SANS ISC Diary

I had three fun ones. I wanted to learn powershell, and I was interested in the history of worms on the internet, so I made a script to check https://isc.sans.edu/ and send me an email if the status was not green. Turns out, powershell has an all-in-one function to send an SMTP email, which I thought was hilarious. I used windows task scheduler to run it every hour. Second, I was struggling with my Cable internet connection, and it was incredibly difficult to nail down what was causing my slow speeds. To help with the diagnostics, I wrote a little python script to download the files that Netflix uses for speedtests (check Fast.com) and logged the average of 10 runs to a file. It similarly used task scheduler to run every 10 minutes and as a result I now have a big old dataset of SpeedTests and unix timestamps which I graphed while playing around with Pillow I wrote a python bot to Read project Gutenburg books to twitter. This was to participate in a contest that involved seeing which "team" could get a hashtag into more tweets. A twitter bot takes about five minutes to make, as I found a brilliant little Python-Twitter library. Unfortunately, my teammates got cold feet and convinced me to de-rate the bot's posting frequency, meaning we barely lost to a group of 60 or so sorority girls doing it the "correct" way. However, as we did it sort of below-radar, the loophole of automating it is still open and valid. Currently I'm working on automating the process of creating…

There are some neat detection bypass / compromise methods using various image formats, including PNG [0] and SVG [1]! I imagine that folks like journalists could have that type of attack in their threat model, and EFF already do a lot of great stuff in this space :) 0. https://isc.sans.edu/diary/31998 1. https://www.cloudflare.com/cloudforce-one/research/svgs-the-hackers-ca…

This is false in some scenarios. Dumping browser credential vaults as well as extracting from active memory have both become de facto standard post-exploitation behaviors. References are many: https://kylemistele.medium.com/stealing-saved-browser-passwords-your-n… https://isc.sans.edu/diary/Use+Your+Browser+Internal+Password+Vault...… https://www.cyberark.com/resources/threat-research-blog/extracting-cle… https://www.bleepingcomputer.com/news/security/redline-malware-shows-w…

https://comparchpodcast.podbean.com/ I've only listened to the most recent episode so far, but it was great and I plan to hear the rest. BSD Now and the SANS Daily Stormcast are good too. https://isc.sans.edu/podcast.html https://www.bsdnow.tv/

Malicious Life https://malicious.life —-A bit of a history lesson in viruses, malware, and cyber crime. From Morris through CryptoLocker and now Target. Darknet Diaries https://darknetdiaries.com/ —-Similar vein to ML, this one gets you into either specific events, people, or times. Risky Business https://risky.biz —-Weekly current affairs and news show dedicated to CyberSecurity. If this is your field, or next to your field, it’s worth listening to the news episodes at least (the numbered episodes). ISC StormCast https://isc.sans.edu/podcast.html —-A quick (5 min) daily cyber security podcast. If Risky.biz tickled your fancy, this one is worth the add too.

I listen to the SANS Internet StormCast ("daily 5-10 minute information security threat updates") every morning: https://isc.sans.edu/podcast.html Many of my other favorites have already been mentioned, but I also listen to: Twenty Thousand Hertz ("stories behind the world's most recognizable and interesting sounds") https://www.20k.org and have started listening to this new NPR podcast: Wow in the World ("a new way for families to connect, look up and discover the wonders in the world around them. Every episode, hosts Mindy and Guy guide curious kids and their grown-ups away from their screens and on a journey. Through a combination of careful scientific research and fun, we'll go inside our brains, out into space, and deep into the coolest new stories in science and technology") http://www.npr.org/podcasts/510321/wow-in-the-world

We started seeing this around the 9th I believe. We were not the only people as well, based on a somewhat late ISC post[1]. We thought it was a new form of intelligent blackholing. Instead of sending traffic to IPs that could easily be blacklisted by tools to get around the firewall, the Great Firewall would start sending them to random "good" IPs for the same result. Others seem to think the same thing[2]. [1] https://isc.sans.edu/forums/diary/Are+You+Piratebay+thepiratebayorg+Re… [2] https://en.greatfire.org/blog/2015/jan/gfw-upgrade-fail-visitors-block…

It's using an isc.sans.org certificate. Connecting to https://isc.sans.org/ gives the exact same site, with no warnings.

I run BIND at home for my network and take advantage of that to do the following: https://isc.sans.edu/diary/Easy+DNS+BIND+Sinkhole+Setup/7930 I also have a webserver that any black holed domain is sent to so that there is no waiting for a web request to time out. The first time I put it in place I didn't have the webserver so the performance when hitting one of these was horrible. I also use it for any ad server or analytic site I want to permanently block. This way I don't have to distribute and update a hosts file to every machine in the house and I control where the offending sites redirect too.

!WalterGR, as you can see declaring the url with the <url..> protection works. There is a-work-around which I wrote last-year, but !danG rewrote the 'Submissions' url-parser filter which did work. See full history; Hacker News > News-Dog 'Submissions' https://news.ycombinator.com/submitted?id=News-Dog Sorry I have not had more time to look at this, once again, thank for reporting. I think the following is from the-Mod Daniel; >You didn't post a bad URL. "Our software replaces links with canonical URLs now, when there is one, and unfortunately that site is pointing to what appears to be an incorrect canonical URL: <link rel="canonical" href="https://isc.sans.edu/forums/diary/28072/" /> I've fixed it on https://news.ycombinator.com/item?id=29350804 now and killed the previous post." Also, please see here; 'We remove the plus sign and everything after it. Spammers love the + alias.' https://news.ycombinator.com/item?id=29322301

SANS is still green: https://isc.sans.edu/

What in the world must DigiNotar's business plan for the future include? How could anyone trust them again? How is it possible that root-level certs were being issued and they've got no warning systems, no logging to determine what actually happened? And remember, we only really know about it now because someone caught the DigiNotar-issued SSL cert floating out in the wild and put it up on Pastebin! As rhizome noted, it borders criminality (if you think about it, does it even border?). These folks told users "Users of SSL certificates can depending on the browser vendor be confronted with a statement that the certificate is not trusted. This is in 99.9% of the cases incorrect, the certificate can be trusted" & their site is full of old defacement tags (on both of these, see http://isc.sans.org/diary/DigiNotar+breach+-+the+story+so+far/11500 - also worth reading). The CA system is broked. Everyone's known it for awhile, but man, it's still tough to look straight in the eyes at its brokenness like this.

Many developers need to read and understand this. It is far from mainstream knowledge... The other day, I saw the following post about password hashing in my RSS feed: http://isc.sans.org/diary.html?storyid=11110 - No mention of bcrypt (though the posts mentions key stretching using SHA1) - "When selecting an algorithm to hash passwords, it is important to select carefully as it is difficult to change the algorithm later. You will have to ask users to change their password if you do as you no longer know what password they picked." --> seriously? you can update the password the next time they log in... - "You could also add a secret, in addition to the salt. If the secret is not stored in the database, it would not be easily reachable via a SQL injection exploit (yes, you can use them to read files, but it requires sufficient privileges)." --> security through obscurity, nice - "For the paranoid, you may want to do the hashing on the client side (javascript) . This way, the server never receives the plain text password. We do this here for the ISC website on our login form [2]." --> oh noes... Note that the blog has ~15k subscribers according to Google Reader... --------- I also launched a debate on StackOverflow the other day. A self-proclaimed "security expert" (he later edited his post to remove this part) was advising against using bcrypt, arguing that it would facilitate DOS attacks against the login page... He prefers security through obscurity, using a secret…

Sorry, here is the correct one: https://isc.sans.edu/diary/rss/32846

You are, presumably, already familiar with the ISC Looking Glass? https://isc.sans.edu/api/dnslookup/google.com

Related: https://isc.sans.edu/forums/diary/zipdump+Evasive+ZIP+Concatenation/31… https://isc.sans.edu/forums/diary/zipdump+PKZIP+Records/31428/

Link should be: https://isc.sans.edu/diary/How+to+Find+Hidden+Cameras+in+your+AirBNB/2…

Correct link https://isc.sans.edu/diary/How+to+Find+Hidden+Cameras+in+your+AirBNB/2…

The HN link mangler got it. The link is https://isc.sans.edu/diary/How+to+Find+Hidden+Cameras+in+your+AirBNB/2…

HN insists on breaking the correct hyperlink. https://isc.sans.edu/diary/After+28+years+SSLv2+is+still+not+gone+from…

Ah thanks - let's change to that above instead of https://isc.sans.edu/diary/0.

Contents of the canonical URL appears to change over time by showing the latest blog post, which is currently this[1] that was just published today, not what was originally submitted. [1] https://isc.sans.edu/diary/What+is+the+origin+of+passwords+submitted+t…

No, not really. Cyber ranges are a very distinct concept/product category than threat visualization maps like you might see here: https://livethreatmap.radware.com/ or here: https://isc.sans.edu/data/threatmap.html Cyber Ranges (and pew pew maps) are also very different than control validation tools like Cymulate or Safe Breach…

Related (of course) to https://isc.sans.edu/data/threatmap.html

Yes at the moment the IPv6 internet is way more secure even without a firewall but there are possible attacks to enumerate the used IPv6 addresses. [0] [0]: https://isc.sans.edu/diary/Targeted+IPv6+Scans+Using+pool.ntp.org+./20…

Not specifically examples of arbitrary JS execution, but the SANS ISC has had a couple of posts in the last few days about Google Ads being used as an attack vector if anyone's interested: https://isc.sans.edu/diary/PSA+Why+you+must+run+an+ad+blocker+when+usi… and https://isc.sans.edu/diary/Malicious%20Google%20Ad%20--%3E%20Fake%20No… (and the second link contains links to a bunch of additional examples)

Also, as we learned back when Heartbleed was discovered, the OpenSSL code is not in good shape. It "suffers from maintenance", as one clever wag said about legacy code. There's a reason LibreSSL forked the code. More distributions need to switch away from OpenSSL. And before anyone pipes up, I'm not claiming LibreSSL does not and will not ever haver vulnerabilities. I'm saying that ripping stuff like punycode out of the library reduces the attack surface. https://isc.sans.edu/diary/rss/29208

Looks like this is trending over in SANS as well: https://isc.sans.edu/diary/rss/28392

Proper URL: https://isc.sans.edu/forums/diary/A+Quick+CVE202221907+FAQ+work+in+pro… (was rewritten by HN for some reason)

There seems to be bot posting broken links to these diary entries, correct link is https://isc.sans.edu/forums/diary/Searching+for+Exposed+ASUS+Routers+V…