Talos Intelligence Blog

Google and Gmail account for a very small amount of the global mail-flow and have even less of an impact on standards. In fact they only appear as a contributor/author on RFC8617 (ARC). No standard says, or even suggest, that “residential ips are not valid.” However, reputation is an important par of mail security. Most, if not all residential IPs won’t be sending enough mail to even register a reputation (look up your own on https://talosintelligence.com/). This is the main challenge for self-hosters. That and a significant majority of residential ISPs block SMTP traffic, for very obvious reasons. This isn’t some Google/Microsoft conspiracy. SMTP is fundamentally a plain text format that has been abused for the last 30 or so years - 30, because that’s when MIME became a thing.

Hi, It's probably a combination of young domain, and associated IPs blocked from mail. Check on Cisco Talos https://talosintelligence.com/ Submit ticket: https://talosintelligence.com/reputation_center/support#reputation

This issue aside, I wasn't aware of https://talosintelligence.com/ The information there is very interesting.

This is much better source than the TALOS website[0]. Clearly spells down the impact. Somewhat related, the Alpine Linux security mailing list is currently marked as "inactive". For a distro that calls itself: "Alpine Linux is a security-oriented, lightweight Linux distribution based on musl libc and busybox." I find it very weird that there is no way to subscribe to security notifications. [0]: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0782

It's sloppy writing. They mean it is the empty string in /etc/shadow. Following some links from the CVE, you can find the details (from https://talosintelligence.com/vulnerability_reports/TALOS-2019-0782): > In builds of the Alpine Docker Image (>=3.3) the /etc/shadow file contains a blank field in place of the encrypted password > ... > The net result of a blank sp_pwdp field is that the system will treat the root user as having no password, rather than a 'locked' account if a ! or is explicitly specified.* For those not super familiar with how Unix/Linux password files work, if the field is non-empty, the system will collect a password, hash it, and compare for a match. If the field is empty, the system will just skip prompting for a password and log you in after entering a username. Arguably, this is crappy design and a better design for /etc/shadow would be to require some kind of explicit, very obvious value like "NO-PASSWORD-REQUIRED".

Ask those users who the vendor of the firewall is (or have them ask their IT department) and reach out to them. It's probably one specific vendor. It might not even be on any kind of list, could easily be some kind of heuristic matching some traffic pattern or even it not liking your domain name or IP somehow. You can check your domain in things like https://talosintelligence.com/reputation_center/lookup?search=crewsum.… or other domain reputation engines. But nothing seems wrong with it.

> I used the zoom native client and not the web one You might want to reconsider that; they have a pretty bad security track record: https://www.securemac.com/news/zoom-security-flaw-puts-you-at-risk-eve… https://talosintelligence.com/vulnerability_reports/TALOS-2020-1055 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1056 https://blog.0patch.com/2020/07/remote-code-execution-vulnerability-in…

Anyone have an alternative link? My company relies on Cisco's reputation system[0] to decide if a domain should be blocked. Oddly, thinkingagriculture.io is "untrusted | poor". [0] https://talosintelligence.com/reputation_center/lookup?search=http%3A%…

This has actually happened before. [0] > An exploitable code execution vulnerability exists in the QR code scanning functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted QR Code can cause a buffer overflow, resulting in code execution. [0] https://talosintelligence.com/vulnerability_reports/TALOS-2018-0571

Later down the thread it shows that OVH Hosting's reputation is probably the reason why it's marked as spam. https://talosintelligence.com/reputation_center/lookup?search=OVH%20Ho… ^ pretty nifty look at how your neighbors screw you sometimes

Check your neighborhood :) you can use Talos to see the reputation of your IP block and ASN: https://talosintelligence.com/reputation_center/lookup

Hmm? Per the Date Entry Created this was reported months ago (EDIT: I can't read), although the linked report (https://talosintelligence.com/vulnerability_reports/TALOS-2019-0782) was posted today

I believe it's public on their GitHub since 5 Aug 2018. https://github.com/gliderlabs/docker-alpine/issues/430 > 2019-03-01 - It was discovered that this issue was also reported and made public in their Github prior to our report, but was not flagged as a security issue and thus remained unresolved until it was rediscovered and reported by Cisco. https://talosintelligence.com/vulnerability_reports/TALOS-2019-0782

2019 not 2018. https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-075…

Is the advisory page loading for others? https://www.talosintelligence.com/reports/TALOS-2018-0758 404s

To report a false positive blacklisting to Outlook.com: https://support.microsoft.com/en-us/getsupport?oaspworkflow=start_1.0.… Check your /24 neighborhood first though, one of your neighbors might be sending spam: https://www.talosintelligence.com/reputation_center/lookup

If you're allergic to Forbes, I wrote a short summary on my company blog: https://thisdata.com/blog/bug-in-apple-products-allows-password-steali… Tyler Bohan's original disclosure writeup (with some technial details) is here: http://www.talosintelligence.com/reports/TALOS-2016-0171/

If you go down to the bottom of the article they actually provide the link to the Apple Update page[1]. The actual vulnerability report page [2]. They also have a zeroday report for LibTiff so I guess they found something similar in the library. [1]: https://support.apple.com/en-us/HT206902 [2]: http://www.talosintelligence.com/reports/TALOS-2016-0171/

First, you need to set up the technical side: rDNS, SPF, DKIM, DMARC, no IPv6, TLS, etc. Lots of guides on the internet for that. After setting up the technical side (which you can test with a site like https://www.mail-tester.com), you need an IP (v4) without a bad reputation. This is the hardest part, because it's less easy to control. If your IP has been used to send spam, or sometimes even the neighbouring IP's, you won't get through to a lot of providers. These are the best places (in my experience) to check IP reputation: https://talosintelligence.com/reputation_center/lookup https://senderscore.org https://www.barracudacentral.org/lookups/lookup-reputation And also check for blacklists, for example with https://mxtoolbox.com/blacklists.aspx. If your IP is on a blacklist, you can remove is most of the time by requesting it via their (90's looking) websites. Also, if you send a lot of mail, Microsoft and Google have programs for senders to monitor reputation: https://sendersupport.olc.protection.outlook.com/snds/ https://www.gmail.com/postmaster/ But... even with an IP with a neutral reputation, your mails may be sent to the spambox. You need some volume of legitimate email over time to build trust (this is called warming up an IP).

I'm not an analyst, but I'm in the field. It's broad, and not many good targeted communities exist that I know of. Here is my current list of places to check regularly. Let me know if you know of others! ## Social https://www.reddit.com/user/goretsky/m/security/ - compliation of 90-100 security subreddits. ## Security / Tech News https://www.darkreading.com/ https://www.bleepingcomputer.com/ https://news.ycombinator.com/ https://nakedsecurity.sophos.com/ https://threatpost.com/ https://blog.erratasec.com/ https://krebsonsecurity.com/ https://medium.com/mitre-attack https://threatpost.com/ ## Threat updates / SOC https://www.securitywizardry.com/radar.htm - dashboard - virus news, latest alert feeds https://www.talosintelligence.com/ - reputation lookup for networks & vuln reports ## Podcasts http://defensivesecurity.org/ https://securityledger.com/ https://securityweekly.com/ https://risky.biz ## Slack Communities OWASP - owasp.slack.com DFIR IR - dfircommunity.slack.com - mostly around the Demisto products, but some other discussion as well Hangops Infosec - hangops.slack.com - infosec channel

It is totally awesome that function similarity is seeing the light of day. Google bought Zynamics way back when and their work has evolved a lot since then. This sort of work has big implications in signature generation for malware samples, for clustering families of samples as well as finding common functions to generate detections on. You couldn't necessarily throw this into a detection engine, because we don't have a fast (dedicated) function recovery tool for binaries, but you can absolutely use it to generate byte based detection from a seed of a few samples. Rather than having hash based signatures you could generate signatures that cover many samples (and likely new ones) in bulk. Normally a good signature like that requires manual effort from an analyst, this is a step toward machines doing it. As well, a central authoritative name database that could say "this is Petya" could force some sane naming convention on the industry (every AV wouldn't just be like "it's Zbot lol"). This stuff can even aid manual reverse engineering. You could build a function naming database that uses this. Maybe a new engine for Talos FIRST. [1] Then if you opened up a file without debug symbols this could match it to known functions and really speed up reverse engineering efforts. I look forward to reading it in more detail tomorrow. Thanks to Halvar for putting this out. 1. https://www.talosintelligence.com/first