You could potentially otherwise check https://www.projecthoneypot.org/ This is the ancestor of Cloudflare and still actively flagging IPs for bad bots, which is probably a source in Cloudflare itself.

Some technical details linked from the article… https://cybersecurity.att.com/blogs/labs-research/behind-the-scenes-ja…

The discovering group (AT&T Alien Labs) wrote a pretty useful blog post "Behind the scenes: JaskaGO’s coordinated strike on macOS and Windows"[0], which goes into interesting detail on how it behaves (fake error message popup, the anti-vm detection, the trivial tasks if it thinks it's in a VM, the malicious tasks it can attempt if prompted by the command & control). TechRadar summarizes thehackernews which summarizes the blog post. [0]: https://cybersecurity.att.com/blogs/labs-research/behind-the-scenes-ja…

>>The proxy application and most of the malware delivering it are packed using Inno Setup, a free and popular Windows installer.<< ProxyNation: The dark nexus between proxy apps and malware https://cybersecurity.att.com/blogs/labs-research/proxynation-the-dark…

https://www.theguardian.com/commentisfree/2015/feb/20/att-price-on-pri… It’s even explained on their site: https://cybersecurity.att.com/blogs/security-essentials/what-is-deep-p… Justification: to keep you safe!1

Change to https://cybersecurity.att.com/blogs/labs-research/shikitega-new-stealt…

>> The more I learn about the networking side the more interested I am in how to secure this, and I'm less interested in writing code. Be warned, most 'security' jobs are running scripts and programs and filling out checklists. If you were interested in writing code I'd suggest books like Reversing: Secrets of Reverse Engineering or Hacking: The Art of Exploitation That said, a good way to get into it is to find any kind of local user groups, either in industries or at colleges, and find ones that offer security classes and do capture the flag (CTF) events. Here's one in Michigan, for example: https://www.merit.edu/security/training/ This is a good way to get familiar with the tools you would be using and even better, a good way to meet other people in your area who might know of job openings and such. Here are some details on CTF events: https://cybersecurity.att.com/blogs/security-essentials/capture-the-fl…