SANS Internet Storm Center Handler

Recent Diaries:

• Wipe the drive! Stealthy Malware Persistence - Part 4
• Wipe the drive! Stealthy Malware Persistence - Part 3
• AVG detect legit file as virus
• Wipe the drive! Stealthy Malware Persistence - Part 2
• Wipe the drive! Stealthy Malware Persistence Mechanism - Part 1

SANS Internet Storm Center Handler

Recent Diaries:

• FYI: Anonymous Planning "OpUSA" Attacks on Banks and US Gov't on May 7th. More Info as Relevant to Come.
• A Chargen-based DDoS? Chargen is still a thing?
• ISC Handler Lenny Zeltser's REMnux v4 Reviewed on Hak5
• UPDATEDx1: Boston-Related Malware Campaigns Have Begun - Now with Waco Plant Explosion Fun
• Fake Boston Marathon Scams Update

SANS Internet Storm Center Handler

Click to  View Handler Created Tools

Recent Diaries:

• Safe - Tools, Tactics and Techniques
• Port 51616 - Got Packets?
• Apple ID Two-step Verification Now Available in some Countries
• IPv6 Focus Month: IPv6 Encapsulation - Protocol 41
• Apple Blocking Java Web plug-in

SANS Internet Storm Center Handler

Click to  View Handler Page

Recent Diaries:

• NBC site redirecting to Exploit kit
• Cyber Security Awareness Month - Day 14 - Poor Man's File Analysis System - Part 1
• Simple Malware Research Tools
• The RedRet connection...
• Updates on ZeroAccess and BlackHole front...

SANS Internet Storm Center Handler

Click to  View Handler Page

Recent Diaries:

• So what passwords are those ssh scanners trying?
• Is there an epidemic of typo squatting?
• IPv6 Focus Month: Guest Diary: Matthew Newton - IPv6 Cat Feeder - Turning those extra bits into bytes, literally
• IPv6 Focus Month at the Internet Storm Center
• And the Java 0-days just keep on coming

SANS Internet Storm Center Handler

Recent Diaries:

• Privilege escalation, why should I care?
• Moore, Oklahoma tornado charitable organization scams, malware, and phishing
• Phishing/spam via SMS
• YYABCAFU - Yes Yet Another Bleeping Critical Adobe Flash Update
• RuggedCom fails key management 101 on Rugged Operating System (ROS)

SANS Internet Storm Center Handler

Click to  View Handler Page

Recent Diaries:

• Cisco TelePresence Supervisor MSE 8050 Denial of Service Vulnerability
• Call for Papers - 4th annual Forensics and Incident Response Summit EU
• Microsoft re-releases MS12-078
• VMWare posts some updates
• Adobe certification revocation for October 4th

SANS Internet Storm Center Handler

Recent Diaries:

• Apple Blocks Older Insecure Versions of Flash Player
• Evernote Security Issue
• Blocking SSH to Limit Security Exposures
• Oracle Releases Java Security Updates
• Apple iTunes Security Update

SANS Internet Storm Center Handler

Recent Diaries:

• Microsoft May 2013 Black Tuesday Overview
• Microsoft Security Advisory overview
• CVE-2013-2094: Linux privilege escalation
• Microsoft Security Advisory 2846338
• Firefox & Thunderbird released

SANS Internet Storm Center Handler

Recent Diaries:

• Another Company Falls Victim
• Badware 2011
• Merry Christmas, Happy Holidays
• Links on your Facebook Wall
• Data Encryption Ban? Really?

SANS Internet Storm Center Handler

Recent Diaries:

• Java 0-Day patched as Java 7 U 11 released
• Sysinternals Updates
• You encrypt your laptops, but what about portable media?
• Oracle Patch Tuesday Pre-Release
• Java 0-day impact to Java 6 (and beyond?)

SANS Internet Storm Center Handler

Recent Diaries:

• Interesting Credit Card transactions, are you seeing similar?
• Verizon Data Breach report has been released
• MS13-036 has been re-released
• KB2823324 causing boot issues in Brazil and some other locales
• Windows XP end of life, 12 months to go.

SANS Internet Storm Center Handler

Recent Diaries:

• Fedora RedHat Vulnerabilty Released
• Is it Really an Attack?
• What's important on your network?
• Potential Phish for Regular Webmail Accounts
• Demonstrating the value of your Intrusion Detection Program and Analysts

SANS Internet Storm Center Handler

Recent Diaries:

• Potential 0-day on Bind 9
• Microsoft killed Kelihos botnet
• MySQL.com compromised spreading malware
• Firefox 3.5 forced upgrade coming soon
• Microsoft Security Intelligence Report volume 10

SANS Internet Storm Center Handler

Recent Diaries:

• How Your Webhosting Account is Getting Hacked
• Untangling the News from South Korea
• Why I think you should try Bro
• "My Computer is Acting Strangely"
• Twitter Confirms Compromise of Approximately 250,000 Users

SANS Internet Storm Center Handler

Click to  View Handler Page

Click to  View Handler Created Tools

Recent Diaries:

• A Puzzlement...
• New, odd SSH brute force behavior
• What's In A Name?
• Security 101 : Security Basics in 140 Characters Or Less
• The Strange Case of Doctor Jekyll and Mr. ED

SANS Internet Storm Center Handler

Click to  View Handler Created Tools

Recent Diaries:

• Apache binary backdoor adds malicious redirect to Blackhole
• SANS's Alan Paller discusses the threat of cyberterrorism on CNN
• What is "up to date anti-virus software"?
• Microsoft's Security Intelligence Report (SIRv14) released
• Java 8 release schedule delayed for renewed focus on security

SANS Internet Storm Center Handler

Recent Diaries:

• Syria drops from Internet 7th May 2013
• Fake Link removal requests
• Does your breach email notification look like a phish?
• VMware releases new and updated security advisories
• Starting the New Year on the right foot

SANS Internet Storm Center Handler

Click to  View Handler Created Tools

Recent Diaries:

• Apple iTunes Services Outage
• IPv6 Focus Month: Traffic Testing, Firewalls, ACLs, pt 1
• Uptick in MSSQL Activity
• Getting Involved with the Local Community
• Using Metasploit for Patch Sanity Checks

SANS Internet Storm Center Handler

Recent Diaries:

• New Internet Storm Center Director
• A Day In The Life Of A DShield Sensor
• Stuxnet Analysis
• Cyber Security Awareness Month - Day 31 - Tying it all together
• Cyber Security Awareness Month - Day 15 - What Teachers Need to Know About Their Students

SANS Internet Storm Center Handler

Recent Diaries:

• More massive malicious spam! This time claiming to be from Almacenes Exito
• Massive Google scam sent by email to Colombian domains
• SANS SCADA Summit at Orlando - Bigger problems and so far from getting them solved
• What can happen within a cyberterrorist attack to the electrical grid of a country?
• New year and new CA compromised

SANS Internet Storm Center Handler

Recent Diaries:

• Port 51616 - Got Packets?
• The Zero-Day Pendulum Swings
• Spamhaus DDOS
• Is it Spam or Is it Malware?
• Cyber Security Awareness Month - Day 29 - Clear Desk: The Unacquainted Standard

SANS Internet Storm Center Handler

Recent Diaries:

• DNS-Changer "clean DNS" extension requested
• GlobalSign releases security incident report.
• New feature in JUNOS to drop or ignore path attributes.
• New Mac Trojan: BASH/QHost.WB
• Health or Performance monitoring to detect security events.

SANS Internet Storm Center Handler

Click to  View Handler Page

Recent Diaries:

• Ubuntu Package available to submit firewall logs to DShield
• SSL: Another reason not to ignore IPv6
• Microsoft and Adobe Patch Tuesday Pre-Release
• "De Flashing" the ISC Web Site and Flash XSS issues
• Are there any websites that are NOT compromised?

SANS Internet Storm Center Handler

Click to  View Handler Created Tools

Recent Diaries:

• Java 7 Update 21 is available - Watch for Behaviour Changes !
• Oops - You Mean That Deleted Server was a Certificate Authority?
• Sourcefire VRT Community ruleset is live
• Several Cisco IOS DOS Issues Resolved
• Which IPS is "The Best"?

SANS Internet Storm Center Handler

Recent Diaries:

• Microsoft August 2012 Black Tuesday Update - Overview
• Interesting scan for medical certification information...
• OpenDNS is looking for a few good malware people!
• TippingPoint DNS Version Request increase
• Excellent Security Education Resources

SANS Internet Storm Center Handler

Recent Diaries:

• e-netprotections.su ?
• Extracting signatures from Apple .apps
• The cost of cleaning up
• How your Webhosting Account is Getting Abused
• Parsing Windows Eventlogs in Powershell

SANS Internet Storm Center Handler

Click to  View Handler Created Tools

Recent Diaries:

• SSHD rootkit in the wild
• Auditd is your friend
• Memory acquisition traps
• Analyzing outgoing network traffic (part 2)
• Analyzing outgoing network traffic

SANS Internet Storm Center Handler

Click to  View Handler Created Tools

Recent Diaries:

• Extracting Digital Signatures from Signed Malware
• It's a Dangerous Web Out There
• Fake Mandiant APT Report Used as Malware Lure
• Challenges of Anti-Phishing Advice, the Google Docs Edition
• Scam Report - Fake Voice Mail Email Notification Redirects to Malicious Site