![]() |
|
|
|
Malware Delivered via Windows Installer Files, (Sat, Feb 17th)For some days, I collected a few samples of malicious MSI files. MSI files are Windows installer files that users can execute to install software on a Microsoft Windows system. Of course, you can replace “software” with “malware”. MSI files look less suspicious and they could bypass simple filters based on file extensions like “(com|exe|dll|js|vbs|…)”. They also look less dangerous because they are Composite Document Files:
Categories: Security
ISC Stormcast For Friday, February 16th 2018 https://isc.sans.edu/podcastdetail.html?id=5873, (Fri, Feb 16th)Categories: Security
ISC Stormcast For Thursday, February 15th 2018 https://isc.sans.edu/podcastdetail.html?id=5871, (Thu, Feb 15th)Categories: Security
ISC Stormcast For Wednesday, February 14th 2018 https://isc.sans.edu/podcastdetail.html?id=5869, (Wed, Feb 14th)Categories: Security
February 2018 Microsoft (and Adobe) Patch Tuesday , (Tue, Feb 13th)I will update this diary as additional bulletins are released. Microsoft marked adobe's bulletin as "not yet exploited". However, according to Adobe and reports from the Korean Cert, one of the vulnerabilities has already been exploited, so I am marking it differently here, and assign it a "Patch Now" rating. Not much detail has been made public yet about this vulnerability, which is why I am leaving the "Disclosed" rating at "No".
Categories: Security
ISC Stormcast For Tuesday, February 13th 2018 https://isc.sans.edu/podcastdetail.html?id=5867, (Tue, Feb 13th)Categories: Security
Analyzing compressed shellcode, (Mon, Feb 12th)I received a malicious RTF file with several stages (PowerShell commands), containing Gzip compressed shellcode.
Categories: Security
ISC Stormcast For Monday, February 12th 2018 https://isc.sans.edu/podcastdetail.html?id=5865, (Mon, Feb 12th)Categories: Security
Finding VBA signatures in Word documents, (Sun, Feb 11th)One of my former students contacted me after reading my last diary entry "An autograph from the Dridex gang" with a question: how to detect Word documents with signed VBA code?
Categories: Security
Increase in port 2580 probe sources, (Fri, Feb 9th)Reviewing the dashboards at the ISC today revealed an anomaly on port 2580. Over the last couple days the number of sources probing for port 2580 has increased by nearly 600x from near none historically.
Categories: Security
An autograph from the Dridex gang, (Fri, Feb 9th)Reader Wayne Smith submitted a PDF file attached to a malicious email.
Categories: Security
ISC Stormcast For Friday, February 9th 2018 https://isc.sans.edu/podcastdetail.html?id=5863, (Fri, Feb 9th)Categories: Security
SQL injection and division by zero exceptions, (Thu, Feb 8th)SQL injections are my favorite vulnerabilities. Of course, every penetration tester loves them since they are (in most cases) critical, however what I like with them is that there are so many ways to exploit even the apparently-looking remote or unexploitable cases.
Categories: Security
ISC Stormcast For Thursday, February 8th 2018 https://isc.sans.edu/podcastdetail.html?id=5861, (Thu, Feb 8th)Categories: Security
ISC Stormcast For Wednesday, February 7th 2018 https://isc.sans.edu/podcastdetail.html?id=5859, (Wed, Feb 7th)Categories: Security

Flaw in Grammarly Chrome Extension Leaves Millions of Private Documents Exposed: http://www.zdnet.com/article/grammarly-flawed-chrome-extension-exposed-private-documents/#ftag=RSSbaffb68, (Tue, Feb 6th)--
Categories: Security
ISC Stormcast For Tuesday, February 6th 2018 https://isc.sans.edu/podcastdetail.html?id=5857, (Tue, Feb 6th)Categories: Security
Analyzing an HTA file: Update, (Mon, Feb 5th)A reader asked what the &H?? strings were in the malware I analyzed in my last diary entry. These are numbers in VBA written in hexadecimal.
Categories: Security
|