LAYER 2 SWITCH NETWORK PROTECTIONS MAN IN THE MIDDLE MITM ATTACK |
| 2009-11-11 | Rob VandenBrink | Layer 2 Network Protections against Man in the Middle Attacks |
LAYER |
| 2019-10-10/a> | Rob VandenBrink | Mining Live Networks for OUI Data Oddness |
| 2019-09-26/a> | Rob VandenBrink | Mining MAC Address and OUI Information |
| 2016-10-26/a> | Johannes Ullrich | Critical Flash Player Update APSB16-36 |
| 2015-01-23/a> | Adrien de Beaupre | Infocon change to yellow for Adobe Flash issues |
| 2014-04-28/a> | Russ McRee | Adobe Security Bulletin: Security updates available for Adobe Flash Player http://adobe.ly/QVjO72 |
| 2013-03-02/a> | Scott Fendley | Apple Blocks Older Insecure Versions of Flash Player |
| 2012-11-08/a> | Daniel Wesemann | Adobe Patches |
| 2012-10-24/a> | Rob VandenBrink | Time to run Windows Update - - Microsoft Updates KB2755801 for Windows RT / IE10 / Flash Player - http://technet.microsoft.com/en-us/security/advisory/2755801 |
| 2012-10-09/a> | Johannes Ullrich | Adobe Flash Player update http://www.adobe.com/support/security/bulletins/apsb12-22.html |
| 2012-09-20/a> | Russ McRee | Flash Player update but no announcement, check your version http://www.adobe.com/software/flash/about/ |
| 2012-08-03/a> | Guy Bruneau | Flash Player 11.3.300.270 for Windows released to address a crash - http://forums.adobe.com/message/4594596#4594596 |
| 2012-03-28/a> | Kevin Shortt | Adobe Flash Player APSB12-07 - 28 March 2012 |
| 2012-03-05/a> | Johannes Ullrich | Adobe Flash Player Security Update |
| 2012-02-16/a> | Johannes Ullrich | Adobe Flash Player Update |
| 2011-04-11/a> | Johannes Ullrich | Layer 2 DoS and other IPv6 Tricks |
| 2010-11-01/a> | Manuel Humberto Santander Pelaez | CVE-2010-3654 exploit in the wild |
| 2010-10-30/a> | Guy Bruneau | Security Update for Shockwave Player |
| 2010-08-25/a> | Pedro Bueno | Adobe released security update for Shockwave player that fix several CVEs: APSB1020 |
| 2010-06-16/a> | Kevin Shortt | Adobe Flash Player 10.1 - Security Update Available |
| 2010-06-05/a> | Guy Bruneau | Security Advisory for Flash Player, Adobe Reader and Acrobat |
| 2010-05-12/a> | Rob VandenBrink | Layer 2 Security - Private VLANs (the Story Continues ...) |
| 2010-02-12/a> | G. N. White | Adobe Flash Player 10.0.45.2 and AIR 1.5.3.9130 released to correct vulnerability CVE-2010-0186 Details: http://www.adobe.com/support/security/bulletins/apsb10-06.html |
| 2010-01-12/a> | Johannes Ullrich | Microsoft Advices XP Users to Uninstall Flash Player 6 |
| 2009-12-07/a> | Rob VandenBrink | Layer 2 Network Protections – reloaded! |
| 2009-11-11/a> | Rob VandenBrink | Layer 2 Network Protections against Man in the Middle Attacks |
| 2009-01-21/a> | Raul Siles | Traffic increase for port UDP/8247 |
| 2008-05-27/a> | Adrien de Beaupre | Adobe flash player vuln |
| 2006-12-12/a> | Robert Danford | MS06-078: 2 Windows Media Format Vulnerabilities (CVE-2006-4702, CVE-2006-6134) |
2 |
| 2025-04-02/a> | Johannes Ullrich | Surge in Scans for Juniper "t128" Default User |
| 2025-02-27/a> | Xavier Mertens | Njrat Campaign Using Microsoft Dev Tunnels |
| 2025-01-30/a> | Guy Bruneau | PCAPs or It Didn't Happen: Exposing an Old Netgear Vulnerability Still Active in 2025 [Guest Diary] |
| 2024-12-15/a> | Johannes Ullrich | Exploit attempts inspired by recent Struts2 File Upload Vulnerability (CVE-2024-53677, CVE-2023-50164) |
| 2024-12-11/a> | Guy Bruneau | Vulnerability Symbiosis: vSphere?s CVE-2024-38812 and CVE-2024-38813 [Guest Diary] |
| 2024-08-20/a> | Johannes Ullrich | Where are we with CVE-2024-38063: Microsoft IPv6 Vulnerability |
| 2024-04-23/a> | Johannes Ullrich | Struts "devmode": Still a problem ten years later? |
| 2024-03-14/a> | Jan Kopriva | Increase in the number of phishing messages pointing to IPFS and to R2 buckets |
| 2023-12-20/a> | Guy Bruneau | How to Protect your Webserver from Directory Enumeration Attack ? Apache2 [Guest Diary] |
| 2023-11-30/a> | John Bambenek | Prophetic Post by Intern on CVE-2023-1389 Foreshadows Mirai Botnet Expansion Today |
| 2023-11-22/a> | Guy Bruneau | CVE-2023-1389: A New Means to Expand Botnets |
| 2023-11-06/a> | Johannes Ullrich | Exploit Activity for CVE-2023-22518, Atlassian Confluence Data Center and Server |
| 2023-08-28/a> | Didier Stevens | Analysis of RAR Exploit Files (CVE-2023-38831) |
| 2023-08-25/a> | Xavier Mertens | Python Malware Using Postgresql for C2 Communications |
| 2023-07-12/a> | Brad Duncan | Loader activity for Formbook "QM18" |
| 2023-06-22/a> | Brad Duncan | Qakbot (Qbot) activity, obama271 distribution tag |
| 2023-06-17/a> | Brad Duncan | Formbook from Possible ModiLoader (DBatLoader) |
| 2023-05-14/a> | Guy Bruneau | VMware Aria Operations addresses multiple Local Privilege Escalations and a Deserialization issue |
| 2023-05-09/a> | Russ McRee | Exploratory Data Analysis with CISSM Cyber Attacks Database - Part 2 |
| 2023-03-25/a> | Guy Bruneau | Microsoft Released an Update for Windows Snipping Tool Vulnerability |
| 2023-02-22/a> | Johannes Ullrich | Internet Wide Scan Fingerprinting Confluence Servers |
| 2022-12-22/a> | Guy Bruneau | Exchange OWASSRF Exploited for Remote Code Execution |
| 2022-12-16/a> | Guy Bruneau | VMware Security Updates |
| 2022-12-10/a> | Didier Stevens | Open Now: 2022 SANS Holiday Hack Challenge & KringleCon |
| 2022-10-24/a> | Xavier Mertens | C2 Communications Through outlook.com |
| 2022-10-15/a> | Guy Bruneau | Malware - Covid Vaccination Supplier Declaration |
| 2022-10-07/a> | Xavier Mertens | Powershell Backdoor with DGA Capability |
| 2022-08-26/a> | Guy Bruneau | HTTP/2 Packet Analysis with Wireshark |
| 2022-08-22/a> | Xavier Mertens | 32 or 64 bits Malware? |
| 2022-08-14/a> | Johannes Ullrich | Realtek SDK SIP ALG Vulnerability: A Big Deal, but not much you can do about it. CVE 2022-27255 |
| 2022-07-23/a> | Guy Bruneau | Analysis of SSH Honeypot Data with PowerBI |
| 2022-06-09/a> | Brad Duncan | TA570 Qakbot (Qbot) tries CVE-2022-30190 (Follina) exploit (ms-msdt) |
| 2022-05-13/a> | Johannes Ullrich | From 0-Day to Mirai: 7 days of BIG-IP Exploits |
| 2022-04-28/a> | Johannes Ullrich | A Day of SMB: What does our SMB/RPC Honeypot see? CVE-2022-26809 |
| 2022-04-14/a> | Johannes Ullrich | An Update on CVE-2022-26809 - MSRPC Vulnerabliity - PATCH NOW |
| 2022-01-12/a> | Johannes Ullrich | A Quick CVE-2022-21907 FAQ |
| 2022-01-02/a> | Guy Bruneau | Exchange Server - Email Trapped in Transport Queues |
| 2021-12-19/a> | Didier Stevens | Office 2021: VBA Project Version |
| 2021-12-18/a> | Guy Bruneau | VMware Security Update - https://www.vmware.com/security/advisories/VMSA-2021-0030.html |
| 2021-12-14/a> | Johannes Ullrich | Log4j: Getting ready for the long haul (CVE-2021-44228) |
| 2021-12-11/a> | Johannes Ullrich | Log4j / Log4Shell Followup: What we see and how to defend (and how to access our data) |
| 2021-11-26/a> | Guy Bruneau | Searching for Exposed ASUS Routers Vulnerable to CVE-2021-20090 |
| 2021-11-20/a> | Guy Bruneau | Hikvision Security Cameras Potentially Exposed to Remote Code Execution |
| 2021-11-07/a> | Didier Stevens | Video: Decrypting Cobalt Strike Traffic With Keys Extracted From Process Memory |
| 2021-11-06/a> | Didier Stevens | Decrypting Cobalt Strike Traffic With Keys Extracted From Process Memory |
| 2021-10-30/a> | Guy Bruneau | Remote Desktop Protocol (RDP) Discovery |
| 2021-10-25/a> | Didier Stevens | Decrypting Cobalt Strike Traffic With a "Leaked" Private Key |
| 2021-10-16/a> | Guy Bruneau | Apache is Actively Scan for CVE-2021-41773 & CVE-2021-42013 |
| 2021-10-06/a> | Johannes Ullrich | Apache 2.4.49 Directory Traversal Vulnerability (CVE-2021-41773) |
| 2021-08-20/a> | Xavier Mertens | Waiting for the C2 to Show Up |
| 2021-08-03/a> | Johannes Ullrich | Three Problems with Two Factor Authentication |
| 2021-06-30/a> | Johannes Ullrich | CVE-2021-1675: Incomplete Patch and Leaked RCE Exploit |
| 2021-06-26/a> | Guy Bruneau | CVE-2019-9670: Zimbra Collaboration Suite XXE vulnerability |
| 2021-05-28/a> | Xavier Mertens | Malicious PowerShell Hosted on script.google.com |
| 2021-05-21/a> | Xavier Mertens | Locking Kernel32.dll As Anti-Debugging Technique |
| 2021-05-18/a> | Xavier Mertens | From RunDLL32 to JavaScript then PowerShell |
| 2021-04-02/a> | Xavier Mertens | C2 Activity: Sandboxes or Real Victims? |
| 2021-03-19/a> | Xavier Mertens | Pastebin.com Used As a Simple C2 Channel |
| 2021-02-25/a> | Jim Clausing | So where did those Satori attacks come from? |
| 2021-02-24/a> | Brad Duncan | Malspam pushes GuLoader for Remcos RAT |
| 2021-02-16/a> | Jim Clausing | More weirdness on TCP port 26 |
| 2021-02-02/a> | Xavier Mertens | New Example of XSL Script Processing aka "Mitre T1220" |
| 2020-12-18/a> | Jan Kopriva | A slightly optimistic tale of how patching went for CVE-2019-19781 |
| 2020-12-13/a> | Didier Stevens | KringleCon 2020 |
| 2020-12-10/a> | Xavier Mertens | Python Backdoor Talking to a C2 Through Ngrok |
| 2020-11-21/a> | Guy Bruneau | VMware privilege escalation vulnerabilities (CVE-2020-4004, CVE-2020-4005) - https://www.vmware.com/security/advisories/VMSA-2020-0026.html |
| 2020-10-29/a> | Johannes Ullrich | PATCH NOW: CVE-2020-14882 Weblogic Actively Exploited Against Honeypots |
| 2020-10-28/a> | Jan Kopriva | SMBGhost - the critical vulnerability many seem to have forgotten to patch |
| 2020-08-08/a> | Guy Bruneau | Scanning Activity Include Netcat Listener |
| 2020-08-04/a> | Johannes Ullrich | Reminder: Patch Cisco ASA / FTD Devices (CVE-2020-3452). Exploitation Continues |
| 2020-07-22/a> | Rick Wanner | A few IoCs related to CVE-2020-5902 |
| 2020-07-15/a> | Johannes Ullrich | PATCH NOW - SIGRed - CVE-2020-1350 - Microsoft DNS Server Vulnerability |
| 2020-07-06/a> | Johannes Ullrich | Summary of CVE-2020-5902 F5 BIG-IP RCE Vulnerability Exploits |
| 2020-05-19/a> | Rick Wanner | What is up on Port 62234? |
| 2020-05-14/a> | Rob VandenBrink | Patch Tuesday Revisited - CVE-2020-1048 isn't as "Medium" as MS Would Have You Believe |
| 2020-04-29/a> | Johannes Ullrich | Privacy Preserving Protocols to Trace Covid19 Exposure |
| 2020-02-21/a> | Xavier Mertens | Quick Analysis of an Encrypted Compound Document Format |
| 2020-02-18/a> | Jan Kopriva | Discovering contents of folders in Windows without permissions |
| 2020-01-16/a> | Bojan Zdrnja | Summing up CVE-2020-0601, or the Let?s Decrypt vulnerability |
| 2020-01-15/a> | Johannes Ullrich | CVE-2020-0601 Followup |
| 2020-01-13/a> | Didier Stevens | Citrix ADC Exploits: Overview of Observed Payloads |
| 2020-01-11/a> | Johannes Ullrich | Citrix ADC Exploits are Public and Heavily Used. Attempts to Install Backdoor |
| 2020-01-07/a> | Johannes Ullrich | A Quick Update on Scanning for CVE-2019-19781 (Citrix ADC / Gateway Vulnerability) |
| 2019-12-02/a> | Jim Clausing | Next up, what's up with TCP port 26? |
| 2019-11-18/a> | Johannes Ullrich | SMS and 2FA: Another Reason to Move away from It. |
| 2019-11-06/a> | Brad Duncan | More malspam pushing Formbook |
| 2019-11-01/a> | Didier Stevens | Tip: Password Managers and 2FA |
| 2019-10-10/a> | Rob VandenBrink | Mining Live Networks for OUI Data Oddness |
| 2019-09-26/a> | Rob VandenBrink | Mining MAC Address and OUI Information |
| 2019-08-01/a> | Johannes Ullrich | What is Listening On Port 9527/TCP? |
| 2019-07-18/a> | Rob VandenBrink | The Other Side of Critical Control 1: 802.1x Wired Network Access Controls |
| 2019-06-19/a> | Johannes Ullrich | Critical Actively Exploited WebLogic Flaw Patched CVE-2019-2729 |
| 2019-05-22/a> | Johannes Ullrich | An Update on the Microsoft Windows RDP "Bluekeep" Vulnerability (CVE-2019-0708) [now with pcaps] |
| 2019-04-28/a> | Johannes Ullrich | Update about Weblogic CVE-2019-2725 (Exploits Used in the Wild, Patch Status) |
| 2019-04-02/a> | Johannes Ullrich | Fake AV is Back: LaCie Network Drives Used to Spread Malware |
| 2019-03-29/a> | Remco Verhoef | Annotating Golang binaries with Cutter and Jupyter |
| 2019-03-15/a> | Remco Verhoef | Binary Analysis with Jupyter and Radare2 |
| 2019-03-09/a> | Guy Bruneau | A Comparison Study of SSH Port Activity - TCP 22 & 2222 |
| 2019-02-02/a> | Guy Bruneau | Scanning for WebDAV PROPFIND Exploiting CVE-2017-7269 |
| 2019-01-09/a> | Russ McRee | gganimate: Animate YouR Security Analysis |
| 2018-12-21/a> | Lorna Hutcheson | Phishing Attempts That Bypass 2FA |
| 2018-10-10/a> | Xavier Mertens | New Campaign Using Old Equation Editor Vulnerability |
| 2018-10-08/a> | Guy Bruneau | Latest Release of rockNSM 2.1 |
| 2018-08-31/a> | Jim Clausing | Quickie: Using radare2 to disassemble shellcode |
| 2018-08-20/a> | Didier Stevens | OpenSSH user enumeration (CVE-2018-15473) |
| 2018-06-27/a> | Renato Marinho | Silently Profiling Unknown Malware Samples |
| 2018-06-15/a> | Lorna Hutcheson | SMTP Strangeness - Possible C2 |
| 2018-06-01/a> | Remco Verhoef | Binary analysis with Radare2 |
| 2018-05-22/a> | Guy Bruneau | VMware updates enable Hypervisor-Assisted Guest Mitigations for Speculative Store Bypass issue - https://www.vmware.com/security/advisories/VMSA-2018-0012.html |
| 2018-01-19/a> | Jim Clausing | Followup to IPv6 brute force and IPv6 blocking |
| 2017-12-27/a> | Guy Bruneau | What are your Security Challenges for 2018? |
| 2017-10-16/a> | Johannes Ullrich | WPA2 "KRACK" Attack |
| 2017-09-08/a> | Adrien de Beaupre | YASRV (Yet Another Struts RCE Vulnerability) yes a different one from yesterday |
| 2017-09-05/a> | Johannes Ullrich | The Mirai Botnet: A Look Back and Ahead At What's Next |
| 2017-05-26/a> | Lorna Hutcheson | File2pcap - A new tool for your toolkit! |
| 2017-05-13/a> | Guy Bruneau | Microsoft Released Guidance for WannaCrypt |
| 2017-01-30/a> | Didier Stevens | py2exe Decompiling - Part 2 |
| 2016-10-22/a> | Guy Bruneau | Request for Packets TCP 4786 - CVE-2016-6385 |
| 2016-10-10/a> | Didier Stevens | Radare2: rahash2 |
| 2016-09-15/a> | Xavier Mertens | In Need of a OTP Manager Soon? |
| 2016-07-17/a> | Guy Bruneau | Juniper -> Junos: Self-signed certificate with spoofed trusted Issuer CN accepted as valid - https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10755&actp=search |
| 2016-07-05/a> | Johannes Ullrich | Apache Update: TLS Certificate Authentication Bypass with HTTP/2 (CVE-2016-4979) |
| 2016-05-18/a> | Russ McRee | Resources: Windows Auditing & Monitoring, Linux 2FA |
| 2016-03-13/a> | Guy Bruneau | A Look at the Mandiant M-Trends 2016 Report |
| 2016-03-06/a> | Jim Clausing | Novel method for slowing down Locky on Samba server using fail2ban |
| 2016-02-13/a> | Guy Bruneau | VMware VMSA-2015-0007.3 has been Re-released |
| 2016-01-31/a> | Guy Bruneau | OpenSSL 1.0.2 Advisory and Update |
| 2016-01-05/a> | Guy Bruneau | What are you Concerned the Most in 2016? |
| 2015-10-12/a> | Guy Bruneau | Critical Vulnerability in Multiple Cisco Products - Apache Struts 2 Command Execution http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2 |
| 2015-08-12/a> | Rob VandenBrink | Wireshark 1.12.7 is released, multiple fixes. Find the release notes at: https://www.wireshark.org/docs/relnotes/wireshark-1.12.7.html and the binaries at: https://www.wireshark.org/download.html |
| 2015-07-12/a> | Guy Bruneau | PHP 5.x Security Updates |
| 2015-06-16/a> | John Bambenek | CVE-2014-4114 and an Interesting AV Bypass Technique |
| 2015-04-15/a> | Johannes Ullrich | MS15-034: HTTP.sys (IIS) DoS And Possible Remote Code Execution. PATCH NOW |
| 2015-02-05/a> | Johannes Ullrich | Adobe Flash Player Update Released, Fixing CVE 2015-0313 |
| 2015-01-27/a> | Johannes Ullrich | New Critical GLibc Vulnerability CVE-2015-0235 (aka GHOST) |
| 2014-09-25/a> | Johannes Ullrich | Update on CVE-2014-6271: Vulnerability in bash (shellshock) |
| 2014-09-24/a> | Pedro Bueno | Attention *NIX admins, time to patch! |
| 2014-09-22/a> | Johannes Ullrich | Cyber Security Awareness Month: What's your favorite/most scary false positive |
| 2014-08-23/a> | Guy Bruneau | NSS Labs Cyber Resilience Report |
| 2014-07-07/a> | Johannes Ullrich | Multi Platform *Coin Miner Attacking Routers on Port 32764 |
| 2014-06-30/a> | Johannes Ullrich | Should I setup a Honeypot? [SANSFIRE] |
| 2014-06-12/a> | Johannes Ullrich | Metasploit now includes module to exploit CVE-2014-0195 (OpenSSL DTLS Fragment Vuln.) |
| 2014-05-23/a> | Richard Porter | Highlights from Cisco Live 2014 - The Internet of Everything |
| 2014-04-08/a> | Guy Bruneau | OpenSSL CVE-2014-0160 Fixed |
| 2014-03-24/a> | Johannes Ullrich | New Microsoft Advisory: Unpatched Word Flaw used in Targeted Attacks |
| 2014-03-02/a> | Stephen Hall | Symantec goes yellow |
| 2014-02-27/a> | Richard Porter | DDoS and BCP 38 |
| 2014-02-07/a> | Rob VandenBrink | New ISO Standards on Vulnerability Handling and Disclosure |
| 2013-12-05/a> | Mark Hofman | Updated Standards Part 1 - ISO 27001 |
| 2013-11-28/a> | Rob VandenBrink | Microsoft Security Advisory (2914486): Vulnerability in Microsoft Windows Kernel 0 day exploit in wild |
| 2013-10-25/a> | Rob VandenBrink | Kaspersky flags TCPIP.SYS as Malware |
| 2013-10-15/a> | Rob VandenBrink | CSAM: Microsoft Logs - NPS and IAS (RADIUS) |
| 2013-10-10/a> | Mark Hofman | CSAM Some more unusual scans |
| 2013-10-09/a> | Johannes Ullrich | CSAM: SSL Request Logs |
| 2013-10-02/a> | Johannes Ullrich | CSAM: Misc. DNS Logs |
| 2013-10-01/a> | Adrien de Beaupre | CSAM! Send us your logs! |
| 2013-10-01/a> | John Bambenek | *Metaspoit Releases Module to Exploit Unpatched IE Vuln CVE-2013-3893 |
| 2013-09-20/a> | Russ McRee | Threat Level Yellow: Protection recommendations regarding Internet Explorer exploits in the wild |
| 2013-09-18/a> | Rob VandenBrink | Cisco DCNM Update Released |
| 2013-09-17/a> | John Bambenek | Microsoft Releases Out-of-Band Advisory for all Versions of Internet Explorer |
| 2013-08-16/a> | Kevin Liston | CVE-2013-2251 Apache Struts 2.X OGNL Vulnerability |
| 2013-08-09/a> | Kevin Shortt | Copy Machines - Changing Scanned Content |
| 2013-07-06/a> | Guy Bruneau | Microsoft July Patch Pre-Announcement |
| 2013-06-01/a> | Guy Bruneau | Exploit Sample for Win32/CVE-2012-0158 |
| 2013-05-20/a> | Guy Bruneau | Safe - Tools, Tactics and Techniques |
| 2013-05-09/a> | Johannes Ullrich | Microsoft released a Fix-it for the Internet Explorer 8 Vulnerability http://support.microsoft.com/kb/2847140 |
| 2013-04-25/a> | Adam Swanger | SANS 2013 Forensics Survey - https://www.surveymonkey.com/s/2013SANSForensicsSurvey |
| 2013-04-16/a> | Rob VandenBrink | Java 7 Update 21 is available - Watch for Behaviour Changes ! |
| 2013-03-25/a> | Johannes Ullrich | IPv6 Focus Month: IPv6 over IPv4 Preference |
| 2013-02-22/a> | Chris Mohan | PHP 5.4.12 and PHP 5.3.22 released http://www.php.net/ChangeLog-5.php |
| 2013-02-11/a> | John Bambenek | OpenSSL 1.0.1e Released with Corrected fix for CVE-2013-1069, more here: http://www.openssl.org/ |
| 2013-01-19/a> | Guy Bruneau | Java 7 Update 11 Still has a Flaw |
| 2013-01-10/a> | Rob VandenBrink | What Else runs Telnets? Or, Pentesters Love Video Conferencing Units Too! |
| 2013-01-09/a> | Richard Porter | The 80's called - They Want Their Mainframe Back! |
| 2013-01-07/a> | Adam Swanger | Please consider participating in our 2013 ISC StormCast survey at http://www.surveymonkey.com/s/stormcast |
| 2013-01-04/a> | Guy Bruneau | "FixIt" Patch for CVE-2012-4792 Bypassed |
| 2012-10-30/a> | Mark Hofman | Cyber Security Awareness Month - Day 30 - DSD 35 mitigating controls |
| 2012-10-29/a> | Kevin Shortt | Cyber Security Awareness Month - Day 29 - Clear Desk: The Unacquainted Standard |
| 2012-10-26/a> | Russ McRee | Cyber Security Awareness Month - Day 26 - Attackers use trusted domain to propagate Citadel Zeus variant |
| 2012-10-25/a> | Richard Porter | Cyber Security Awareness Month - Day 25 - Pro Audio & Video Packets on the Wire |
| 2012-10-24/a> | Russ McRee | Cyber Security Awareness Month - Day 24 - A Standard for Information Security Incident Management - ISO 27035 |
| 2012-10-23/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 23: Character Encoding Standards - ASCII and Successors |
| 2012-10-21/a> | Johannes Ullrich | Cyber Security Awareness Month - Day 22: Connectors |
| 2012-10-19/a> | Johannes Ullrich | Cyber Security Awareness Month - Day 19: Standard log formats and CEE. |
| 2012-10-18/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 18 - Vendor Standards: The vSphere Hardening Guide |
| 2012-10-17/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 17 - A Standard for Risk Management - ISO 27005 |
| 2012-10-16/a> | Richard Porter | CyberAwareness Month - Day 15, Standards Body Soup (pt2), Same Soup Different Cook. |
| 2012-10-16/a> | Johannes Ullrich | Cyber Security Awareness Month - Day 16: W3C and HTML |
| 2012-10-14/a> | Pedro Bueno | Cyber Security Awareness Month - Day 14 - Poor Man's File Analysis System - Part 1 |
| 2012-10-13/a> | Guy Bruneau | New Poll - Cyber Security Awareness Month Activities 2012 - https://isc.sans.edu/poll.html |
| 2012-10-12/a> | Mark Hofman | Cyber Security Awareness Month - Day 12 PCI DSS |
| 2012-10-11/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 11 - Vendor Agnostic Standards (Center for Internet Security) |
| 2012-10-10/a> | Kevin Shortt | Cyber Security Awareness Month - Day 10 - Standard Sudo - Part Two |
| 2012-10-09/a> | Johannes Ullrich | Cyber Security Awreness Month - Day 9 - Request for Comment (RFC) |
| 2012-10-08/a> | Mark Hofman | Cyber Security Awareness Month - Day 8 ISO 27001 |
| 2012-10-07/a> | Tony Carothers | Cyber Security Awareness Month - Day 7 - Rollup Review of CSAM Week 1 |
| 2012-10-06/a> | Manuel Humberto Santander Pelaez | Cyber Security Awareness Month - Day 6 - NERC: The standard that enforces security on power SCADA |
| 2012-10-05/a> | Johannes Ullrich | Cyber Security Awareness Month - Day 5: Standards Body Soup, So many Flavors in the bowl. |
| 2012-10-04/a> | Johannes Ullrich | Cyber Security Awareness Month - Day 4: Crypto Standards |
| 2012-10-03/a> | Kevin Shortt | Cyber Security Awareness Month - Day 3 - Standard Sudo - Part One |
| 2012-10-02/a> | Russ McRee | Cyber Security Awareness Month - Day 2 - PCI Security Standard: Mobile Payment Acceptance Security Guidelines |
| 2012-10-01/a> | Johannes Ullrich | Cyber Security Awareness Month |
| 2012-09-23/a> | Tony Carothers | Update for CVE-2012-3132 |
| 2012-09-21/a> | Guy Bruneau | IE Cumulative Updates MS12-063 - KB2744842 |
| 2012-09-21/a> | Guy Bruneau | Update for Vulnerabilities in Adobe Flash Player in Internet Explorer 10 (2755801) |
| 2012-09-09/a> | Guy Bruneau | Phishing/Spam Pretending to be from BBB |
| 2012-07-30/a> | Guy Bruneau | End of Days for MS-CHAPv2 |
| 2012-07-18/a> | Rob VandenBrink | Vote NO to Weak Keys! |
| 2012-07-15/a> | Guy Bruneau | Oracle July 2012 Critical Patch Pre-Release Announcement |
| 2012-07-10/a> | Rob VandenBrink | Today at SANSFIRE (09 July 2012) - ISC Panel Discussion on the State of the Internet |
| 2012-06-18/a> | Guy Bruneau | CVE-2012-1875 exploit is now available |
| 2012-05-25/a> | Guy Bruneau | Technical Analysis of Flash Player CVE-2012-0779 |
| 2012-05-16/a> | Johannes Ullrich | Got Packets? Odd duplicate DNS replies from 10.x IP Addresses |
| 2012-05-05/a> | Tony Carothers | Vulnerability Exploit for Snow Leopard |
| 2012-04-27/a> | Mark Hofman | Microsoft has added MSSQL 2008 R2 SP1 to the list of affected software for MS12-027 (Thanks Ryan). More info here --> http://technet.microsoft.com/security/bulletin/ms12-027 |
| 2012-04-19/a> | Kevin Shortt | OpenSSL Security Advisory - CVE-2012-2110 |
| 2012-04-12/a> | Guy Bruneau | wicd Privilege Escalation 0day exploit for Backtrack 5 R2 |
| 2012-02-03/a> | Guy Bruneau | Sophos 2012 Security Threat Report |
| 2012-01-12/a> | Rob VandenBrink | PHP 5.39 was release on the 10th, amongst other things, it addresses CVE-2011-4885 (prevents attacks based on hash collisions) and CVE-2011-4566 (integer overflow when parsing invalid exif header) |
| 2011-12-21/a> | Johannes Ullrich | New Vulnerability in Windows 7 64 bit |
| 2011-10-29/a> | Richard Porter | The Sub Critical Control? Evidence Collection |
| 2011-10-28/a> | Russ McRee | Critical Control 19: Data Recovery Capability |
| 2011-10-28/a> | Daniel Wesemann | Critical Control 20: Security Skills Assessment and Training to fill Gaps |
| 2011-10-27/a> | Mark Baggett | Critical Control 18: Incident Response Capabilities |
| 2011-10-26/a> | Rick Wanner | Critical Control 17:Penetration Tests and Red Team Exercises |
| 2011-10-17/a> | Rob VandenBrink | Critical Control 11: Account Monitoring and Control |
| 2011-10-13/a> | Guy Bruneau | Critical Control 10: Continuous Vulnerability Assessment and Remediation |
| 2011-10-12/a> | Kevin Shortt | Critical Control 8 - Controlled Use of Administrative Privileges |
| 2011-10-11/a> | Swa Frantzen | Critical Control 7 - Application Software Security |
| 2011-10-10/a> | Jim Clausing | Critical Control 6 - Maintenance, Monitoring, and Analysis of Security Audit Logs |
| 2011-10-07/a> | Mark Hofman | Critical Control 5 - Boundary Defence |
| 2011-10-06/a> | Rob VandenBrink | Apache HTTP Server mod_proxy reverse proxy issue |
| 2011-10-04/a> | Rob VandenBrink | Critical Control 2 - Inventory of Authorized and Unauthorized Software |
| 2011-10-04/a> | Johannes Ullrich | Critical Control 3 - Secure Configurations for Hardware and Software on Laptops, Workstations and Servers |
| 2011-10-03/a> | Tom Liston | Security 101 : Security Basics in 140 Characters Or Less |
| 2011-10-03/a> | Mark Hofman | Critical Control 1 - Inventory of Authorized and Unauthorized Devices |
| 2011-10-03/a> | Mark Baggett | What are the 20 Critical Controls? |
| 2011-10-02/a> | Mark Hofman | Cyber Security Awareness Month Day 1/2 - Schedule |
| 2011-10-02/a> | Mark Hofman | Cyber Security Awareness Month Day 1/2 - Introduction to the controls |
| 2011-09-21/a> | Mark Hofman | October 2011 Cyber Security Awareness Month |
| 2011-08-30/a> | Johannes Ullrich | A Packet Challenge: Help us identify this traffic |
| 2011-08-15/a> | Rob VandenBrink | 8 Years since the Eastern Seaboard Blackout - Has it Been that Long? |
| 2011-08-10/a> | Guy Bruneau | Samba 3.6.0 Released |
| 2011-06-30/a> | Rob VandenBrink | Update for RSA Authentication Manager |
| 2011-05-22/a> | Kevin Shortt | Facebook goes two-factor |
| 2011-04-28/a> | Chris Mohan | Gathering and use of location information fears - or is it all a bit too late |
| 2011-04-21/a> | Guy Bruneau | Silverlight Update Available |
| 2011-04-18/a> | John Bambenek | Wordpress.com Security Breach |
| 2011-04-15/a> | Kevin Liston | MS11-020 (KB2508429) Upgrading from Critical to PATCH NOW |
| 2011-04-11/a> | Johannes Ullrich | Layer 2 DoS and other IPv6 Tricks |
| 2011-02-23/a> | Manuel Humberto Santander Pelaez | Bind DOS vulnerability (CVE-2011-0414) |
| 2011-02-21/a> | Adrien de Beaupre | What’s New, it's Python 3.2 |
| 2011-01-08/a> | Guy Bruneau | PandaLabs 2010 Annual Report |
| 2011-01-03/a> | Johannes Ullrich | What Will Matter in 2011 |
| 2010-12-20/a> | Guy Bruneau | Highlight of Survey Related to Issues Affecting Businesses in 2010 |
| 2010-12-20/a> | Guy Bruneau | Patch Issues with Outlook 2007 |
| 2010-12-15/a> | Manuel Humberto Santander Pelaez | HP StorageWorks P2000 G3 MSA hardcoded user |
| 2010-11-16/a> | Guy Bruneau | OpenSSL TLS Extension Parsing Race Condition |
| 2010-10-31/a> | Marcus Sachs | Cyber Security Awareness Month - Day 31 - Tying it all together |
| 2010-10-30/a> | Guy Bruneau | Security Update for Shockwave Player |
| 2010-10-30/a> | Guy Bruneau | Cyber Security Awareness Month - Day 30 - Role of the network team |
| 2010-10-29/a> | Manuel Humberto Santander Pelaez | Cyber Security Awareness Month - Day 29- Role of the office geek |
| 2010-10-28/a> | Rick Wanner | Cyber Security Awareness Month - Day 27 - Social Media use in the office |
| 2010-10-28/a> | Tony Carothers | Cyber Security Awareness Month - Day 28 - Role of the employee |
| 2010-10-28/a> | Manuel Humberto Santander Pelaez | CVE-2010-3654 - New dangerous 0-day authplay library adobe products vulnerability |
| 2010-10-26/a> | Pedro Bueno | Cyber Security Awareness Month - Day 26 - Sharing Office Files |
| 2010-10-25/a> | Kevin Shortt | Cyber Security Awareness Month - Day 25 - Using Home Computers for Work |
| 2010-10-24/a> | Swa Frantzen | Cyber Security Awarenes Month - Day 24 - Using work computers at home |
| 2010-10-23/a> | Mark Hofman | Cyber Security Awareness Month - Day 23 - The Importance of compliance |
| 2010-10-22/a> | Daniel Wesemann | Cyber Security Awareness Month - Day 22 - Security of removable media |
| 2010-10-21/a> | Chris Carboni | Cyber Security Awareness Month - Day 21 - Impossible Requests from the Boss |
| 2010-10-20/a> | Jim Clausing | Cyber Security Awareness Month - Day 20 - Securing Mobile Devices |
| 2010-10-19/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 19 - Remote Access Tools |
| 2010-10-19/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 19 - Remote User VPN Tunnels - to Split or not to Split? |
| 2010-10-19/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 19 - VPN Architectures – SSL or IPSec? |
| 2010-10-19/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 19 - Remote User VPN Access – Are things getting too easy, or too hard? |
| 2010-10-19/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 19 - VPN and Remote Access Tools |
| 2010-10-18/a> | Manuel Humberto Santander Pelaez | Cyber Security Awareness Month - Day 18 - What you should tell your boss when there's a crisis |
| 2010-10-17/a> | Stephen Hall | Cyber Security Awareness Month - Day 17 - What a boss should and should not have access to |
| 2010-10-15/a> | Marcus Sachs | Cyber Security Awareness Month - Day 15 - What Teachers Need to Know About Their Students |
| 2010-10-15/a> | Guy Bruneau | Cyber Security Awareness Month - Day 16 - Securing a donated computer |
| 2010-10-14/a> | Johannes Ullrich | Cyber Security Awareness Month - Day 14 - Securing a public computer |
| 2010-10-13/a> | Deborah Hale | Cyber Security Awareness Month - Day 13 - Online Bullying |
| 2010-10-12/a> | Scott Fendley | Cyber Security Awareness Month - Day 12 - Protecting and Managing Your Digital Identity On Social Media Sites |
| 2010-10-11/a> | Rick Wanner | Cyber Security Awareness Month - Day 11 - Safe Browsing for Teens |
| 2010-10-10/a> | Kevin Liston | Cyber Security Awareness Month - Day 10 - Safe browsing for pre-teens |
| 2010-10-09/a> | Kevin Shortt | Cyber Security Awareness Month - Day 9 - Disposal of an Old Computer |
| 2010-10-08/a> | Rick Wanner | Cyber Security Awareness Month - Day 8 - Patch Management and System Updates |
| 2010-10-06/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 7 - Remote Access and Monitoring Tools |
| 2010-10-06/a> | Marcus Sachs | Cyber Security Awareness Month - Day 6 - Computer Monitoring Tools |
| 2010-10-05/a> | Rick Wanner | Cyber Security Awareness Month - Day 5 - Sites you should stay away from |
| 2010-10-04/a> | Daniel Wesemann | Cyber Security Awareness Month - Day 4 - Managing EMail |
| 2010-10-03/a> | Adrien de Beaupre | Cyber Security Awareness Month - Day 3 - Recognizing phishing and online scams |
| 2010-10-02/a> | Mark Hofman | Cyber Security Awareness Month - Day 2 - Securing the Family Network |
| 2010-10-01/a> | Marcus Sachs | Cyber Security Awareness Month - 2010 |
| 2010-10-01/a> | Marcus Sachs | Cyber Security Awareness Month - Day 1 - Securing the Family PC |
| 2010-09-17/a> | Robert Danford | Circa 2007 Linux Kernel Vulnerability Resurfaces (Was CVE-2007-4573, Now CVE-2010-3301) |
| 2010-09-13/a> | Manuel Humberto Santander Pelaez | Adobe SING table parsing exploit (CVE-2010-2883) in the wild |
| 2010-09-12/a> | Manuel Humberto Santander Pelaez | Adobe Acrobat pushstring Memory Corruption paper |
| 2010-09-08/a> | John Bambenek | Adobe Acrobat/Reader 0-day in Wild, Adobe Issues Advisory |
| 2010-08-25/a> | Pedro Bueno | Adobe released security update for Shockwave player that fix several CVEs: APSB1020 |
| 2010-08-22/a> | Manuel Humberto Santander Pelaez | SCADA: A big challenge for information security professionals |
| 2010-07-29/a> | Rob VandenBrink | Snort 2.8.6.1 and Snort 2.9 Beta Released |
| 2010-07-26/a> | Guy Bruneau | SophosLabs Released Free Tool to Validate Microsoft Shortcut |
| 2010-07-20/a> | Manuel Humberto Santander Pelaez | LNK vulnerability now with Metasploit module implementing the WebDAV method |
| 2010-07-20/a> | Manuel Humberto Santander Pelaez | iTunes buffer overflow vulnerability |
| 2010-07-10/a> | Tony Carothers | Oracle July 2010 Pre-Release Announcement |
| 2010-06-15/a> | Manuel Humberto Santander Pelaez | Microsoft Windows Help and Support Center vulnerability (CVE 2010-1885) exploit in the wild |
| 2010-05-12/a> | Rob VandenBrink | Layer 2 Security - Private VLANs (the Story Continues ...) |
| 2010-04-27/a> | Rob VandenBrink | Layer 2 Security - L2TPv3 for Disaster Recovery Sites |
| 2010-04-22/a> | Guy Bruneau | MS10-025 Security Update has been Pulled |
| 2010-04-16/a> | G. N. White | MS10-021: Encountering A Failed WinXP Update |
| 2010-03-28/a> | Rick Wanner | Honeynet Project: 2010 Forensic Challenge #3 |
| 2010-03-10/a> | Rob VandenBrink | Microsoft re-release of KB973811 - attacks on Extended Protection for Authentication |
| 2010-03-01/a> | Mark Hofman | Microsoft will drop support for Vista (without any Service Packs) on April 13 and support for XP SP2 ends July 13. (i.e. no more security updates). If you are still running these, it it time to update. |
| 2010-02-23/a> | Mark Hofman | What is your firewall telling you and what is TCP249? |
| 2010-02-21/a> | Tony Carothers | TCP Port 12174 Request For Packets |
| 2010-02-17/a> | Rob VandenBrink | Defining Clouds - " A Cloud by any Other Name Would be a Lot Less Confusing" |
| 2010-02-01/a> | Rob VandenBrink | NMAP 5.21 - Is UDP Protocol Specific Scanning Important? Why Should I Care? |
| 2010-01-19/a> | Jim Clausing | The IE saga continues, out-of-cycle patch coming soon |
| 2010-01-15/a> | Kevin Liston | Exploit code available for CVE-2010-0249 |
| 2010-01-12/a> | Adrien de Beaupre | PoC for CVE-2009-0689 MacOS X 10.5/10.6 vulnerability |
| 2010-01-04/a> | Bojan Zdrnja | Sophisticated, targeted malicious PDF documents exploiting CVE-2009-4324 |
| 2009-12-29/a> | Rick Wanner | What's up with port 12174? Possible Symantec server compromise? |
| 2009-12-07/a> | Rob VandenBrink | Layer 2 Network Protections – reloaded! |
| 2009-11-14/a> | Adrien de Beaupre | Microsoft advisory for Windows 7 / Windows Server 2008 R2 Remote SMB DoS Exploit released |
| 2009-11-12/a> | Rob VandenBrink | Windows 7 / Windows Server 2008 Remote SMB Exploit |
| 2009-11-11/a> | Rob VandenBrink | Layer 2 Network Protections against Man in the Middle Attacks |
| 2009-10-31/a> | Rick Wanner | Cyber Security Awareness Month - Day 31, ident |
| 2009-10-30/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 30 - The "Common" IPSEC VPN Protocols - IKE / ISAKMP (500/udp), ESP (IP Protocol 50), NAT-T-IKE (500/udp, 4500/udp), PPTP (tcp/1723), GRE (IP Protocol 47) |
| 2009-10-29/a> | Kyle Haugsness | Cyber Security Awareness Month - Day 29 - dns port 53 |
| 2009-10-28/a> | Johannes Ullrich | Cyber Security Awareness Month - Day 28 - ntp (123/udp) |
| 2009-10-25/a> | Lorna Hutcheson | Cyber Security Awareness Month - Day 25 - Port 80 and 443 |
| 2009-10-22/a> | Adrien de Beaupre | Cyber Security Awareness Month - Day 22 port 502 TCP - Modbus |
| 2009-10-22/a> | Adrien de Beaupre | Sysinternals updates: Disk2vhd v1.1, ZoomIt v4.1, Coreinfo v2.0, VMMap v2.4 |
| 2009-10-19/a> | Daniel Wesemann | Cyber Security Awareness Month - Day 19 - ICMP |
| 2009-10-17/a> | Rick Wanner | Cyber Security Awareness Month - Day 17 - Port 22/SSH |
| 2009-10-16/a> | Adrien de Beaupre | Cyber Security Awareness Month - Day 16 - Port 1521 - Oracle TNS Listener |
| 2009-10-11/a> | Mark Hofman | Cyber Security Awareness Month - Day 12 Ports 161/162 Simple Network Management Protocol (SNMP) |
| 2009-10-09/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 9 - Port 3389/tcp (RDP) |
| 2009-10-08/a> | Johannes Ullrich | Cyber Security Awareness Month - Day 8 - Port 25 - SMTP |
| 2009-10-06/a> | Adrien de Beaupre | Cyber Security Awareness Month - Day 6 ports 67&68 udp - bootp and dhcp |
| 2009-10-05/a> | Adrien de Beaupre | Cyber Security Awareness Month - Day 5 port 31337 |
| 2009-09-16/a> | Bojan Zdrnja | SMB2 remote exploit released |
| 2009-09-08/a> | Guy Bruneau | Vista/2008/Windows 7 SMB2 BSOD 0Day |
| 2009-09-07/a> | Jim Clausing | Request for packets |
| 2009-08-28/a> | Adrien de Beaupre | WPA with TKIP done |
| 2009-08-08/a> | Kevin Liston | Sun OpenSSO Enterprise/Sun Access Manager XML Vulnerabilities |
| 2009-07-12/a> | Mari Nichols | CA Apologizes for False Positive |
| 2009-06-20/a> | Mark Hofman | G'day from Sansfire2009 |
| 2009-06-14/a> | Guy Bruneau | SANSFIRE 2009 Starts Tomorrow |
| 2009-05-28/a> | Stephen Hall | Microsoft DirectShow vulnerability |
| 2009-05-27/a> | donald smith | WebDAV write-up |
| 2009-05-26/a> | Jason Lam | Vista & Win2K8 SP2 available |
| 2009-05-02/a> | Rick Wanner | Significant increase in port 2967 traffic |
| 2009-03-24/a> | G. N. White | CanSecWest Pwn2Own: Would IE8 have been exploitable had the event waited one more day? |
| 2009-02-19/a> | Bojan Zdrnja | MS09-002, XML/DOC and initial infection vector |
| 2009-02-17/a> | Bojan Zdrnja | MS09-002 exploit in the wild |
| 2009-01-31/a> | Swa Frantzen | VMware updates |
| 2008-11-04/a> | Marcus Sachs | Cyber Security Awareness Month 2008 - Summary and Links |
| 2008-11-03/a> | Joel Esler | Day 34 -- Feeding The Lessons Learned Back to the Preparation Phase |
| 2008-11-02/a> | Mari Nichols | Day 33 - Working with Management to Improve Processes |
| 2008-11-01/a> | Koon Yaw Tan | Day 32 - What Should I Make Public? |
| 2008-10-31/a> | Rick Wanner | Day 31 - Legal Awareness |
| 2008-10-30/a> | Kevin Liston | Day 30 - Applying Patches and Updates |
| 2008-10-29/a> | Deborah Hale | Day 29 - Should I Switch Software Vendors? |
| 2008-10-28/a> | Jason Lam | Day 28 - Avoiding Finger Pointing and the Blame Game |
| 2008-10-27/a> | Johannes Ullrich | Day 27 - Validation via Vulnerability Scanning |
| 2008-10-25/a> | Koon Yaw Tan | Day 25 - Finding and Removing Hidden Files and Directories |
| 2008-10-25/a> | Rick Wanner | Day 26 - Restoring Systems from Backup |
| 2008-10-24/a> | Stephen Hall | Day 24 - Cleaning Email Servers and Clients |
| 2008-10-22/a> | Johannes Ullrich | Day 22 - Wiping Disks and Media |
| 2008-10-22/a> | Chris Carboni | Day 23 - Turning off Unused Services |
| 2008-10-21/a> | Johannes Ullrich | Day 21 - Removing Bots, Keyloggers, and Spyware |
| 2008-10-20/a> | Raul Siles | Day 20 - Eradicating a Rootkit |
| 2008-10-19/a> | Lorna Hutcheson | Day 19 - Eradication: Forensic Analysis Tools - What Happened? |
| 2008-10-17/a> | Patrick Nolan | Day 17 - Containing a DNS Hijacking |
| 2008-10-17/a> | Rick Wanner | Day 18 - Containing Other Incidents |
| 2008-10-16/a> | Mark Hofman | Day 16 - Containing a Malware Outbreak |
| 2008-10-15/a> | Rick Wanner | Day 15 - Containing the Damage From a Lost or Stolen Laptop |
| 2008-10-14/a> | Swa Frantzen | Day 14 - Containment: a Personal IdentityTheft Incident |
| 2008-10-13/a> | Adrien de Beaupre | Day 13 - Containment: Containing on Production Systems Such as a Web Server |
| 2008-10-12/a> | Mari Nichols | Day 12 Containment: Gathering Evidence That Can be Used in Court |
| 2008-10-11/a> | Stephen Hall | Day 11 - Identification: Other Methods of Identifying an Incident |
| 2008-10-10/a> | Marcus Sachs | Day 10 - Identification: Using Your Help Desk to Identify Security Incidents |
| 2008-10-09/a> | Marcus Sachs | Day 9 - Identification: Log and Audit Analysis |
| 2008-10-08/a> | Johannes Ullrich | Day 8 - Global Incident Awareness |
| 2008-10-07/a> | Kyle Haugsness | Day 7 - Identification: Host-based Intrusion Detection Systems |
| 2008-10-06/a> | Jim Clausing | Day 6 - Network-based Intrusion Detection Systems |
| 2008-10-05/a> | Stephen Hall | Day 5 - Identification: Events versus Incidents |
| 2008-10-04/a> | Marcus Sachs | Day 4 - Preparation: What Goes Into a Response Kit |
| 2008-10-03/a> | Jason Lam | Day 3 - Preparation: Building Checklists |
| 2008-10-02/a> | Marcus Sachs | Day 2 - Preparation: Building a Response Team |
| 2008-10-01/a> | Marcus Sachs | Day 1 - Preparation: Policies, Management Support, and User Awareness |
| 2008-09-30/a> | Marcus Sachs | Cyber Security Awareness Month - Daily Topics |
| 2008-09-15/a> | donald smith | Fake antivirus 2009 and search engine results |
| 2008-08-26/a> | John Bambenek | Active attacks using stolen SSH keys (UPDATED) |
| 2008-08-15/a> | Jim Clausing | Another MS update that may have escaped notice |
| 2008-04-27/a> | Marcus Sachs | What's With Port 20329? |
| 2008-04-22/a> | donald smith | XP SP3 RC2 Available |
| 2008-04-10/a> | Deborah Hale | Symantec Threatcon Level 2 |
| 2006-09-19/a> | Swa Frantzen | Yet another MSIE 0-day: VML |
| 2006-09-15/a> | Swa Frantzen | MSIE DirectAnimation ActiveX 0-day update |
| 2006-09-12/a> | Swa Frantzen | Microsoft security patches for September 2006 |
| 2000-01-02/a> | Deborah Hale | 2010 A Look Back - 2011 A Look Ahead |
| 2000-01-01/a> | Manuel Humberto Santander Pelaez | Happy New Year 2011!!! |
SWITCH |
| 2013-03-05/a> | Mark Hofman | IPv6 Focus Month: Device Defaults |
| 2010-07-10/a> | Tony Carothers | Software Update for Cisco IE 3000 Series Switches |
| 2009-11-11/a> | Rob VandenBrink | Layer 2 Network Protections against Man in the Middle Attacks |
| 2009-08-03/a> | Mark Hofman | Switch hardening on your network |
NETWORK |
| 2025-03-26/a> | Jesse La Grew | [Guest Diary] Leveraging CNNs and Entropy-Based Feature Selection to Identify Potential Malware Artifacts of Interest |
| 2023-08-26/a> | Xavier Mertens | macOS: Who?s Behind This Network Connection? |
| 2023-01-02/a> | Xavier Mertens | NetworkMiner 2.8 Released |
| 2022-01-25/a> | Brad Duncan | Emotet Stops Using 0.0.0.0 in Spambot Traffic |
| 2021-12-06/a> | Xavier Mertens | The Importance of Out-of-Band Networks |
| 2021-06-18/a> | Daniel Wesemann | Network Forensics on Azure VMs (Part #2) |
| 2021-06-17/a> | Daniel Wesemann | Network Forensics on Azure VMs (Part #1) |
| 2021-01-30/a> | Guy Bruneau | PacketSifter as Network Parsing and Telemetry Tool |
| 2019-10-16/a> | Xavier Mertens | Security Monitoring: At Network or Host Level? |
| 2019-10-06/a> | Russ McRee | visNetwork for Network Data |
| 2019-07-20/a> | Guy Bruneau | Re-evaluating Network Security - It is Increasingly More Complex |
| 2019-03-27/a> | Xavier Mertens | Running your Own Passive DNS Service |
| 2018-06-06/a> | Xavier Mertens | Converting PCAP Web Traffic to Apache Log |
| 2017-12-02/a> | Xavier Mertens | Using Bad Material for the Good |
| 2017-09-28/a> | Xavier Mertens | The easy way to analyze huge amounts of PCAP data |
| 2017-02-17/a> | Rob VandenBrink | RTRBK - Router / Switch / Firewall Backups in PowerShell (tool drop) |
| 2017-01-13/a> | Xavier Mertens | Who's Attacking Me? |
| 2017-01-12/a> | Mark Baggett | Some tools updates |
| 2016-05-26/a> | Xavier Mertens | Keeping an Eye on Tor Traffic |
| 2015-04-17/a> | Didier Stevens | Memory Forensics Of Network Devices |
| 2015-03-16/a> | Johannes Ullrich | Automatically Documenting Network Connections From New Devices Connected to Home Networks |
| 2014-10-13/a> | Lorna Hutcheson | For or Against: Port Security for Network Access Control |
| 2014-06-03/a> | Basil Alawi S.Taher | An Introduction to RSA Netwitness Investigator |
| 2014-01-24/a> | Chris Mohan | Phishing via Social Media |
| 2013-11-30/a> | Russ McRee | A review of Tubes, A Journey to the Center of the Internet |
| 2013-07-17/a> | Johannes Ullrich | Network Solutions Outage |
| 2013-07-13/a> | Lenny Zeltser | Decoy Personas for Safeguarding Online Identity Using Deception |
| 2013-02-03/a> | Lorna Hutcheson | Is it Really an Attack? |
| 2012-12-31/a> | Manuel Humberto Santander Pelaez | How to determine which NAC solutions fits best to your needs |
| 2012-08-30/a> | Bojan Zdrnja | Analyzing outgoing network traffic (part 2) |
| 2012-08-23/a> | Bojan Zdrnja | Analyzing outgoing network traffic |
| 2012-04-06/a> | Johannes Ullrich | Social Share Privacy |
| 2011-08-05/a> | Johannes Ullrich | Microsoft Patch Tuesday Advance Notification: 13 Bulletins coming http://www.microsoft.com/technet/security/Bulletin/MS11-aug.mspx |
| 2011-05-25/a> | Lenny Zeltser | Monitoring Social Media for Security References to Your Organization |
| 2011-02-14/a> | Lorna Hutcheson | Network Visualization |
| 2011-01-23/a> | Richard Porter | Crime is still Crime! |
| 2010-12-21/a> | Rob VandenBrink | Network Reliability, Part 2 - HSRP Attacks and Defenses |
| 2010-11-22/a> | Lenny Zeltser | Brand Impersonations On-Line: Brandjacking and Social Networks |
| 2010-11-08/a> | Manuel Humberto Santander Pelaez | Network Security Perimeter: How to choose the correct firewall and IPS for your environment? |
| 2010-09-16/a> | Johannes Ullrich | Facebook "Like Pages" |
| 2010-08-05/a> | Rob VandenBrink | Access Controls for Network Infrastructure |
| 2010-07-07/a> | Kevin Shortt | Facebook, Facebook, What Do YOU See? |
| 2010-06-10/a> | Deborah Hale | Top 5 Social Networking Media Risks |
| 2010-04-18/a> | Guy Bruneau | Some NetSol hosted sites breached |
| 2009-12-07/a> | Rob VandenBrink | Layer 2 Network Protections – reloaded! |
| 2009-11-25/a> | Jim Clausing | Tool updates |
| 2009-11-11/a> | Rob VandenBrink | Layer 2 Network Protections against Man in the Middle Attacks |
| 2009-08-13/a> | Jim Clausing | New and updated cheat sheets |
| 2009-08-03/a> | Mark Hofman | Switch hardening on your network |
| 2009-07-28/a> | Adrien de Beaupre | YYAMCCBA |
| 2009-05-28/a> | Jim Clausing | Stego in TCP retransmissions |
| 2009-05-18/a> | Rick Wanner | Cisco SAFE Security Reference Guide Updated |
| 2008-04-07/a> | John Bambenek | Network Solutions Technical Difficulties? Enom too |
PROTECTIONS |
| 2009-12-07/a> | Rob VandenBrink | Layer 2 Network Protections – reloaded! |
| 2009-11-11/a> | Rob VandenBrink | Layer 2 Network Protections against Man in the Middle Attacks |
| 2009-10-30/a> | Rob VandenBrink | New version of NIST 800-41, Firewalls and Firewall Policy Guidelines |
MAN |
| 2024-12-27/a> | Guy Bruneau | Phishing for Banking Information |
| 2024-08-07/a> | Guy Bruneau | Same Scripts, Different Day: What My DShield Honeypot Taught Me About the Importance of Security Fundamentals [Guest Diary] |
| 2024-07-10/a> | Jesse La Grew | Finding Honeypot Data Clusters Using DBSCAN: Part 1 |
| 2024-04-29/a> | Johannes Ullrich | D-Link NAS Device Backdoor Abused |
| 2024-01-25/a> | Xavier Mertens | Facebook AdsManager Targeted by a Python Infostealer |
| 2023-09-09/a> | Guy Bruneau | ?Anyone get the ASN of the Truck that Hit Me?!?: Creating a PowerShell Function to Make 3rd Party API Calls for Extending Honeypot Information [Guest Diary] |
| 2023-06-15/a> | Yee Ching Tok | Supervision and Verification in Vulnerability Management |
| 2023-06-11/a> | Guy Bruneau | DShield Honeypot Activity for May 2023 |
| 2023-05-24/a> | Tom Webb | IR Case/Alert Management |
| 2021-12-06/a> | Xavier Mertens | The Importance of Out-of-Band Networks |
| 2021-09-15/a> | Brad Duncan | Hancitor campaign abusing Microsoft's OneDrive |
| 2021-08-29/a> | Guy Bruneau | Filter JSON Data by Value with Linux jq |
| 2021-07-09/a> | Brad Duncan | Hancitor tries XLL as initial malware file |
| 2021-02-13/a> | Guy Bruneau | vSphere Replication updates address a command injection vulnerability (CVE-2021-21976) - https://www.vmware.com/security/advisories/VMSA-2021-0001.html |
| 2021-02-05/a> | Xavier Mertens | VBA Macro Trying to Alter the Application Menus |
| 2020-09-16/a> | Johannes Ullrich | Do Vulnerabilities Ever Get Old? Recent "Mirai" Variant Scanning for 20 Year Old Amanda Version? |
| 2020-03-15/a> | Guy Bruneau | VPN Access and Activity Monitoring |
| 2020-02-14/a> | Xavier Mertens | Keep an Eye on Command-Line Browsers |
| 2019-11-01/a> | Didier Stevens | Tip: Password Managers and 2FA |
| 2019-09-19/a> | Xavier Mertens | Blocklisting or Whitelisting in the Right Way |
| 2019-07-16/a> | Russ McRee | Commando VM: The Complete Mandiant Offensive VM |
| 2019-02-24/a> | Guy Bruneau | Packet Editor and Builder by Colasoft |
| 2018-07-30/a> | Xavier Mertens | Exploiting the Power of Curl |
| 2018-05-02/a> | Russ McRee | Windows Commands Reference - An InfoSec Must Have |
| 2017-10-30/a> | Johannes Ullrich | Critical Patch For Oracle's Identity Manager |
| 2017-09-18/a> | Johannes Ullrich | SANS Securingthehuman posted a follow up to their Equifax breach webcast: https://securingthehuman.sans.org/blog/2017/09/15/equifax-webcast-follow-up |
| 2017-01-11/a> | Johannes Ullrich | January 2017 Edition of Ouch! Security Awareness Newsletter Released: https://securingthehuman.sans.org/ouch |
| 2016-07-26/a> | Johannes Ullrich | Command and Control Channels Using "AAAA" DNS Records |
| 2016-06-23/a> | Russell Eubanks | An Approach to Vulnerability Management |
| 2016-06-20/a> | Xavier Mertens | Using Your Password Manager to Monitor Data Leaks |
| 2016-04-15/a> | Xavier Mertens | Windows Command Line Persistence? |
| 2015-10-12/a> | Guy Bruneau | Critical Vulnerability in Multiple Cisco Products - Apache Struts 2 Command Execution http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2 |
| 2015-09-23/a> | Daniel Wesemann | Making our users unlearn what we taught them |
| 2015-07-18/a> | Russell Eubanks | The Value a "Fresh Set Of Eyes" (FSOE) |
| 2014-08-06/a> | Johannes Ullrich | Exploit Available for Symantec End Point Protection |
| 2014-08-04/a> | Russ McRee | Threats & Indicators: A Security Intelligence Lifecycle |
| 2014-07-30/a> | Rick Wanner | Symantec Endpoint Protection Privilege Escalation Zero Day |
| 2014-07-02/a> | Johannes Ullrich | July Ouch! Security Awareness Newsletter Released. E-mail Do's and Don'ts http://www.securingthehuman.org/resources/newsletters/ouch/2014#july2014 |
| 2014-06-13/a> | Richard Porter | A welcomed response, PF Chang's |
| 2014-03-17/a> | Johannes Ullrich | Scans for FCKEditor File Manager |
| 2014-03-11/a> | Basil Alawi S.Taher | Introduction to Memory Analysis with Mandiant Redline |
| 2014-03-02/a> | Stephen Hall | Symantec goes yellow |
| 2014-02-14/a> | Chris Mohan | SYM14-004 Symantec Endpoint Protection Management Vulnerabilities - http://www.symantec.com/business/support/index?page=content&id=TECH214866 |
| 2014-02-05/a> | Johannes Ullrich | SANS Ouch Security Awareness Newsletter What is Malware http://www.securingthehuman.org/ouch |
| 2014-01-23/a> | Chris Mohan | Learning from the breaches that happens to others Part 2 |
| 2014-01-14/a> | Chris Mohan | Spamming and scanning botnets - is there something I can do to block them from my site? |
| 2013-12-28/a> | Russ McRee | Weekend Reading List 27 DEC |
| 2013-09-24/a> | Tom Webb | IDS, NSM, and Log Management with Security Onion 12.04.3 |
| 2013-09-09/a> | Johannes Ullrich | SSL is broken. So what? |
| 2013-02-25/a> | Rob VandenBrink | Silent Traitors - Embedded Devices in your Datacenter |
| 2013-02-17/a> | Guy Bruneau | HP ArcSight Connector Appliance and Logger Vulnerabilities |
| 2013-02-04/a> | Adam Swanger | SAN Securing The Human Monthly Awareness Video - Advanced Persistent Threat (APT) http://www.securingthehuman.org/resources/ncsam |
| 2012-12-27/a> | John Bambenek | It's 3pm 2 days after Christmas, do you know where your unmanaged SSH keys are? |
| 2012-10-26/a> | Adam Swanger | Securing the Human Special Webcast - October 30, 2012 |
| 2012-08-21/a> | Adrien de Beaupre | RuggedCom fails key management 101 on Rugged Operating System (ROS) |
| 2012-06-22/a> | Kevin Liston | Updated Poll: Which Patch Delivery Schedule Works the Best for You? |
| 2012-04-23/a> | Russ McRee | Emergency Operations Centers & Security Incident Management: A Correlation |
| 2012-01-25/a> | Bojan Zdrnja | pcAnywhere users – patch now! |
| 2011-10-28/a> | Russ McRee | Critical Control 19: Data Recovery Capability |
| 2011-02-19/a> | Guy Bruneau | Snort Data Acquisition Library |
| 2010-12-21/a> | Rob VandenBrink | Network Reliability, Part 2 - HSRP Attacks and Defenses |
| 2010-08-19/a> | Rob VandenBrink | Change is Good. Change is Bad. Change is Life. |
| 2010-07-25/a> | Rick Wanner | Updated version of Mandiant's Web Historian |
| 2010-07-24/a> | Manuel Humberto Santander Pelaez | Transmiting logon information unsecured in the network |
| 2010-06-02/a> | Rob VandenBrink | SPAM pretending to be from Habitat for Humanity |
| 2010-05-16/a> | Rick Wanner | Symantec triggers on World of Warcraft update |
| 2010-02-07/a> | Rick Wanner | Mandiant Mtrends Report |
| 2010-02-06/a> | Guy Bruneau | LANDesk Management Gateway Vulnerability |
| 2010-01-27/a> | Raul Siles | Command Line Kung Fu |
| 2009-12-29/a> | Rick Wanner | What's up with port 12174? Possible Symantec server compromise? |
| 2009-11-11/a> | Rob VandenBrink | Layer 2 Network Protections against Man in the Middle Attacks |
| 2009-07-13/a> | Adrien de Beaupre | Security Update available for Wyse Device Manager |
| 2009-05-19/a> | Rick Wanner | New Version of Mandiant Highlighter |
| 2009-05-01/a> | Adrien de Beaupre | Incident Management |
| 2009-03-20/a> | donald smith | Stealthier then a MBR rootkit, more powerful then ring 0 control, it’s the soon to be developed SMM root kit. |
| 2009-03-10/a> | Swa Frantzen | conspiracy fodder: pifts.exe |
| 2009-02-05/a> | Rick Wanner | Mandiant Memoryze review, Hilighter, other Mandiant tools! |
| 2008-04-22/a> | donald smith | Symantec decomposer rar bypass allowed malicious content. |
| 2006-10-05/a> | John Bambenek | There are no more Passive Exploits |
IN |
| 2025-04-02/a> | Guy Bruneau | Exploring Statistical Measures to Predict URLs as Legitimate or Intrusive [Guest Diary] |
| 2025-03-26/a> | Jesse La Grew | [Guest Diary] Leveraging CNNs and Entropy-Based Feature Selection to Identify Potential Malware Artifacts of Interest |
| 2025-03-20/a> | Johannes Ullrich | Some new Data Feeds, and a little "incident". |
| 2025-03-18/a> | Xavier Mertens | Python Bot Delivered Through DLL Side-Loading |
| 2025-03-12/a> | Guy Bruneau | File Hashes Analysis with Power BI from Data Stored in DShield SIEM |
| 2025-03-06/a> | Guy Bruneau | DShield Traffic Analysis using ELK |
| 2025-02-24/a> | Jim Clausing | Unfurl v2025.02 released |
| 2025-02-20/a> | Guy Bruneau | Using ES|QL in Kibana to Queries DShield Honeypot Logs |
| 2025-02-14/a> | Xavier Mertens | Fake BSOD Delivered by Malicious Python Script |
| 2025-02-13/a> | Guy Bruneau | DShield SIEM Docker Updates |
| 2025-02-12/a> | Yee Ching Tok | An ontology for threats, cybercrime and digital forensic investigation on Smart City Infrastructure |
| 2025-02-06/a> | Xavier Mertens | The Unbreakable Multi-Layer Anti-Debugging System |
| 2025-02-05/a> | Johannes Ullrich | Phishing via "com-" prefix domains |
| 2025-01-29/a> | Xavier Mertens | From PowerShell to a Python Obfuscation Race! |
| 2025-01-28/a> | Xavier Mertens | Fileless Python InfoStealer Targeting Exodus |
| 2025-01-21/a> | Johannes Ullrich | Geolocation and Starlink |
| 2025-01-18/a> | Jim Clausing | New tool: immutable.py |
| 2025-01-17/a> | Guy Bruneau | Leveraging Honeypot Data for Offensive Security Operations [Guest Diary] |
| 2025-01-15/a> | Yee Ching Tok | The Curious Case of a 12-Year-Old Netgear Router Vulnerability |
| 2025-01-09/a> | Guy Bruneau | Examining Redtail Analyzing a Sophisticated Cryptomining Malware and its Advanced Tactics [Guest Diary] |
| 2025-01-07/a> | Yee Ching Tok | PacketCrypt Classic Cryptocurrency Miner on PHP Servers |
| 2025-01-06/a> | Xavier Mertens | Make Malware Happy |
| 2024-12-27/a> | Guy Bruneau | Phishing for Banking Information |
| 2024-12-20/a> | Xavier Mertens | Christmas "Gift" Delivered Through SSH |
| 2024-12-17/a> | Guy Bruneau | Command Injection Exploit For PHPUnit before 4.8.28 and 5.x before 5.6.3 [Guest Diary] |
| 2024-12-05/a> | Jesse La Grew | [Guest Diary] Business Email Compromise |
| 2024-11-30/a> | Xavier Mertens | From a Regular Infostealer to its Obfuscated Version |
| 2024-11-26/a> | Jesse La Grew | [Guest Diary] Using Zeek, Snort, and Grafana to Detect Crypto Mining Malware |
| 2024-11-22/a> | Xavier Mertens | An Infostealer Searching for « BIP-0039 » Data |
| 2024-11-19/a> | Xavier Mertens | Detecting the Presence of a Debugger in Linux |
| 2024-11-17/a> | Johannes Ullrich | Ancient TP-Link Backdoor Discovered by Attackers |
| 2024-11-07/a> | Xavier Mertens | Steam Account Checker Poisoned with Infostealer |
| 2024-10-31/a> | Guy Bruneau | October 2024 Activity with Username chenzilong |
| 2024-10-14/a> | Xavier Mertens | Phishing Page Delivered Through a Blob URL |
| 2024-10-09/a> | Xavier Mertens | From Perfctl to InfoStealer |
| 2024-10-03/a> | Guy Bruneau | Kickstart Your DShield Honeypot [Guest Diary] |
| 2024-09-25/a> | Guy Bruneau | OSINT - Image Analysis or More Where, When, and Metadata [Guest Diary] |
| 2024-09-18/a> | Guy Bruneau | Time-to-Live Analysis of DShield Data with Vega-Lite |
| 2024-09-18/a> | Xavier Mertens | Python Infostealer Patching Windows Exodus App |
| 2024-09-11/a> | Guy Bruneau | Hygiene, Hygiene, Hygiene! [Guest Diary] |
| 2024-09-04/a> | Guy Bruneau | Attack Surface [Guest Diary] |
| 2024-08-30/a> | Jesse La Grew | Simulating Traffic With Scapy |
| 2024-08-29/a> | Xavier Mertens | Live Patching DLLs with Python |
| 2024-08-27/a> | Xavier Mertens | Why Is Python so Popular to Infect Windows Hosts? |
| 2024-08-27/a> | Guy Bruneau | Vega-Lite with Kibana to Parse and Display IP Activity over Time |
| 2024-08-26/a> | Xavier Mertens | From Highly Obfuscated Batch File to XWorm and Redline |
| 2024-08-20/a> | Guy Bruneau | Mapping Threats with DNSTwist and the Internet Storm Center [Guest Diary] |
| 2024-08-16/a> | Jesse La Grew | [Guest Diary] 7 minutes and 4 steps to a quick win: A write-up on custom tools |
| 2024-08-14/a> | Xavier Mertens | Multiple Malware Dropped Through MSI Package |
| 2024-08-07/a> | Guy Bruneau | Same Scripts, Different Day: What My DShield Honeypot Taught Me About the Importance of Security Fundamentals [Guest Diary] |
| 2024-07-25/a> | Xavier Mertens | XWorm Hidden With Process Hollowing |
| 2024-07-23/a> | Johannes Ullrich | New Exploit Variation Against D-Link NAS Devices (CVE-2024-3273) |
| 2024-07-16/a> | Jan Kopriva | "Reply-chain phishing" with a twist |
| 2024-07-16/a> | Guy Bruneau | Who You Gonna Call? AndroxGh0st Busters! [Guest Diary] |
| 2024-07-13/a> | Didier Stevens | 16-bit Hash Collisions in .xls Spreadsheets |
| 2024-07-10/a> | Jesse La Grew | Finding Honeypot Data Clusters Using DBSCAN: Part 1 |
| 2024-07-08/a> | Xavier Mertens | Kunai: Keep an Eye on your Linux Hosts Activity |
| 2024-06-26/a> | Guy Bruneau | What Setting Live Traps for Cybercriminals Taught Me About Security [Guest Diary] |
| 2024-06-20/a> | Guy Bruneau | No Excuses, Free Tools to Help Secure Authentication in Ubuntu Linux [Guest Diary] |
| 2024-06-13/a> | Guy Bruneau | The Art of JQ and Command-line Fu [Guest Diary] |
| 2024-05-31/a> | Xavier Mertens | "K1w1" InfoStealer Uses gofile.io for Exfiltration |
| 2024-05-30/a> | Xavier Mertens | Feeding MISP with OSSEC |
| 2024-05-28/a> | Guy Bruneau | Is that It? Finding the Unknown: Correlations Between Honeypot Logs & PCAPs [Guest Diary] |
| 2024-05-22/a> | Rob VandenBrink | NMAP Scanning without Scanning (Part 2) - The ipinfo API |
| 2024-05-22/a> | Guy Bruneau | Analysis of ?redtail? File Uploads to ICS Honeypot, a Multi-Architecture Coin Miner [Guest Diary] |
| 2024-05-16/a> | Rob VandenBrink | Why yq? Adventures in XML |
| 2024-05-15/a> | Rob VandenBrink | Got MFA? If not, Now is the Time! |
| 2024-05-06/a> | Johannes Ullrich | Detecting XFinity/Comcast DNS Spoofing |
| 2024-04-29/a> | Johannes Ullrich | D-Link NAS Device Backdoor Abused |
| 2024-04-29/a> | Guy Bruneau | Linux Trojan - Xorddos with Filename eyshcjdmzg |
| 2024-04-22/a> | Jan Kopriva | It appears that the number of industrial devices accessible from the internet has risen by 30 thousand over the past three years |
| 2024-04-17/a> | Xavier Mertens | Malicious PDF File Used As Delivery Mechanism |
| 2024-04-11/a> | Yee Ching Tok | Evolution of Artificial Intelligence Systems and Ensuring Trustworthiness |
| 2024-04-07/a> | Guy Bruneau | A Use Case for Adding Threat Hunting to Your Security Operations Team. Detecting Adversaries Abusing Legitimate Tools in A Customer Environment. [Guest Diary] |
| 2024-03-19/a> | Johannes Ullrich | Attacker Hunting Firewalls |
| 2024-03-17/a> | Guy Bruneau | Gamified Learning: Using Capture the Flag Challenges to Supplement Cybersecurity Training [Guest Diary] |
| 2024-03-14/a> | Jan Kopriva | Increase in the number of phishing messages pointing to IPFS and to R2 buckets |
| 2024-03-06/a> | Bojan Zdrnja | Scanning and abusing the QUIC protocol |
| 2024-02-21/a> | Jan Kopriva | Phishing pages hosted on archive.org |
| 2024-02-20/a> | Xavier Mertens | Python InfoStealer With Dynamic Sandbox Detection |
| 2024-02-15/a> | Jesse La Grew | [Guest Diary] Learning by doing: Iterative adventures in troubleshooting |
| 2024-01-31/a> | Johannes Ullrich | The Fun and Dangers of Top Level Domains (TLDs) |
| 2024-01-25/a> | Xavier Mertens | Facebook AdsManager Targeted by a Python Infostealer |
| 2024-01-24/a> | Johannes Ullrich | How Bad User Interfaces Make Security Tools Harmful |
| 2024-01-06/a> | Xavier Mertens | Are you sure of your password? |
| 2024-01-02/a> | Johannes Ullrich | Fingerprinting SSH Identification Strings |
| 2023-12-31/a> | Tom Webb | Pi-Hole Pi4 Docker Deployment |
| 2023-12-22/a> | Xavier Mertens | Shall We Play a Game? |
| 2023-12-06/a> | Guy Bruneau | Revealing the Hidden Risks of QR Codes [Guest Diary] |
| 2023-11-30/a> | John Bambenek | Prophetic Post by Intern on CVE-2023-1389 Foreshadows Mirai Botnet Expansion Today |
| 2023-11-22/a> | Guy Bruneau | CVE-2023-1389: A New Means to Expand Botnets |
| 2023-11-17/a> | Jan Kopriva | Phishing page with trivial anti-analysis features |
| 2023-11-15/a> | Xavier Mertens | Redline Dropped Through MSIX Package |
| 2023-11-09/a> | Xavier Mertens | Visual Examples of Code Injection |
| 2023-11-08/a> | Xavier Mertens | Example of Phishing Campaign Project File |
| 2023-10-29/a> | Guy Bruneau | Spam or Phishing? Looking for Credentials & Passwords |
| 2023-10-28/a> | Xavier Mertens | Size Matters for Many Security Controls |
| 2023-10-16/a> | Jan Kopriva | Are typos still relevant as an indicator of phishing? |
| 2023-10-15/a> | Guy Bruneau | Domain Name Used as Password Captured by DShield Sensor |
| 2023-10-03/a> | Tom Webb | Are Local LLMs Useful in Incident Response? |
| 2023-09-29/a> | Xavier Mertens | Are You Still Storing Passwords In Plain Text Files? |
| 2023-09-26/a> | Jan Kopriva | A new spin on the ZeroFont phishing technique |
| 2023-09-23/a> | Guy Bruneau | Scanning for Laravel - a PHP Framework for Web Artisants |
| 2023-09-03/a> | Didier Stevens | Analysis of a Defective Phishing PDF |
| 2023-08-31/a> | Jan Kopriva | The low, low cost of (committing) cybercrime |
| 2023-08-31/a> | Guy Bruneau | Potential Weaponizing of Honeypot Logs [Guest Diary] |
| 2023-08-21/a> | Xavier Mertens | Quick Malware Triage With Inotify Tools |
| 2023-08-20/a> | Guy Bruneau | SystemBC Malware Activity |
| 2023-08-18/a> | Xavier Mertens | From a Zalando Phishing to a RAT |
| 2023-08-17/a> | Jesse La Grew | Command Line Parsing - Are These Really Unique Strings? |
| 2023-08-11/a> | Xavier Mertens | Show me All Your Windows! |
| 2023-07-24/a> | Rob VandenBrink | JQ: Another Tool We Thought We Knew |
| 2023-07-18/a> | Johannes Ullrich | Exploit Attempts for "Stagil navigation for Jira Menus & Themes" CVE-2023-26255 and CVE-2023-26256 |
| 2023-07-13/a> | Jesse La Grew | DShield Honeypot Maintenance and Data Retention |
| 2023-07-01/a> | Russ McRee | Sandfly Security |
| 2023-06-29/a> | Brad Duncan | GuLoader- or DBatLoader/ModiLoader-style infection for Remcos RAT |
| 2023-06-21/a> | Yee Ching Tok | Analyzing a YouTube Sponsorship Phishing Mail and Malware Targeting Content Creators |
| 2023-06-19/a> | Xavier Mertens | Malware Delivered Through .inf File |
| 2023-06-16/a> | Xavier Mertens | Another RAT Delivered Through VBS |
| 2023-05-30/a> | Johannes Ullrich | Your Business Data and Machine Learning at Risk: Attacks Against Apache NiFi |
| 2023-05-28/a> | Guy Bruneau | We Can no Longer Ignore the Cost of Cybersecurity |
| 2023-05-26/a> | Xavier Mertens | Using DFIR Techniques To Recover From Infrastructure Outages |
| 2023-05-24/a> | Tom Webb | IR Case/Alert Management |
| 2023-05-20/a> | Xavier Mertens | Phishing Kit Collecting Victim's IP Address |
| 2023-05-19/a> | Xavier Mertens | When the Phisher Messes Up With Encoding |
| 2023-05-15/a> | Jan Kopriva | Ongoing Facebook phishing campaign without a sender and (almost) without links |
| 2023-05-04/a> | Xavier Mertens | Infostealer Embedded in a Word Document |
| 2023-05-01/a> | Jan Kopriva | "Passive" analysis of a phishing attachment |
| 2023-04-26/a> | Yee Ching Tok | Strolling through Cyberspace and Hunting for Phishing Sites |
| 2023-04-17/a> | Jan Kopriva | The strange case of Great honeypot of China |
| 2023-04-08/a> | Xavier Mertens | Microsoft Netlogon: Potential Upcoming Impacts of CVE-2022-38023 |
| 2023-04-03/a> | Johannes Ullrich | Tax Season Risks |
| 2023-03-31/a> | Guy Bruneau | Using Linux grep and Windows findstr to Manipulate Files |
| 2023-03-31/a> | Jan Kopriva | Use of X-Frame-Options and CSP frame-ancestors security headers on 1 million most popular domains |
| 2023-03-25/a> | Guy Bruneau | Microsoft Released an Update for Windows Snipping Tool Vulnerability |
| 2023-03-22/a> | Didier Stevens | Windows 11 Snipping Tool Privacy Bug: Inspecting PNG Files |
| 2023-03-20/a> | Xavier Mertens | From Phishing Kit To Telegram... or Not! |
| 2023-03-15/a> | Jan Kopriva | IPFS phishing and the need for correctly set HTTP security headers |
| 2023-03-12/a> | Guy Bruneau | AsynRAT Trojan - Bill Payment (Pago de la factura) |
| 2023-03-11/a> | Xavier Mertens | Overview of a Mirai Payload Generator |
| 2023-03-01/a> | Xavier Mertens | Python Infostealer Targeting Gamers |
| 2023-02-27/a> | Xavier Mertens | Phishing Again and Again |
| 2023-02-21/a> | Xavier Mertens | Phishing Page Branded with Your Corporate Website |
| 2023-02-19/a> | Didier Stevens | "Unsupported 16-bit Application" or HTML? |
| 2023-02-18/a> | Guy Bruneau | Spear Phishing Handlers for Username/Password |
| 2023-02-16/a> | Jan Kopriva | HTML phishing attachment with browser-in-the-browser technique |
| 2023-02-13/a> | Johannes Ullrich | Venmo Phishing Abusing LinkedIn "slink" |
| 2023-02-10/a> | Xavier Mertens | Obfuscated Deactivation of Script Block Logging |
| 2023-02-09/a> | Xavier Mertens | A Backdoor with Smart Screenshot Capability |
| 2023-02-04/a> | Guy Bruneau | Assemblyline as a Malware Analysis Sandbox |
| 2023-01-28/a> | Didier Stevens | Sysinternals Updates: RDCMan v2.92, Sysmon v14.14, and ZoomIt v6.12 |
| 2023-01-26/a> | Tom Webb | Live Linux IR with UAC |
| 2023-01-23/a> | Xavier Mertens | Who's Resolving This Domain? |
| 2023-01-21/a> | Guy Bruneau | DShield Sensor JSON Log to Elasticsearch |
| 2023-01-15/a> | Johannes Ullrich | Elon Musk Themed Crypto Scams Flooding YouTube Today |
| 2023-01-08/a> | Guy Bruneau | DShield Sensor JSON Log Analysis |
| 2023-01-02/a> | Xavier Mertens | NetworkMiner 2.8 Released |
| 2022-12-21/a> | Guy Bruneau | DShield Sensor Setup in Azure |
| 2022-12-20/a> | Xavier Mertens | Linux File System Monitoring & Actions |
| 2022-12-19/a> | Xavier Mertens | Hunting for Mastodon Servers |
| 2022-12-18/a> | Guy Bruneau | Infostealer Malware with Double Extension |
| 2022-12-04/a> | Didier Stevens | Finger.exe LOLBin |
| 2022-12-03/a> | Guy Bruneau | Linux LOLBins Applications Available in Windows |
| 2022-12-02/a> | Brad Duncan | obama224 distribution Qakbot tries .vhd (virtual hard disk) images |
| 2022-11-29/a> | Johannes Ullrich | Identifying Groups of "Bot" Accounts on LinkedIn |
| 2022-11-28/a> | Johannes Ullrich | Ukraine Themed Twitter Spam Pushing iOS Scareware |
| 2022-11-24/a> | Xavier Mertens | Attackers Keep Phishing Victims Under Stress |
| 2022-11-19/a> | Guy Bruneau | McAfee Fake Antivirus Phishing Campaign is Back! |
| 2022-11-10/a> | Xavier Mertens | Do you collect "Observables" or "IOCs"? |
| 2022-11-05/a> | Guy Bruneau | Windows Malware with VHD Extension |
| 2022-11-02/a> | Rob VandenBrink | Breakpoints in Burp |
| 2022-10-30/a> | Didier Stevens | Sysinternals Updates: Process Explorer v17.0, Handle v5.0, Process Monitor v3.92 and Sysmon v14.11 |
| 2022-10-27/a> | Tom Webb | Supersizing your DUO and 365 Integration |
| 2022-10-19/a> | Xavier Mertens | Are Internet Scanning Services Good or Bad for You? |
| 2022-10-15/a> | Guy Bruneau | Malware - Covid Vaccination Supplier Declaration |
| 2022-10-07/a> | Xavier Mertens | Powershell Backdoor with DGA Capability |
| 2022-10-07/a> | Xavier Mertens | Critical Fortinet Vulnerability Ahead |
| 2022-10-04/a> | Johannes Ullrich | Credential Harvesting with Telegram API |
| 2022-09-21/a> | Xavier Mertens | Phishing Campaigns Use Free Online Resources |
| 2022-09-19/a> | Russ McRee | Chainsaw: Hunt, search, and extract event log records |
| 2022-09-15/a> | Xavier Mertens | Malicious Word Document with a Frameset |
| 2022-09-14/a> | Xavier Mertens | Easy Process Injection within Python |
| 2022-09-10/a> | Guy Bruneau | Phishing Word Documents with Suspicious URL |
| 2022-08-28/a> | Didier Stevens | Sysinternals Updates: Sysmon v14.0 and ZoomIt v6.01 |
| 2022-08-26/a> | Xavier Mertens | Paypal Phishing/Coinbase in One Image |
| 2022-08-26/a> | Guy Bruneau | HTTP/2 Packet Analysis with Wireshark |
| 2022-08-13/a> | Guy Bruneau | Phishing HTML Attachment as Voicemail Audio Transcription |
| 2022-08-11/a> | Xavier Mertens | InfoStealer Script Based on Curl and NSudo |
| 2022-08-02/a> | Johannes Ullrich | A Little DDoS in the Morning - Followup |
| 2022-08-02/a> | Johannes Ullrich | Increase in Chinese "Hacktivism" Attacks |
| 2022-08-01/a> | Johannes Ullrich | A Little DDoS In the Morning |
| 2022-07-28/a> | Johannes Ullrich | Exfiltrating Data With Bookmarks |
| 2022-07-25/a> | Xavier Mertens | PowerShell Script with Fileless Capability |
| 2022-07-23/a> | Guy Bruneau | Analysis of SSH Honeypot Data with PowerBI |
| 2022-07-22/a> | Yee Ching Tok | An Analysis of a Discerning Phishing Website |
| 2022-07-20/a> | Xavier Mertens | Malicious Python Script Behaving Like a Rubber Ducky |
| 2022-07-20/a> | Johannes Ullrich | Apple Patches Everything Day |
| 2022-07-13/a> | Xavier Mertens | Using Referers to Detect Phishing Attacks |
| 2022-07-09/a> | Didier Stevens | 7-Zip Editing & MoW |
| 2022-06-26/a> | Didier Stevens | My Paste Command |
| 2022-06-24/a> | Xavier Mertens | Python (ab)using The Windows GUI |
| 2022-06-23/a> | Xavier Mertens | FLOSS 2.0 Has Been Released |
| 2022-06-21/a> | Johannes Ullrich | Experimental New Domain / Domain Age API |
| 2022-06-19/a> | Didier Stevens | Video: Decoding Obfuscated BASE64 Statistically |
| 2022-06-18/a> | Didier Stevens | Decoding Obfuscated BASE64 Statistically |
| 2022-06-16/a> | Xavier Mertens | Houdini is Back Delivered Through a JavaScript Dropper |
| 2022-06-12/a> | Didier Stevens | Quickie: Follina, RTF & Explorer Preview Pane |
| 2022-06-09/a> | Brad Duncan | TA570 Qakbot (Qbot) tries CVE-2022-30190 (Follina) exploit (ms-msdt) |
| 2022-06-02/a> | Johannes Ullrich | Quick Answers in Incident Response: RECmd.exe |
| 2022-06-01/a> | Jan Kopriva | HTML phishing attachments - now with anti-analysis features |
| 2022-05-31/a> | Xavier Mertens | First Exploitation of Follina Seen in the Wild |
| 2022-05-18/a> | Jan Kopriva | Do you want 30 BTC? Nothing is easier (or cheaper) in this phishing campaign... |
| 2022-05-14/a> | Didier Stevens | Quick Analysis Of Phishing MSG |
| 2022-05-07/a> | Guy Bruneau | Phishing PDF Received in my ISC Mailbox |
| 2022-04-28/a> | Johannes Ullrich | A Day of SMB: What does our SMB/RPC Honeypot see? CVE-2022-26809 |
| 2022-04-24/a> | Didier Stevens | Analyzing a Phishing Word Document |
| 2022-04-23/a> | Guy Bruneau | Are Roku Streaming Devices Safe from Exploitation? |
| 2022-04-14/a> | Johannes Ullrich | An Update on CVE-2022-26809 - MSRPC Vulnerabliity - PATCH NOW |
| 2022-04-13/a> | Jan Kopriva | How is Ukrainian internet holding up during the Russian invasion? |
| 2022-04-11/a> | Johannes Ullrich | Spring: It isn't just about Spring4Shell. Spring Cloud Function Vulnerabilities are being probed too. |
| 2022-04-10/a> | Didier Stevens | Video: Method For String Extraction Filtering |
| 2022-04-09/a> | Didier Stevens | Method For String Extraction Filtering |
| 2022-04-07/a> | Johannes Ullrich | What is BIMI and how is it supposed to help with Phishing. |
| 2022-04-06/a> | Brad Duncan | Windows MetaStealer Malware |
| 2022-04-05/a> | Johannes Ullrich | WebLogic Crypto Miner Malware Disabling Alibaba Cloud Monitoring Tools |
| 2022-04-04/a> | Johannes Ullrich | Emptying the Phishtank: Are WordPress sites the Mosquitoes of the Internet? |
| 2022-03-31/a> | Johannes Ullrich | Spring Vulnerability Update - Exploitation Attempts CVE-2022-22965 |
| 2022-03-30/a> | Johannes Ullrich | Possible new Java Spring Framework Vulnerability (Updated: not a Spring problem) |
| 2022-03-30/a> | Johannes Ullrich | Java Springtime Confusion: What Vulnerability are We Talking About |
| 2022-03-29/a> | Johannes Ullrich | More Fake/Typosquatting Twitter Accounts Asking for Ukraine Crytocurrency Donations |
| 2022-03-26/a> | Guy Bruneau | Is buying Cyber Insurance a Must Now? |
| 2022-03-25/a> | Xavier Mertens | XLSB Files: Because Binary is Stealthier Than XML |
| 2022-03-24/a> | Xavier Mertens | Malware Delivered Through Free Sharing Tool |
| 2022-03-23/a> | Brad Duncan | Arkei Variants: From Vidar to Mars Stealer |
| 2022-03-22/a> | Johannes Ullrich | Statement by President Biden: What you need to do (or not do) |
| 2022-03-15/a> | Xavier Mertens | Clean Binaries with Suspicious Behaviour |
| 2022-03-09/a> | Xavier Mertens | Infostealer in a Batch File |
| 2022-03-07/a> | Johannes Ullrich | No Bitcoin - No Problem: Follow Up to Last Weeks Donation Scam |
| 2022-03-04/a> | Johannes Ullrich | Scam E-Mail Impersonating Red Cross |
| 2022-03-02/a> | Johannes Ullrich | The More Often Something is Repeated, the More True It Becomes: Dealing with Social Media |
| 2022-02-25/a> | Didier Stevens | Windows, Fixed IPv4 Addresses and APIPA |
| 2022-02-24/a> | Xavier Mertens | Ukraine & Russia Situation From a Domain Names Perspective |
| 2022-02-13/a> | Guy Bruneau | DHL Spear Phishing to Capture Username/Password |
| 2022-02-11/a> | Xavier Mertens | CinaRAT Delivered Through HTML ID Attributes |
| 2022-02-10/a> | Johannes Ullrich | Zyxel Network Storage Devices Hunted By Mirai Variant |
| 2022-02-05/a> | Didier Stevens | Power over Ethernet and Thermal Imaging |
| 2022-02-02/a> | Johannes Ullrich | Finding elFinder: Who is looking for your files? |
| 2022-01-31/a> | Xavier Mertens | Be careful with RPMSG files |
| 2022-01-29/a> | Guy Bruneau | SIEM In this Decade, Are They Better than the Last? |
| 2022-01-28/a> | Xavier Mertens | Malicious ISO Embedded in an HTML Page |
| 2022-01-21/a> | Xavier Mertens | Obscure Wininet.dll Feature? |
| 2022-01-20/a> | Xavier Mertens | RedLine Stealer Delivered Through FTP |
| 2022-01-18/a> | Jan Kopriva | Phishing e-mail with...an advertisement? |
| 2022-01-05/a> | Xavier Mertens | Code Reuse In the Malware Landscape |
| 2022-01-04/a> | Xavier Mertens | A Simple Batch File That Blocks People |
| 2022-01-03/a> | Xavier Mertens | McAfee Phishing Campaign with a Nice Fake Scan |
| 2022-01-02/a> | Guy Bruneau | Exchange Server - Email Trapped in Transport Queues |
| 2021-12-28/a> | Russ McRee | LotL Classifier tests for shells, exfil, and miners |
| 2021-12-23/a> | Xavier Mertens | Nicely Crafted indeed.com Login Page |
| 2021-12-21/a> | Xavier Mertens | More Undetected PowerShell Dropper |
| 2021-12-20/a> | Jan Kopriva | PowerPoint attachments, Agent Tesla and code reuse in malware |
| 2021-12-14/a> | Johannes Ullrich | Log4j: Getting ready for the long haul (CVE-2021-44228) |
| 2021-12-10/a> | Xavier Mertens | Python Shellcode Injection From JSON Data |
| 2021-12-09/a> | Yee Ching Tok | Phishing Direct Messages via Discord |
| 2021-12-06/a> | Xavier Mertens | The Importance of Out-of-Band Networks |
| 2021-12-04/a> | Guy Bruneau | A Review of Year 2021 |
| 2021-12-01/a> | Xavier Mertens | Info-Stealer Using webhook.site to Exfiltrate Data |
| 2021-11-25/a> | Didier Stevens | YARA's Private Strings |
| 2021-11-24/a> | Jan Kopriva | Phishing page hiding itself using dynamically adjusted IP-based allow list |
| 2021-11-21/a> | Didier Stevens | Backdooring PAM |
| 2021-11-20/a> | Guy Bruneau | Hikvision Security Cameras Potentially Exposed to Remote Code Execution |
| 2021-11-19/a> | Xavier Mertens | Downloader Disguised as Excel Add-In (XLL) |
| 2021-11-10/a> | Xavier Mertens | Shadow IT Makes People More Vulnerable to Phishing |
| 2021-10-31/a> | Didier Stevens | Sysinternals: Autoruns and Sysmon updates |
| 2021-10-30/a> | Guy Bruneau | Remote Desktop Protocol (RDP) Discovery |
| 2021-10-26/a> | Yee Ching Tok | Hunting for Phishing Sites Masquerading as Outlook Web Access |
| 2021-10-14/a> | Xavier Mertens | Port-Forwarding with Windows for the Win |
| 2021-10-13/a> | Johannes Ullrich | Please fix your E-Mail Brute forcing tool! |
| 2021-10-09/a> | Guy Bruneau | Scanning for Previous Oracle WebLogic Vulnerabilities |
| 2021-10-07/a> | Johannes Ullrich | Who Is Hunting For Your IPTV Set-Top Box? |
| 2021-09-25/a> | Didier Stevens | Strings Analysis: VBA & Excel4 Maldoc |
| 2021-09-25/a> | Didier Stevens | Video: Strings Analysis: VBA & Excel4 Maldoc |
| 2021-09-24/a> | Xavier Mertens | Keep an Eye on Your Users Mobile Devices (Simple Inventory) |
| 2021-09-20/a> | Johannes Ullrich | #OMIGOD Exploits Captured in the Wild. Researchers responsible for half of scans for related ports. |
| 2021-09-16/a> | Jan Kopriva | Phishing 101: why depend on one suspicious message subject when you can use many? |
| 2021-09-09/a> | Johannes Ullrich | Updates to Our Datafeeds/API |
| 2021-09-07/a> | Johannes Ullrich | Why I Gave Up on IPv6. And no, it is not because of security issues. |
| 2021-09-02/a> | Xavier Mertens | Attackers Will Always Abuse Major Events in our Lifes |
| 2021-08-24/a> | Johannes Ullrich | Attackers Hunting For Twilio Credentials |
| 2021-08-21/a> | Didier Stevens | New Versions Of Sysinternals Tools |
| 2021-08-19/a> | Johannes Ullrich | When Lightning Strikes. What works and doesn't work. |
| 2021-08-13/a> | Guy Bruneau | Scanning for Microsoft Exchange eDiscovery |
| 2021-08-04/a> | Yee Ching Tok | Pivoting and Hunting for Shenanigans from a Reported Phishing Domain |
| 2021-08-03/a> | Johannes Ullrich | Is this the Weirdest Phishing (SMishing?) Attempt Ever? |
| 2021-08-01/a> | Didier Stevens | procdump Version 10.1 |
| 2021-07-31/a> | Guy Bruneau | Unsolicited DNS Queries |
| 2021-07-28/a> | Jan Kopriva | A sextortion e-mail from...IT support?! |
| 2021-07-24/a> | Bojan Zdrnja | Active Directory Certificate Services (ADCS - PKI) domain admin vulnerability |
| 2021-07-21/a> | Johannes Ullrich | "Summer of SAM": Microsoft Releases Guidance for CVE-2021-36934 |
| 2021-07-19/a> | Rick Wanner | New Windows Print Spooler Vulnerability - CVE-2021-34481 |
| 2021-07-16/a> | Xavier Mertens | Multiple BaseXX Obfuscations |
| 2021-07-14/a> | Jan Kopriva | One way to fail at malspam - give recipients the wrong password for an encrypted attachment |
| 2021-07-13/a> | Johannes Ullrich | USPS Phishing Using Telegram to Collect Data |
| 2021-07-10/a> | Guy Bruneau | Scanning for Microsoft Secure Socket Tunneling Protocol |
| 2021-07-08/a> | Xavier Mertens | Using Sudo with Python For More Security Controls |
| 2021-07-06/a> | Xavier Mertens | Python DLL Injection Check |
| 2021-07-03/a> | Didier Stevens | Finding Strings With oledump.py |
| 2021-07-02/a> | Xavier Mertens | "inception.py"... Multiple Base64 Encodings |
| 2021-06-30/a> | Johannes Ullrich | CVE-2021-1675: Incomplete Patch and Leaked RCE Exploit |
| 2021-06-28/a> | Didier Stevens | CFBF Files Strings Analysis |
| 2021-06-26/a> | Guy Bruneau | CVE-2019-9670: Zimbra Collaboration Suite XXE vulnerability |
| 2021-06-22/a> | Jan Kopriva | Phishing asking recipients not to report abuse |
| 2021-06-18/a> | Daniel Wesemann | Network Forensics on Azure VMs (Part #2) |
| 2021-06-18/a> | Daniel Wesemann | Open redirects ... and why Phishers love them |
| 2021-06-15/a> | Johannes Ullrich | Multi Perimeter Device Exploit Mirai Version Hunting For Sonicwall, DLink, Cisco and more |
| 2021-06-12/a> | Guy Bruneau | Fortinet Targeted for Unpatched SSL VPN Discovery Activity |
| 2021-05-30/a> | Didier Stevens | Sysinternals: Procmon, Sysmon, TcpView and Process Explorer update |
| 2021-05-29/a> | Guy Bruneau | Spear-phishing Email Targeting Outlook Mail Clients |
| 2021-05-27/a> | Jan Kopriva | All your Base are...nearly equal when it comes to AV evasion, but 64-bit executables are not |
| 2021-05-22/a> | Xavier Mertens | "Serverless" Phishing Campaign |
| 2021-05-21/a> | Xavier Mertens | Locking Kernel32.dll As Anti-Debugging Technique |
| 2021-05-14/a> | Xavier Mertens | "Open" Access to Industrial Systems Interface is Also Far From Zero |
| 2021-05-12/a> | Jan Kopriva | Number of industrial control systems on the internet is lower then in 2020...but still far from zero |
| 2021-05-10/a> | Johannes Ullrich | Correctly Validating IP Addresses: Why encoding matters for input validation. |
| 2021-05-08/a> | Guy Bruneau | Who is Probing the Internet for Research Purposes? |
| 2021-05-07/a> | Daniel Wesemann | Exposed Azure Storage Containers |
| 2021-05-06/a> | Xavier Mertens | Alternative Ways To Perform Basic Tasks |
| 2021-05-02/a> | Didier Stevens | PuTTY And FileZilla Use The Same Fingerprint Registry Keys |
| 2021-04-30/a> | Remco Verhoef | Qiling: A true instrumentable binary emulation framework |
| 2021-04-29/a> | Xavier Mertens | From Python to .Net |
| 2021-04-24/a> | Guy Bruneau | Base64 Hashes Used in Web Scanning |
| 2021-04-23/a> | Xavier Mertens | Malicious PowerPoint Add-On: "Small Is Beautiful" |
| 2021-04-22/a> | Xavier Mertens | How Safe Are Your Docker Images? |
| 2021-04-19/a> | Jan Kopriva | Hunting phishing websites with favicon hashes |
| 2021-04-09/a> | Xavier Mertens | No Python Interpreter? This Simple RAT Installs Its Own Copy |
| 2021-04-06/a> | Jan Kopriva | Malspam with Lokibot vs. Outlook and RFCs |
| 2021-03-31/a> | Xavier Mertens | Quick Analysis of a Modular InfoStealer |
| 2021-03-19/a> | Xavier Mertens | Pastebin.com Used As a Simple C2 Channel |
| 2021-03-17/a> | Xavier Mertens | Defenders, Know Your Operating System Like Attackers Do! |
| 2021-03-12/a> | Guy Bruneau | Microsoft DHCP Logs Shipped to ELK |
| 2021-03-11/a> | Johannes Ullrich | Piktochart - Phishing with Infographics |
| 2021-03-06/a> | Xavier Mertens | Spotting the Red Team on VirusTotal! |
| 2021-03-04/a> | Xavier Mertens | From VBS, PowerShell, C Sharp, Process Hollowing to RAT |
| 2021-02-26/a> | Guy Bruneau | Pretending to be an Outlook Version Update |
| 2021-02-25/a> | Daniel Wesemann | Forensicating Azure VMs |
| 2021-02-17/a> | Xavier Mertens | The new "LinkedInSecureMessage" ? |
| 2021-02-13/a> | Guy Bruneau | vSphere Replication updates address a command injection vulnerability (CVE-2021-21976) - https://www.vmware.com/security/advisories/VMSA-2021-0001.html |
| 2021-02-13/a> | Guy Bruneau | Using Logstash to Parse IPtables Firewall Logs |
| 2021-02-10/a> | Brad Duncan | Phishing message to the ISC handlers email distro |
| 2021-01-30/a> | Guy Bruneau | PacketSifter as Network Parsing and Telemetry Tool |
| 2021-01-19/a> | Russ McRee | Gordon for fast cyber reputation checks |
| 2021-01-17/a> | Didier Stevens | New Release of Sysmon Adding Detection for Process Tampering |
| 2021-01-15/a> | Guy Bruneau | Obfuscated DNS Queries |
| 2021-01-10/a> | Didier Stevens | Maldoc Analysis With CyberChef |
| 2021-01-09/a> | Didier Stevens | Maldoc Strings Analysis |
| 2021-01-02/a> | Guy Bruneau | Protecting Home Office and Enterprise in 2021 |
| 2021-01-01/a> | Didier Stevens | Strings 2021 |
| 2020-12-29/a> | Jan Kopriva | Want to know what's in a folder you don't have a permission to access? Try asking your AV solution... |
| 2020-12-26/a> | Didier Stevens | base64dump.py Supported Encodings |
| 2020-12-14/a> | Johannes Ullrich | SolarWinds Breach Used to Infiltrate Customer Networks (Solarigate) |
| 2020-12-13/a> | Didier Stevens | KringleCon 2020 |
| 2020-12-08/a> | Johannes Ullrich | December 2020 Microsoft Patch Tuesday: Exchange, Sharepoint, Dynamics and DNS Spoofing |
| 2020-12-06/a> | Didier Stevens | oledump's Indicators (video) |
| 2020-12-05/a> | Guy Bruneau | Is IP 91.199.118.137 testing Access to aahwwx.52host.xyz? |
| 2020-12-04/a> | Guy Bruneau | Detecting Actors Activity with Threat Intel |
| 2020-11-19/a> | Xavier Mertens | PowerShell Dropper Delivering Formbook |
| 2020-11-07/a> | Guy Bruneau | Cryptojacking Targeting WebLogic TCP/7001 |
| 2020-11-05/a> | Xavier Mertens | Did You Spot "Invoke-Expression"? |
| 2020-10-25/a> | Didier Stevens | Video: Pascal Strings |
| 2020-10-24/a> | Guy Bruneau | An Alternative to Shodan, Censys with User-Agent CensysInspect/1.1 |
| 2020-10-22/a> | Jan Kopriva | BazarLoader phishing lures: plan a Halloween party, get a bonus and be fired in the same afternoon |
| 2020-10-11/a> | Didier Stevens | Analyzing MSG Files With plugin_msg_summary |
| 2020-10-09/a> | Jan Kopriva | Phishing kits as far as the eye can see |
| 2020-10-03/a> | Guy Bruneau | Scanning for SOHO Routers |
| 2020-10-02/a> | Xavier Mertens | Analysis of a Phishing Kit |
| 2020-09-30/a> | Johannes Ullrich | Scans for FPURL.xml: Reconnaissance or Not? |
| 2020-09-24/a> | Xavier Mertens | Party in Ibiza with PowerShell |
| 2020-09-21/a> | Jan Kopriva | Slightly broken overlay phishing |
| 2020-09-20/a> | Guy Bruneau | Analysis of a Salesforce Phishing Emails |
| 2020-09-17/a> | Xavier Mertens | Suspicious Endpoint Containment with OSSEC |
| 2020-09-02/a> | Xavier Mertens | Python and Risky Windows API Calls |
| 2020-09-01/a> | Johannes Ullrich | Exposed Windows Domain Controllers Used in CLDAP DDoS Attacks |
| 2020-08-30/a> | Johannes Ullrich | CenturyLink Outage Causing Internet Wide Problems |
| 2020-08-28/a> | Xavier Mertens | Example of Malicious DLL Injected in PowerShell |
| 2020-08-25/a> | Xavier Mertens | Keep An Eye on LOLBins |
| 2020-08-24/a> | Xavier Mertens | Tracking A Malware Campaign Through VT |
| 2020-08-22/a> | Guy Bruneau | Remote Desktop (TCP/3389) and Telnet (TCP/23), What might they have in Common? |
| 2020-08-20/a> | Rob VandenBrink | Office 365 Mail Forwarding Rules (and other Mail Rules too) |
| 2020-08-10/a> | Bojan Zdrnja | Scoping web application and web service penetration tests |
| 2020-08-08/a> | Guy Bruneau | Scanning Activity Include Netcat Listener |
| 2020-08-03/a> | Johannes Ullrich | A Word of Caution: Helping Out People Being Stalked Online |
| 2020-07-30/a> | Johannes Ullrich | Python Developers: Prepare!!! |
| 2020-07-28/a> | Johannes Ullrich | All I want this Tuesday: More Data |
| 2020-07-27/a> | Johannes Ullrich | In Memory of Donald Smith |
| 2020-07-26/a> | Didier Stevens | Cracking Maldoc VBA Project Passwords |
| 2020-07-20/a> | Rick Wanner | Sextortion Update: The Final Final Chapter |
| 2020-07-19/a> | Guy Bruneau | Scanning Activity for ZeroShell Unauthenticated Access |
| 2020-07-12/a> | Didier Stevens | Maldoc: VBA Purging Example |
| 2020-07-11/a> | Guy Bruneau | Scanning Home Internet Facing Devices to Exploit |
| 2020-07-08/a> | Xavier Mertens | If You Want Something Done Right, You Have To Do It Yourself... Malware Too! |
| 2020-07-04/a> | Russ McRee | Happy FouRth of July from the Internet Storm Center |
| 2020-06-29/a> | Didier Stevens | Sysmon and Alternate Data Streams |
| 2020-06-25/a> | Johannes Ullrich | Tech Tuesday Recap / Recordings: Part 2 (Installing the Honeypot) release. |
| 2020-06-24/a> | Jan Kopriva | Using Shell Links as zero-touch downloaders and to initiate network connections |
| 2020-06-18/a> | Jan Kopriva | Broken phishing accidentally exploiting Outlook zero-day |
| 2020-06-16/a> | Xavier Mertens | Sextortion to The Next Level |
| 2020-06-15/a> | Rick Wanner | HTML based Phishing Run |
| 2020-06-13/a> | Guy Bruneau | Mirai Botnet Activity |
| 2020-06-11/a> | Xavier Mertens | Anti-Debugging JavaScript Techniques |
| 2020-06-08/a> | Didier Stevens | Translating BASE64 Obfuscated Scripts |
| 2020-06-04/a> | Xavier Mertens | Anti-Debugging Technique based on Memory Protection |
| 2020-06-01/a> | Jim Clausing | Stackstrings, type 2 |
| 2020-05-27/a> | Jan Kopriva | Frankenstein's phishing using Google Cloud Storage |
| 2020-05-23/a> | Xavier Mertens | AgentTesla Delivered via a Malicious PowerPoint Add-In |
| 2020-05-22/a> | Didier Stevens | Some Strings to Remember |
| 2020-05-21/a> | Xavier Mertens | Malware Triage with FLOSS: API Calls Based Behavior |
| 2020-05-16/a> | Guy Bruneau | Scanning for Outlook Web Access (OWA) & Microsoft Exchange Control Panel (ECP) |
| 2020-05-14/a> | Rob VandenBrink | Patch Tuesday Revisited - CVE-2020-1048 isn't as "Medium" as MS Would Have You Believe |
| 2020-05-04/a> | Didier Stevens | Sysmon and File Deletion |
| 2020-05-02/a> | Guy Bruneau | Phishing PDF with Unusual Hostname |
| 2020-04-29/a> | Johannes Ullrich | Privacy Preserving Protocols to Trace Covid19 Exposure |
| 2020-04-28/a> | Jan Kopriva | Agent Tesla delivered by the same phishing campaign for over a year |
| 2020-04-27/a> | Xavier Mertens | Powershell Payload Stored in a PSCredential Object |
| 2020-04-18/a> | Guy Bruneau | Maldoc Falsely Represented as DOCX Invoice Redirecting to Fake Apple Store |
| 2020-04-16/a> | Johannes Ullrich | Using AppLocker to Prevent Living off the Land Attacks |
| 2020-04-13/a> | Jan Kopriva | Look at the same phishing campaign 3 months apart |
| 2020-04-07/a> | Johannes Ullrich | Increase in RDP Scanning |
| 2020-04-03/a> | Xavier Mertens | Obfuscated with a Simple 0x0A |
| 2020-03-30/a> | Jan Kopriva | Crashing explorer.exe with(out) a click |
| 2020-03-28/a> | Didier Stevens | Covid19 Domain Classifier |
| 2020-03-27/a> | Johannes Ullrich | Help us classify Covid19 related domains https://isc.sans.edu/covidclassifier.html (login required) |
| 2020-03-23/a> | Didier Stevens | Windows Zeroday Actively Exploited: Type 1 Font Parsing Remote Code Execution Vulnerability |
| 2020-03-21/a> | Guy Bruneau | Honeypot - Scanning and Targeting Devices & Services |
| 2020-03-16/a> | Jan Kopriva | Desktop.ini as a post-exploitation tool |
| 2020-03-15/a> | Guy Bruneau | VPN Access and Activity Monitoring |
| 2020-03-14/a> | Didier Stevens | Phishing PDF With Incremental Updates. |
| 2020-03-13/a> | Rob VandenBrink | Not all Ethernet NICs are Created Equal - Trying to Capture Invalid Ethernet Frames |
| 2020-03-05/a> | Xavier Mertens | Will You Put Your Password in a Survey? |
| 2020-02-29/a> | Guy Bruneau | Hazelcast IMDG Discover Scan |
| 2020-02-18/a> | Jan Kopriva | Discovering contents of folders in Windows without permissions |
| 2020-02-17/a> | Didier Stevens | curl and SSPI |
| 2020-02-16/a> | Guy Bruneau | SOAR or not to SOAR? |
| 2020-02-15/a> | Didier Stevens | bsdtar on Windows 10 |
| 2020-02-10/a> | Jan Kopriva | Current PayPal phishing campaign or "give me all your personal information" |
| 2020-02-03/a> | Jan Kopriva | Analysis of a triple-encrypted AZORult downloader |
| 2020-02-02/a> | Didier Stevens | Video: Stego & Cryptominers |
| 2020-01-27/a> | Johannes Ullrich | Network Security Perspective on Coronavirus Preparedness |
| 2020-01-25/a> | Guy Bruneau | Is Threat Hunting the new Fad? |
| 2020-01-24/a> | Xavier Mertens | Why Phishing Remains So Popular? |
| 2020-01-21/a> | Russ McRee | DeepBlueCLI: Powershell Threat Hunting |
| 2020-01-16/a> | Jan Kopriva | Picks of 2019 malware - the large, the small and the one full of null bytes |
| 2020-01-09/a> | Kevin Shortt | Windows 7 - End of Life |
| 2020-01-04/a> | Didier Stevens | KringleCon 2019 |
| 2019-12-26/a> | Xavier Mertens | Bypassing UAC to Install a Cryptominer |
| 2019-12-22/a> | Didier Stevens | Extracting VBA Macros From .DWG Files |
| 2019-12-16/a> | Didier Stevens | Malicious .DWG Files? |
| 2019-12-13/a> | Jan Kopriva | Internet banking sites and their use of TLS... and SSLv3... and SSLv2?! |
| 2019-12-06/a> | Jan Kopriva | Phishing with a self-contained credentials-stealing webpage |
| 2019-12-05/a> | Jan Kopriva | E-mail from Agent Tesla |
| 2019-12-04/a> | Jan Kopriva | Analysis of a strangely poetic malware |
| 2019-11-27/a> | Brad Duncan | Finding an Agent Tesla malware sample |
| 2019-11-26/a> | Jan Kopriva | Lessons learned from playing a willing phish |
| 2019-11-25/a> | Xavier Mertens | My Little DoH Setup |
| 2019-11-23/a> | Guy Bruneau | Local Malware Analysis with Malice |
| 2019-11-11/a> | Johannes Ullrich | Are We Going Back to TheMoon (and How is Liquor Involved)? |
| 2019-11-03/a> | Didier Stevens | You Too? "Unusual Activity with Double Base64 Encoding" |
| 2019-10-31/a> | Jan Kopriva | EML attachments in O365 - a recipe for phishing |
| 2019-10-30/a> | Xavier Mertens | Keep an Eye on Remote Access to Mailboxes |
| 2019-10-27/a> | Guy Bruneau | Unusual Activity with Double Base64 Encoding |
| 2019-10-24/a> | Johannes Ullrich | Your Supply Chain Doesn't End At Receiving: How Do You Decommission Network Equipment? |
| 2019-10-20/a> | Guy Bruneau | Scanning Activity for NVMS-9000 Digital Video Recorder |
| 2019-10-17/a> | Jan Kopriva | Phishing e-mail spoofing SPF-enabled domain |
| 2019-10-16/a> | Xavier Mertens | Security Monitoring: At Network or Host Level? |
| 2019-10-10/a> | Rob VandenBrink | Mining Live Networks for OUI Data Oddness |
| 2019-10-09/a> | Brad Duncan | What data does Vidar malware steal from an infected host? |
| 2019-09-27/a> | Xavier Mertens | New Scans for Polycom Autoconfiguration Files |
| 2019-09-19/a> | Xavier Mertens | Blocklisting or Whitelisting in the Right Way |
| 2019-09-07/a> | Guy Bruneau | Unidentified Scanning Activity |
| 2019-08-25/a> | Guy Bruneau | Are there any Advantages of Buying Cyber Security Insurance? |
| 2019-08-15/a> | Didier Stevens | Analysis of a Spearphishing Maldoc |
| 2019-08-09/a> | Xavier Mertens | 100% JavaScript Phishing Page |
| 2019-08-08/a> | Johannes Ullrich | [Guest Diary] The good, the bad and the non-functional, or "how not to do an attack campaign" |
| 2019-07-25/a> | Rob VandenBrink | When Users Attack! Users (and Admins) Thwarting Security Controls |
| 2019-07-17/a> | Xavier Mertens | Analyzis of DNS TXT Records |
| 2019-07-13/a> | Guy Bruneau | Guidance to Protect DNS Against Hijacking & Scanning for Version.BIND Still a Thing |
| 2019-07-08/a> | Didier Stevens | Machine Code? No! |
| 2019-07-07/a> | Rick Wanner | OpSec and OSInt |
| 2019-07-04/a> | Didier Stevens | Machine Code? |
| 2019-07-02/a> | Xavier Mertens | Malicious Script With Multiple Payloads |
| 2019-06-27/a> | Rob VandenBrink | Finding the Gold in a Pile of Pennies - Long Tail Analysis in PowerShell |
| 2019-06-20/a> | Xavier Mertens | Using a Travel Packing App for Infosec Purpose |
| 2019-06-18/a> | Johannes Ullrich | What You Need To Know About TCP "SACK Panic" |
| 2019-06-14/a> | Jim Clausing | A few Ghidra tips for IDA users, part 4 - function call graphs |
| 2019-06-06/a> | Xavier Mertens | Keep an Eye on Your WMI Logs |
| 2019-05-22/a> | Johannes Ullrich | An Update on the Microsoft Windows RDP "Bluekeep" Vulnerability (CVE-2019-0708) [now with pcaps] |
| 2019-05-20/a> | Tom Webb | CVE-2019-0604 Attack |
| 2019-05-13/a> | Xavier Mertens | From Phishing To Ransomware? |
| 2019-05-06/a> | Didier Stevens | Text and Text |
| 2019-05-03/a> | Jim Clausing | A few Ghidra tips for IDA users, part 3 - conversion, labels, and comments |
| 2019-04-24/a> | Rob VandenBrink | Where have all the Domain Admins gone? Rooting out Unwanted Domain Administrators |
| 2019-04-17/a> | Jim Clausing | A few Ghidra tips for IDA users, part 2 - strings and parameters |
| 2019-04-17/a> | Xavier Mertens | Malware Sample Delivered Through UDF Image |
| 2019-04-08/a> | Jim Clausing | A few Ghidra tips for IDA users, part 1 - the decompiler/unreachable code |
| 2019-04-03/a> | Jim Clausing | A few Ghidra tips for IDA users, part 0 - automatic comments for API call parameters |
| 2019-04-02/a> | Johannes Ullrich | Fake AV is Back: LaCie Network Drives Used to Spread Malware |
| 2019-03-27/a> | Xavier Mertens | Running your Own Passive DNS Service |
| 2019-03-21/a> | Xavier Mertens | New Wave of Extortion Emails: Central Intelligence Agency Case |
| 2019-03-05/a> | Rob VandenBrink | Powershell, Active Directory and the Windows Host Firewall |
| 2019-02-28/a> | Tom Webb | Phishing impersonations |
| 2019-02-07/a> | Xavier Mertens | Phishing Kit with JavaScript Keylogger |
| 2019-02-03/a> | Didier Stevens | Video: Analyzing a Simple HTML Phishing Attachment |
| 2019-02-01/a> | Rick Wanner | Sextortion: Follow the Money Part 3 - The cashout begins! |
| 2019-01-31/a> | Xavier Mertens | Tracking Unexpected DNS Changes |
| 2019-01-30/a> | Russ McRee | CR19-010: The United States vs. Huawei |
| 2019-01-29/a> | Johannes Ullrich | A Not So Well Done Phish (Why Attackers need to Implement IPv6 Now! ;-) ) |
| 2019-01-24/a> | Brad Duncan | Malspam with Word docs uses macro to run Powershell script and steal system data |
| 2019-01-18/a> | John Bambenek | Sextortion Bitcoin on the Move |
| 2019-01-14/a> | Rob VandenBrink | Still Running Windows 7? Time to think about that upgrade project! |
| 2019-01-10/a> | Brad Duncan | Heartbreaking Emails: "Love You" Malspam |
| 2019-01-02/a> | Lorna Hutcheson | Gift Card Scams on the rise |
| 2019-01-02/a> | Xavier Mertens | Malicious Script Leaking Data via FTP |
| 2018-12-27/a> | Didier Stevens | Matryoshka Phish |
| 2018-12-26/a> | Didier Stevens | Bitcoin "Blocklists" |
| 2018-12-23/a> | Guy Bruneau | Scanning Activity, end Goal is to add Hosts to Mirai Botnet |
| 2018-12-22/a> | Didier Stevens | KringleCon 2018 |
| 2018-12-21/a> | Lorna Hutcheson | Phishing Attempts That Bypass 2FA |
| 2018-12-19/a> | Xavier Mertens | Restricting PowerShell Capabilities with NetSh |
| 2018-12-19/a> | Xavier Mertens | Microsoft OOB Patch for Internet Explorer: Scripting Engine Memory Corruption Vulnerability |
| 2018-12-16/a> | Guy Bruneau | Random Port Scan for Open RDP Backdoor |
| 2018-12-13/a> | Xavier Mertens | Phishing Attack Through Non-Delivery Notification |
| 2018-12-09/a> | Didier Stevens | Quickie: String Analysis is Still Useful |
| 2018-11-30/a> | Remco Verhoef | CoinMiners searching for hosts |
| 2018-11-22/a> | Xavier Mertens | Divided Payload in Multiple Pasties |
| 2018-11-20/a> | Xavier Mertens | Querying DShield from Cortex |
| 2018-11-18/a> | Guy Bruneau | Multipurpose PCAP Analysis Tool |
| 2018-11-17/a> | Xavier Mertens | Quickly Investigating Websites with Lookyloo |
| 2018-11-15/a> | Brad Duncan | Emotet infection with IcedID banking Trojan |
| 2018-11-14/a> | Brad Duncan | Day in the life of a researcher: Finding a wave of Trickbot malspam |
| 2018-11-12/a> | Rick Wanner | Using the Neutrino ip-blocklist API to test general badness of an IP |
| 2018-11-11/a> | Pasquale Stirparo | Community contribution: joining forces or multiply solutions? |
| 2018-10-26/a> | Xavier Mertens | Dissecting Malicious Office Documents with Linux |
| 2018-10-17/a> | Russ McRee | RedHunt Linux - Adversary Emulation, Threat Hunting & Intelligence |
| 2018-09-28/a> | Xavier Mertens | More Excel DDE Code Injection |
| 2018-09-20/a> | Xavier Mertens | Hunting for Suspicious Processes with OSSEC |
| 2018-09-13/a> | Xavier Mertens | Malware Delivered Through MHT Files |
| 2018-09-07/a> | Xavier Mertens | Crypto Mining in a Windows Headless Browser |
| 2018-09-05/a> | Rob VandenBrink | Where have all my Certificates gone? (And when do they expire?) |
| 2018-09-05/a> | Xavier Mertens | Malicious PowerShell Compiling C# Code on the Fly |
| 2018-08-30/a> | Xavier Mertens | Crypto Mining Is More Popular Than Ever! |
| 2018-08-29/a> | Xavier Mertens | 3D Printers in The Wild, What Can Go Wrong? |
| 2018-08-26/a> | Didier Stevens | Identifying numeric obfuscation |
| 2018-08-23/a> | Xavier Mertens | Simple Phishing Through formcrafts.com |
| 2018-08-12/a> | Didier Stevens | A URL shortener handy for phishers |
| 2018-08-10/a> | Remco Verhoef | Hunting SSL/TLS clients using JA3 |
| 2018-08-06/a> | Didier Stevens | Numeric obfuscation: another example |
| 2018-08-05/a> | Didier Stevens | Video: Maldoc analysis with standard Linux tools |
| 2018-08-04/a> | Didier Stevens | Dealing with numeric obfuscation in malicious scripts |
| 2018-07-30/a> | Xavier Mertens | Exploiting the Power of Curl |
| 2018-07-29/a> | Guy Bruneau | Using RITA for Threat Analysis |
| 2018-07-21/a> | Didier Stevens | BTC pickpockets are back |
| 2018-07-17/a> | Xavier Mertens | Searching for Geographically Improbable Login Attempts |
| 2018-07-15/a> | Didier Stevens | Video: Retrieving and processing JSON data (BTC example) |
| 2018-07-15/a> | Didier Stevens | Extracting BTC addresses from emails |
| 2018-07-14/a> | Didier Stevens | Retrieving and processing JSON data (BTC example) |
| 2018-07-13/a> | Xavier Mertens | Cryptominer Delivered Though Compromized JavaScript File |
| 2018-07-03/a> | Didier Stevens | Progress indication for scripts on Windows |
| 2018-07-02/a> | Guy Bruneau | Hello Peppa! - PHP Scans |
| 2018-07-01/a> | Didier Stevens | Video: Analyzing XPS Files |
| 2018-06-30/a> | Didier Stevens | XPS samples |
| 2018-06-26/a> | Didier Stevens | Analyzing XPS files |
| 2018-06-22/a> | Lorna Hutcheson | XPS Attachment Used for Phishing |
| 2018-06-21/a> | Xavier Mertens | Are Your Hunting Rules Still Working? |
| 2018-06-19/a> | Xavier Mertens | PowerShell: ScriptBlock Logging... Or Not? |
| 2018-06-13/a> | Xavier Mertens | A Bunch of Compromized Wordpress Sites |
| 2018-06-07/a> | Remco Verhoef | Automated twitter loot collection |
| 2018-06-05/a> | Xavier Mertens | Malicious Post-Exploitation Batch File |
| 2018-05-24/a> | Xavier Mertens | "Blocked" Does Not Mean "Forget It" |
| 2018-05-22/a> | Xavier Mertens | Malware Distributed via .slk Files |
| 2018-05-09/a> | Xavier Mertens | Nice Phishing Sample Delivering Trickbot |
| 2018-05-07/a> | Xavier Mertens | Adding Persistence Via Scheduled Tasks |
| 2018-05-03/a> | Renato Marinho | WebLogic Exploited in the Wild (Again) |
| 2018-05-02/a> | Russ McRee | Windows Commands Reference - An InfoSec Must Have |
| 2018-03-12/a> | Xavier Mertens | Payload delivery via SMB |
| 2018-03-05/a> | Xavier Mertens | Malicious Bash Script with Multiple Features |
| 2018-03-04/a> | Xavier Mertens | The Crypto Miners Fight For CPU Cycles |
| 2018-03-02/a> | Xavier Mertens | Common Patterns Used in Phishing Campaigns Files |
| 2018-02-25/a> | Guy Bruneau | Blackhole Advertising Sites with Pi-hole |
| 2018-02-01/a> | Xavier Mertens | Adaptive Phishing Kit |
| 2018-01-31/a> | Tom Webb | Tax Phishing Time |
| 2018-01-25/a> | Xavier Mertens | Ransomware as a Service |
| 2018-01-20/a> | Didier Stevens | An RTF phish |
| 2018-01-13/a> | Rick Wanner | Flaw in Intel's Active Management Technology (AMT) |
| 2018-01-11/a> | Xavier Mertens | Mining or Nothing! |
| 2018-01-07/a> | Guy Bruneau | SSH Scans by Clients Types |
| 2018-01-03/a> | John Bambenek | Phishing to Rural America Leads to Six-figure Wire Fraud Losses |
| 2018-01-02/a> | Didier Stevens | PDF documents & URLs: video |
| 2018-01-01/a> | Didier Stevens | What is new? |
| 2017-12-27/a> | Guy Bruneau | What are your Security Challenges for 2018? |
| 2017-12-19/a> | Xavier Mertens | Example of 'MouseOver' Link in a Powerpoint File |
| 2017-12-14/a> | Russ McRee | Security Planner: Improve your online safety |
| 2017-12-13/a> | Xavier Mertens | Tracking Newly Registered Domains |
| 2017-12-05/a> | Tom Webb | IR using the Hive Project. |
| 2017-12-02/a> | Xavier Mertens | Using Bad Material for the Good |
| 2017-12-01/a> | Xavier Mertens | Phishing Kit (Ab)Using Cloud Services |
| 2017-11-29/a> | Xavier Mertens | Fileless Malicious PowerShell Sample |
| 2017-11-25/a> | Guy Bruneau | Benefits associated with the use of Open Source Software |
| 2017-11-23/a> | Xavier Mertens | Proactive Malicious Domain Search |
| 2017-11-17/a> | Xavier Mertens | Top-100 Malicious IP STIX Feed |
| 2017-11-16/a> | Xavier Mertens | Suspicious Domains Tracking Dashboard |
| 2017-11-15/a> | Xavier Mertens | If you want something done right, do it yourself! |
| 2017-11-13/a> | Guy Bruneau | jsonrpc Scanning for root account |
| 2017-11-13/a> | Guy Bruneau | VBE Embeded Script (info.zip) |
| 2017-11-11/a> | Xavier Mertens | Keep An Eye on your Root Certificates |
| 2017-11-10/a> | Bojan Zdrnja | Battling e-mail phishing |
| 2017-11-05/a> | Didier Stevens | Extracting the text from PDF documents |
| 2017-11-04/a> | Didier Stevens | PDF documents & URLs |
| 2017-11-01/a> | Rob VandenBrink | Securing SSH Services - Go Blue Team!! |
| 2017-10-18/a> | Renato Marinho | Baselining Servers to Detect Outliers |
| 2017-10-06/a> | Johannes Ullrich | What's in a cable? The dangers of unauthorized cables |
| 2017-10-02/a> | Xavier Mertens | Investigating Security Incidents with Passive DNS |
| 2017-09-30/a> | Lorna Hutcheson | Who's Borrowing your Resources? |
| 2017-09-25/a> | Renato Marinho | XPCTRA Malware Steals Banking and Digital Wallet User's Credentials |
| 2017-09-22/a> | Russell Eubanks | What is the State of Your Union? |
| 2017-09-18/a> | Xavier Mertens | Getting some intelligence from malspam |
| 2017-09-18/a> | Johannes Ullrich | SANS Securingthehuman posted a follow up to their Equifax breach webcast: https://securingthehuman.sans.org/blog/2017/09/15/equifax-webcast-follow-up |
| 2017-09-17/a> | Guy Bruneau | rockNSM as a Incident Response Package |
| 2017-09-13/a> | Rob VandenBrink | Sysinternals Update: Sysmon v6.10, Process Monitor v3.40, Autoruns v13.80, AccessChk v6.11 - https://blogs.technet.microsoft.com/sysinternals/2017/09/12/sysinternals-update-sysmon-v6-1-process-monitor-v3-4-autoruns-v13-8-accesschk-v6-11/ |
| 2017-09-11/a> | Russ McRee | Windows Auditing with WINspect |
| 2017-09-06/a> | Adrien de Beaupre | Modern Web Application Penetration Testing , Hash Length Extension Attacks |
| 2017-09-02/a> | Xavier Mertens | AutoIT based malware back in the wild |
| 2017-08-24/a> | Bojan Zdrnja | Free Bitcoins? Why not? |
| 2017-08-18/a> | Renato Marinho | EngineBox Malware Supports 10+ Brazilian Banks |
| 2017-08-16/a> | Xavier Mertens | Analysis of a Paypal phishing kit |
| 2017-08-15/a> | Brad Duncan | Malspam pushing Trickbot banking Trojan |
| 2017-08-13/a> | Didier Stevens | The Good Phishing Email |
| 2017-08-07/a> | Xavier Mertens | Increase of phpMyAdmin scans |
| 2017-07-30/a> | Guy Bruneau | Text Banking Scams |
| 2017-07-24/a> | Russell Eubanks | Trends Over Time |
| 2017-07-16/a> | Renato Marinho | SMS Phishing induces victims to photograph its own token card |
| 2017-07-12/a> | Xavier Mertens | Backup Scripts, the FIM of the Poor |
| 2017-07-09/a> | Russ McRee | Adversary hunting with SOF-ELK |
| 2017-07-05/a> | Didier Stevens | Selecting domains with random names |
| 2017-06-27/a> | Brad Duncan | A Tale of Two Phishies |
| 2017-06-17/a> | Guy Bruneau | Mapping Use Cases to Logs. Which Logs are the Most Important to Collect? |
| 2017-06-15/a> | Bojan Zdrnja | Uberscammers |
| 2017-06-14/a> | Xavier Mertens | Systemd Could Fallback to Google DNS? |
| 2017-06-08/a> | Tom Webb | Summer STEM for Kids |
| 2017-06-02/a> | Xavier Mertens | Phishing Campaigns Follow Trends |
| 2017-06-01/a> | Xavier Mertens | Sharing Private Data with Webcast Invitations |
| 2017-05-31/a> | Pasquale Stirparo | Analysis of Competing Hypotheses, WCry and Lazarus (ACH part 2) |
| 2017-05-28/a> | Pasquale Stirparo | Analysis of Competing Hypotheses (ACH part 1) |
| 2017-05-28/a> | Guy Bruneau | CyberChef a Must Have Tool in your Tool bag! |
| 2017-05-20/a> | Xavier Mertens | Typosquatting: Awareness and Hunting |
| 2017-05-13/a> | Guy Bruneau | Has anyone Tested WannaCry Killswitch? - https://blog.didierstevens.com/2017/05/13/quickpost-wcry-killswitch-check-is-not-proxy-aware/ |
| 2017-05-06/a> | Xavier Mertens | The story of the CFO and CEO... |
| 2017-05-05/a> | Xavier Mertens | HTTP Headers... the Achilles' heel of many applications |
| 2017-05-03/a> | Bojan Zdrnja | OAUTH phishing against Google Docs ? beware! |
| 2017-04-22/a> | Jim Clausing | WTF tcp port 81 |
| 2017-04-20/a> | Xavier Mertens | DNS Query Length... Because Size Does Matter |
| 2017-04-18/a> | Johannes Ullrich | Yet Another Apple Phish and Some DNS Lessons Learned From It |
| 2017-04-16/a> | Johannes Ullrich | Tool to Detect Active Phishing Attacks Using Unicode Look-Alike Domains |
| 2017-03-28/a> | Xavier Mertens | Logical & Physical Security Correlation |
| 2017-03-24/a> | Xavier Mertens | Nicely Obfuscated JavaScript Sample |
| 2017-03-15/a> | Xavier Mertens | Retro Hunting! |
| 2017-03-06/a> | Renato Marinho | A very convincing Typosquatting + Social Engineering campaign is targeting Santander corporate customers in Brazil |
| 2017-02-12/a> | Xavier Mertens | Analysis of a Suspicious Piece of JavaScript |
| 2017-02-05/a> | Xavier Mertens | Many Malware Samples Found on Pastebin |
| 2017-02-02/a> | Rick Wanner | Multiple vulnerabilities discovered in popular printer models |
| 2017-02-01/a> | Xavier Mertens | Quick Analysis of Data Left Available by Attackers |
| 2017-01-18/a> | Rob VandenBrink | Making Windows 10 a bit less "Creepy" - Common Privacy Settings |
| 2017-01-12/a> | Mark Baggett | Some tools updates |
| 2017-01-12/a> | Mark Baggett | System Resource Utilization Monitor |
| 2017-01-11/a> | Johannes Ullrich | January 2017 Edition of Ouch! Security Awareness Newsletter Released: https://securingthehuman.sans.org/ouch |
| 2017-01-10/a> | Johannes Ullrich | Realtors Be Aware: You Are a Target |
| 2017-01-10/a> | Johannes Ullrich | Port 37777 "MapTable" Requests |
| 2017-01-06/a> | John Bambenek | Great Misadventures of Security Vendors: Absurd Sandboxing Edition |
| 2017-01-04/a> | John Bambenek | Mixed Messages : Novel Phishing Attempts Trying to Steal Your E-mail Password Goes Wrong |
| 2016-11-23/a> | Tom Webb | Mapping Attack Methodology to Controls |
| 2016-11-22/a> | Didier Stevens | Update:ZIP With Comment |
| 2016-11-18/a> | Didier Stevens | VBA Shellcode and Windows 10 |
| 2016-11-16/a> | Xavier Mertens | Example of Getting Analysts & Researchers Away |
| 2016-11-13/a> | Guy Bruneau | Bitcoin Miner File Upload via FTP |
| 2016-11-11/a> | Rick Wanner | Benevolent malware? reincarna/Linux.Wifatch |
| 2016-11-02/a> | Rob VandenBrink | What Does a Pentest Look Like? |
| 2016-10-25/a> | Xavier Mertens | Another Day, Another Spam... |
| 2016-10-10/a> | Didier Stevens | Radare2: rahash2 |
| 2016-10-08/a> | Russell Eubanks | Unauthorized Change Detected! |
| 2016-10-02/a> | Guy Bruneau | Is there an Infosec Cybersecurity Talent Shortage? |
| 2016-09-25/a> | Pasquale Stirparo | Defining Threat Intelligence Requirements |
| 2016-09-04/a> | Russ McRee | Kali Linux 2016.2 Release: https://www.kali.org/news/kali-linux-20162-release/ |
| 2016-09-01/a> | Xavier Mertens | Maxmind.com (Ab)used As Anti-Analysis Technique |
| 2016-08-29/a> | Russ McRee | Recommended Reading: Intrusion Detection Using Indicators of Compromise Based on Best Practices and Windows Event Logs |
| 2016-08-24/a> | Tom Webb | Stay on Track During IR |
| 2016-08-23/a> | Xavier Mertens | Voice Message Notifications Deliver Ransomware |
| 2016-08-02/a> | Tom Webb | Windows 10 Anniversary Update Available |
| 2016-07-31/a> | Pasquale Stirparo | Sharing (intel) is caring... or not? |
| 2016-07-27/a> | Xavier Mertens | Analyze of a Linux botnet client source code |
| 2016-07-21/a> | Didier Stevens | Practice ntds.dit File |
| 2016-07-15/a> | Xavier Mertens | Name All the Things! |
| 2016-07-12/a> | Xavier Mertens | Hunting for Malicious Files with MISP + OSSEC |
| 2016-07-03/a> | Guy Bruneau | Is Data Privacy part of your Company's Culture? |
| 2016-06-29/a> | Xavier Mertens | Phishing Campaign with Blurred Images |
| 2016-06-12/a> | Guy Bruneau | DNS Sinkhole ISO Version 2.0 |
| 2016-06-03/a> | Tom Liston | MySQL is YourSQL |
| 2016-06-01/a> | Xavier Mertens | Docker Containers Logging |
| 2016-05-29/a> | Guy Bruneau | Analysis of a Distributed Denial of Service (DDoS) |
| 2016-05-22/a> | Pasquale Stirparo | The strange case of WinZip MRU Registry key |
| 2016-05-21/a> | Didier Stevens | Python Malware - Part 2 |
| 2016-05-18/a> | Russ McRee | Resources: Windows Auditing & Monitoring, Linux 2FA |
| 2016-05-14/a> | Guy Bruneau | INetSim as a Basic Honeypot |
| 2016-05-12/a> | Xavier Mertens | Another Day, Another Wave of Phishing Emails |
| 2016-05-08/a> | Jim Clausing | Guest Diary: Linux Capabilities - A friend and foe |
| 2016-05-05/a> | Xavier Mertens | Microsoft BITS Used to Download Payloads |
| 2016-05-02/a> | Rick Wanner | Lean Threat Intelligence |
| 2016-04-29/a> | Rob VandenBrink | Sysinternals Updated today - Updates to Sysmon, Procdump and Sigcheck. https://blogs.technet.microsoft.com/sysinternals/2016/04/28/update-sysmon-v4-procdump-v8-sigcheck-v2-51/ |
| 2016-04-15/a> | Xavier Mertens | Windows Command Line Persistence? |
| 2016-04-02/a> | Russell Eubanks | Why Can't We Be Friends? |
| 2016-03-30/a> | Xavier Mertens | What to watch with your FIM? |
| 2016-03-28/a> | Xavier Mertens | Improving Bash Forensics Capabilities |
| 2016-03-21/a> | Xavier Mertens | IP Addresses Triage |
| 2016-02-24/a> | Xavier Mertens | Analyzis of a Malicious .lnk File with an Embedded Payload |
| 2016-02-18/a> | Xavier Mertens | Hunting for Executable Code in Windows Environments |
| 2016-02-15/a> | Bojan Zdrnja | Exploiting (pretty) blind SQL injections |
| 2016-02-07/a> | Xavier Mertens | More Malicious JavaScript Obfuscation |
| 2016-02-02/a> | Johannes Ullrich | Targeted IPv6 Scans Using pool.ntp.org . |
| 2016-01-31/a> | Guy Bruneau | Windows 10 and System Protection for DATA Default is OFF |
| 2016-01-23/a> | Didier Stevens | Sigcheck and VirusTotal for Offline Machine |
| 2016-01-20/a> | Xavier Mertens | /tmp, %TEMP%, ~/Desktop, T:\, ... A goldmine for pentesters! |
| 2016-01-13/a> | Alex Stanford | You Have Got a New Audio Message - Guest Diary by Pasquale Stirparo |
| 2016-01-09/a> | Xavier Mertens | Virtual Bitlocker Containers |
| 2015-12-24/a> | Xavier Mertens | Unity Makes Strength |
| 2015-12-12/a> | Russell Eubanks | What Signs Are You Missing? |
| 2015-12-10/a> | Rob VandenBrink | Uninstalling Problem Applications using Powershell |
| 2015-12-10/a> | Rob VandenBrink | New Burp Feature - ClickBandit |
| 2015-12-09/a> | Xavier Mertens | Enforcing USB Storage Policy with PowerShell |
| 2015-12-04/a> | Tom Webb | Automating Phishing Analysis using BRO |
| 2015-11-21/a> | Didier Stevens | Maldoc Social Engineering Trick |
| 2015-11-09/a> | John Bambenek | ICYMI: Widespread Unserialize Vulnerability in Java |
| 2015-10-20/a> | Bojan Zdrnja | When encoding saves the day |
| 2015-10-12/a> | Guy Bruneau | Data Visualization,What is your Tool of Choice? |
| 2015-09-29/a> | Pedro Bueno | Tricks for DLL analysis |
| 2015-09-23/a> | Daniel Wesemann | Making our users unlearn what we taught them |
| 2015-09-21/a> | Xavier Mertens | Detecting XCodeGhost Activity |
| 2015-09-03/a> | Xavier Mertens | Querying the DShield API from RTIR |
| 2015-08-19/a> | Bojan Zdrnja | Outsourcing critical infrastructure (such as DNS) |
| 2015-08-18/a> | Russ McRee | Microsoft Security Bulletin MS15-093 - Critical OOB - Internet Explorer RCE |
| 2015-08-16/a> | Guy Bruneau | Are you a "Hunter"? |
| 2015-08-12/a> | Rob VandenBrink | Windows Service Accounts - Why They're Evil and Why Pentesters Love them! |
| 2015-08-06/a> | Didier Stevens | Sigcheck and virustotal-search |
| 2015-07-23/a> | Mark Hofman | Some more 0-days from ZDI |
| 2015-07-21/a> | Didier Stevens | Searching Through the VirusTotal Database |
| 2015-07-17/a> | Didier Stevens | Process Explorer and VirusTotal |
| 2015-07-17/a> | Didier Stevens | Autoruns and VirusTotal |
| 2015-07-17/a> | Didier Stevens | Sigcheck and VirusTotal |
| 2015-07-03/a> | Didier Stevens | Analyzing Quarantine Files |
| 2015-06-29/a> | Rob VandenBrink | The Powershell Diaries 2 - Software Inventory |
| 2015-06-27/a> | Guy Bruneau | Is Windows XP still around in your Network a year after Support Ended? |
| 2015-06-22/a> | Johannes Ullrich | SMTP Brute Forcing |
| 2015-06-01/a> | Tom Webb | Submit Dshield ASA Logs |
| 2015-05-30/a> | Russell Eubanks | Weekend Learning - Spoofer Project |
| 2015-05-27/a> | Tom Webb | SYSINTERNALS Update(AccessChk v6.0, Autoruns v13.4, Process Monitor v3.2, VMMap v3.2) |
| 2015-05-14/a> | Daniel Wesemann | Oh Bloat! |
| 2015-04-27/a> | Richard Porter | When Prevention Fails, Incident Response Begins |
| 2015-04-17/a> | Didier Stevens | Memory Forensics Of Network Devices |
| 2015-04-10/a> | Didier Stevens | The Kill Chain: Now With Pastebin |
| 2015-04-03/a> | Didier Stevens | SSH Fingerprints Are Important |
| 2015-03-26/a> | Daniel Wesemann | Pin-up on your Smartphone! |
| 2015-03-07/a> | Guy Bruneau | Should it be Mandatory to have an Independent Security Audit after a Breach? |
| 2015-02-19/a> | Daniel Wesemann | DNS-based DDoS |
| 2015-02-06/a> | Johannes Ullrich | Anthem, TurboTax and How Things "Fit Together" Sometimes |
| 2015-02-04/a> | Alex Stanford | Exploit Kit Evolution - Neutrino |
| 2015-01-31/a> | Guy Bruneau | Beware of Phishing and Spam Super Bowl Fans! |
| 2015-01-29/a> | Bojan Zdrnja | Blindly confirming XXE |
| 2015-01-23/a> | Adrien de Beaupre | Infocon change to yellow for Adobe Flash issues |
| 2014-12-24/a> | Rick Wanner | Incident Response at Sony |
| 2014-12-23/a> | John Bambenek | How I learned to stop worrying and love malware DGAs.... |
| 2014-11-27/a> | Russ McRee | Syrian Electronic Army attack leads to malvertising |
| 2014-11-25/a> | Adrien de Beaupre | Less is, umm, less? |
| 2014-09-27/a> | Guy Bruneau | What has Bash and Heartbleed Taught Us? |
| 2014-09-26/a> | Richard Porter | Why We Have Moved to InfoCon:Yellow |
| 2014-09-22/a> | Johannes Ullrich | Fake LogMeIn Certificate Update with Bad AV Detection Rate |
| 2014-09-19/a> | Guy Bruneau | Web Scan looking for /info/whitelist.pac |
| 2014-09-16/a> | Daniel Wesemann | https://yourfakebank.support -- TLD confusion starts! |
| 2014-09-12/a> | Chris Mohan | Are credential dumps worth reviewing? |
| 2014-09-07/a> | Johannes Ullrich | Odd Persistent Password Bruteforcing |
| 2014-08-27/a> | Rob VandenBrink | One More Day of Trolling in POS Memory |
| 2014-08-20/a> | Kevin Shortt | Social Engineering Alive and Well |
| 2014-08-16/a> | Lenny Zeltser | Web Server Attack Investigation - Installing a Bot and Reverse Shell via a PHP Vulnerability |
| 2014-08-15/a> | Tom Webb | AppLocker Event Logs with OSSEC 2.8 |
| 2014-08-12/a> | Adrien de Beaupre | Sysinternals updates Sysmon v1.0; Updates: Autoruns v12.01, Coreinfo v3.3, Procexp v16.03 http://blogs.technet.com/b/sysinternals/ |
| 2014-08-10/a> | Basil Alawi S.Taher | Incident Response with Triage-ir |
| 2014-08-09/a> | Adrien de Beaupre | Complete application ownage via Multi-POST XSRF |
| 2014-08-04/a> | Russ McRee | Threats & Indicators: A Security Intelligence Lifecycle |
| 2014-07-30/a> | Rick Wanner | Symantec Endpoint Protection Privilege Escalation Zero Day |
| 2014-07-26/a> | Chris Mohan | "Internet scanning project" scans |
| 2014-07-23/a> | Johannes Ullrich | New Feature: "Live" SSH Brute Force Logs and New Kippo Client |
| 2014-07-15/a> | Daniel Wesemann | Oracle July 2014 CPU (patch bundle) |
| 2014-07-14/a> | Daniel Wesemann | E-ZPass phishing scam |
| 2014-07-14/a> | Johannes Ullrich | The Internet of Things: How do you "on-board" devices? |
| 2014-07-09/a> | Daniel Wesemann | Who owns your typo? |
| 2014-07-07/a> | Johannes Ullrich | Multi Platform *Coin Miner Attacking Routers on Port 32764 |
| 2014-07-06/a> | Richard Porter | Physical Access, Point of Sale, Vegas |
| 2014-07-05/a> | Guy Bruneau | Java Support ends for Windows XP |
| 2014-07-02/a> | Johannes Ullrich | July Ouch! Security Awareness Newsletter Released. E-mail Do's and Don'ts http://www.securingthehuman.org/resources/newsletters/ouch/2014#july2014 |
| 2014-06-23/a> | Russ McRee | Microsoft Interflow announced today at 26th FIRST conference |
| 2014-06-12/a> | Guy Bruneau | BIND Security Update for CVE-2014-3859 |
| 2014-06-12/a> | Daniel Wesemann | Made any new friends lately? |
| 2014-05-23/a> | Richard Porter | Highlights from Cisco Live 2014 - The Internet of Everything |
| 2014-05-22/a> | Johannes Ullrich | Discontinuing Support for ISC Alert Task Bar Icon |
| 2014-05-01/a> | Johannes Ullrich | Busybox Honeypot Fingerprinting and a new DVR scanner |
| 2014-04-26/a> | Guy Bruneau | Android Users - Beware of Bitcoin Mining Malware |
| 2014-04-26/a> | Guy Bruneau | New Project by Linux Foundation - Core Infrastructure Initiative |
| 2014-04-14/a> | Kevin Shortt | INFOCon Green: Heartbleed - on the mend |
| 2014-04-11/a> | Guy Bruneau | Heartbleed Fix Available for Download for Cisco Products |
| 2014-04-06/a> | Basil Alawi S.Taher | "Power Worm" PowerShell based Malware |
| 2014-04-05/a> | Jim Clausing | Those strange e-mails with URLs in them can lead to Android malware |
| 2014-04-04/a> | Rob VandenBrink | Dealing with Disaster - A Short Malware Incident Response |
| 2014-04-04/a> | Rob VandenBrink | Windows 8.1 Released |
| 2014-04-01/a> | Johannes Ullrich | cmd.so Synology Scanner Also Found on Routers |
| 2014-03-27/a> | Alex Stanford | Apple Credential Phishing via appleidconfirm.net |
| 2014-03-25/a> | Johannes Ullrich | A few updates on "The Moon" worm |
| 2014-03-24/a> | Johannes Ullrich | New Microsoft Advisory: Unpatched Word Flaw used in Targeted Attacks |
| 2014-03-22/a> | Guy Bruneau | How the Compromise of a User Account Lead to a Spam Incident |
| 2014-03-12/a> | Johannes Ullrich | Wordpress "Pingback" DDoS Attacks |
| 2014-03-10/a> | Basil Alawi S.Taher | Sysinternals Process Explorer v16.02, Process Monitor v3.1, PSExec v2.1 and Sigcheck v2.03 update |
| 2014-03-07/a> | Tom Webb | Linux Memory Dump with Rekall |
| 2014-03-04/a> | Daniel Wesemann | XPired! |
| 2014-03-02/a> | Stephen Hall | Sunday Reading |
| 2014-02-28/a> | Daniel Wesemann | Oversharing |
| 2014-02-19/a> | Russ McRee | Threat modeling in the name of security |
| 2014-02-18/a> | Johannes Ullrich | More Details About "TheMoon" Linksys Worm |
| 2014-02-15/a> | Rob VandenBrink | More on HNAP - What is it, How to Use it, How to Find it |
| 2014-02-13/a> | Johannes Ullrich | Linksys Worm ("TheMoon") Captured |
| 2014-02-12/a> | Johannes Ullrich | Suspected Mass Exploit Against Linksys E1000 / E1200 Routers |
| 2014-02-10/a> | Rob VandenBrink | Isn't it About Time to Get Moving on Chip and PIN? |
| 2014-02-07/a> | Rob VandenBrink | Hello Virustotal? It's Microsoft Calling. |
| 2014-02-04/a> | Johannes Ullrich | Odd ICMP Echo Request Payload |
| 2014-01-30/a> | Johannes Ullrich | New gTLDs appearing in the root zone |
| 2014-01-24/a> | Johannes Ullrich | How to send mass e-mail the right way |
| 2014-01-24/a> | Chris Mohan | Phishing via Social Media |
| 2014-01-23/a> | Chris Mohan | Learning from the breaches that happens to others Part 2 |
| 2014-01-22/a> | Chris Mohan | Learning from the breaches that happens to others |
| 2014-01-11/a> | Guy Bruneau | tcpflow 1.4.4 and some of its most Interesting Features |
| 2014-01-10/a> | Basil Alawi S.Taher | Windows Autorun-3 |
| 2014-01-10/a> | Basil Alawi S.Taher | Cisco Small Business Devices backdoor fix |
| 2014-01-04/a> | Tom Webb | Monitoring Windows Networks Using Syslog (Part One) |
| 2014-01-02/a> | John Bambenek | OpenSSL.org Defaced by Attackers Gaining Access to Hypervisor |
| 2014-01-02/a> | Johannes Ullrich | Scans Increase for New Linksys Backdoor (32764/TCP) |
| 2013-12-24/a> | Daniel Wesemann | Unfriendly crontab additions |
| 2013-12-21/a> | Daniel Wesemann | Adobe phishing underway |
| 2013-12-21/a> | Guy Bruneau | Strange DNS Queries - Request for Packets |
| 2013-12-19/a> | Rob VandenBrink | Passive Scanning Two Ways - How-Tos for the Holidays |
| 2013-12-19/a> | Rob VandenBrink | Target US - Credit Card Data Breach |
| 2013-12-16/a> | Tom Webb | The case of Minerd |
| 2013-12-11/a> | Johannes Ullrich | Facebook Phishing and Malware via Tumblr Redirects |
| 2013-12-09/a> | Rob VandenBrink | Scanning without Scanning |
| 2013-12-07/a> | Guy Bruneau | Suspected Active Rovnix Botnet Controller |
| 2013-12-02/a> | Richard Porter | Reports of higher than normal SSH Attacks |
| 2013-12-01/a> | Richard Porter | BPF, PCAP, Binary, hex, why they matter? |
| 2013-11-30/a> | Russ McRee | A review of Tubes, A Journey to the Center of the Internet |
| 2013-11-27/a> | Rob VandenBrink | ATM Traffic + TCPDump + Video = Good or Evil? |
| 2013-11-19/a> | Johannes Ullrich | vBulletin.com Compromise - Possible 0-day |
| 2013-11-18/a> | Johannes Ullrich | Am I Sending Traffic to a "Sinkhole"? |
| 2013-11-15/a> | Johannes Ullrich | The Security Impact of HTTP Caching Headers |
| 2013-11-11/a> | Johannes Ullrich | What Happened to the SANS Ads? |
| 2013-11-04/a> | Manuel Humberto Santander Pelaez | When attackers use your DNS to check for the sites you are visiting |
| 2013-11-01/a> | Russ McRee | Secunia's PSI Country Report - Q3 2013 |
| 2013-10-30/a> | Russ McRee | SIR v15: Five good reasons to leave Windows XP behind |
| 2013-10-25/a> | Johannes Ullrich | PHP.net compromise aftermath: Why Code Signing Beats Hashes |
| 2013-10-25/a> | Rob VandenBrink | Kaspersky flags TCPIP.SYS as Malware |
| 2013-10-22/a> | Richard Porter | Greenbone and OpenVAS Scanner |
| 2013-10-21/a> | Johannes Ullrich | New tricks that may bring DNS spoofing back or: "Why you should enable DNSSEC even if it is a pain to do" |
| 2013-10-19/a> | Johannes Ullrich | Yet Another WHMCS SQL Injection Exploit |
| 2013-10-17/a> | Adrien de Beaupre | Internet wide DNS scanning |
| 2013-10-04/a> | Pedro Bueno | CSAM: WebHosting BruteForce logs |
| 2013-10-01/a> | John Bambenek | *Metaspoit Releases Module to Exploit Unpatched IE Vuln CVE-2013-3893 |
| 2013-09-20/a> | Russ McRee | Threat Level Yellow: Protection recommendations regarding Internet Explorer exploits in the wild |
| 2013-09-17/a> | John Bambenek | Microsoft Releases Out-of-Band Advisory for all Versions of Internet Explorer |
| 2013-09-09/a> | Johannes Ullrich | SSL is broken. So what? |
| 2013-09-05/a> | Rob VandenBrink | Building Your Own GPU Enabled Private Cloud |
| 2013-09-02/a> | Guy Bruneau | Snort IDS Sensor with Sguil New ISO Released |
| 2013-08-26/a> | Alex Stanford | Stop, Drop and File Carve |
| 2013-08-22/a> | Russ McRee | Read of the Week: A Fuzzy Future in Malware Research |
| 2013-08-19/a> | Johannes Ullrich | Running Snort on ESXi using the Distributed Switch |
| 2013-08-19/a> | Rob VandenBrink | ZMAP 1.02 released |
| 2013-08-14/a> | Johannes Ullrich | Imaging LUKS Encrypted Drives |
| 2013-08-13/a> | Swa Frantzen | Microsoft security advisories: RDP and MD5 deprecation in Microsoft root certificates |
| 2013-08-09/a> | Kevin Shortt | Copy Machines - Changing Scanned Content |
| 2013-08-05/a> | Chris Mohan | DMARC: another step forward in the fight against phishing? |
| 2013-07-31/a> | Johannes Ullrich | POP3 Server Brute Forcing Attempts Using Polycom Credentials |
| 2013-07-26/a> | Scott Fendley | ISC BIND DoS |
| 2013-07-20/a> | Manuel Humberto Santander Pelaez | Do you have rogue Internet gateways in your network? Check it with nmap |
| 2013-07-19/a> | Stephen Hall | Cyber Intelligence Tsunami |
| 2013-07-18/a> | Chris Mohan | Blog Spam - annoying junk or a source of intelligence? |
| 2013-07-16/a> | Johannes Ullrich | Why don't we see more examples of web app attacks via POST? |
| 2013-07-13/a> | Lenny Zeltser | Decoy Personas for Safeguarding Online Identity Using Deception |
| 2013-07-08/a> | Richard Porter | Why do we Click? |
| 2013-07-06/a> | Guy Bruneau | Is Metadata the Magic in Modern Network Security? |
| 2013-07-01/a> | Manuel Humberto Santander Pelaez | Using nmap scripts to enhance vulnerability asessment results |
| 2013-06-29/a> | Johannes Ullrich | Instagram "Fruit" Spam |
| 2013-06-21/a> | Guy Bruneau | Sysinternals Updates for Autoruns, Strings & ZoomIt http://blogs.technet.com/b/sysinternals/archive/2013/06/20/updates-autoruns-v11-61-strings-v2-52-zoomit-v4-5.aspx |
| 2013-06-20/a> | Johannes Ullrich | Linkedin DNS Hijack |
| 2013-06-19/a> | Kevin Liston | WinLink Check-In |
| 2013-06-05/a> | Richard Porter | Windows Sysinternals Updated http://technet.microsoft.com/en-us/sysinternals/default.aspx |
| 2013-06-05/a> | Richard Porter | BIND 9 Update fixing CVE-2013-3919 |
| 2013-05-23/a> | Adrien de Beaupre | MoVP II |
| 2013-05-21/a> | Adrien de Beaupre | Moore, Oklahoma tornado charitable organization scams, malware, and phishing |
| 2013-05-20/a> | Guy Bruneau | Sysinternals Updates for Accesschk, Procdump, RAMMap and Strings http://blogs.technet.com/b/sysinternals/archive/2013/05/17/updates-accesschk-v5-11-procdump-v6-0-rammap-v1-22-strings-v2-51.aspx |
| 2013-05-14/a> | Swa Frantzen | CVE-2013-2094: Linux privilege escalation |
| 2013-05-09/a> | Johannes Ullrich | Microsoft released a Fix-it for the Internet Explorer 8 Vulnerability http://support.microsoft.com/kb/2847140 |
| 2013-05-08/a> | Chris Mohan | Syria drops from Internet 7th May 2013 |
| 2013-05-07/a> | Jim Clausing | Is there an epidemic of typo squatting? |
| 2013-05-07/a> | Jim Clausing | NGINX updates address buffer overflow (CVE-2013-2028) see http://nginx.org/en/CHANGES-1.4 |
| 2013-05-04/a> | Kevin Shortt | The Zero-Day Pendulum Swings |
| 2013-05-01/a> | Daniel Wesemann | The cost of cleaning up |
| 2013-04-23/a> | Russ McRee | Microsoft's Security Intelligence Report (SIRv14) released |
| 2013-04-16/a> | John Bambenek | Fake Boston Marathon Scams Update |
| 2013-04-15/a> | Rob VandenBrink | Oops - You Mean That Deleted Server was a Certificate Authority? |
| 2013-04-15/a> | John Bambenek | Please send any spam (full headers), URLs or other suspicious content scamming off Boston Marathon explosions to handlers@sans.org |
| 2013-03-29/a> | Chris Mohan | Fake Link removal requests |
| 2013-03-27/a> | Adam Swanger | IPv6 Focus Month: Guest Diary: Stephen Groat - IPv6 moving target defense |
| 2013-03-19/a> | Johannes Ullrich | Windows 7 SP1 and Windows Server 2008 R2 SP1 Being "pushed" today |
| 2013-03-19/a> | Johannes Ullrich | IPv6 Focus Month: The warm and fuzzy side of IPv6 |
| 2013-03-07/a> | Guy Bruneau | Apple Blocking Java Web plug-in |
| 2013-03-06/a> | Adam Swanger | IPv6 Focus Month: Guest Diary: Stephen Groat - Geolocation Using IPv6 Addresses |
| 2013-03-05/a> | Mark Hofman | IPv6 Focus Month: Device Defaults |
| 2013-03-02/a> | Scott Fendley | Evernote Security Issue |
| 2013-03-02/a> | Scott Fendley | Apple Blocks Older Insecure Versions of Flash Player |
| 2013-02-28/a> | Daniel Wesemann | Parsing Windows Eventlogs in Powershell |
| 2013-02-22/a> | Johannes Ullrich | Zendesk breach affects Tumblr/Pinterest/Twitter |
| 2013-02-19/a> | Johannes Ullrich | APT1, Unit 61398 and are state sponsored attacks real |
| 2013-02-17/a> | Guy Bruneau | HP ArcSight Connector Appliance and Logger Vulnerabilities |
| 2013-02-11/a> | John Bambenek | Is This Chinese Registrar Really Trying to XSS Me? |
| 2013-02-06/a> | Adam Swanger | Sysinternals in particular Process Explorer update https://blogs.technet.com/b/sysinternals/?Redirected=true |
| 2013-02-06/a> | Johannes Ullrich | Are you losing system logging information (and don't know it)? |
| 2013-02-06/a> | Johannes Ullrich | Intel Network Card (82574L) Packet of Death |
| 2013-02-04/a> | Russ McRee | An expose of a recent SANS GIAC XSS vulnerability |
| 2013-02-04/a> | Adam Swanger | SAN Securing The Human Monthly Awareness Video - Advanced Persistent Threat (APT) http://www.securingthehuman.org/resources/ncsam |
| 2013-01-30/a> | Richard Porter | Getting Involved with the Local Community |
| 2013-01-25/a> | Johannes Ullrich | Vulnerability Scans via Search Engines (Request for Logs) |
| 2013-01-15/a> | Rob VandenBrink | When Disabling IE6 (or Java, or whatever) is not an Option... |
| 2013-01-13/a> | Stephen Hall | Sysinternals Updates |
| 2013-01-10/a> | Rob VandenBrink | What Else runs Telnets? Or, Pentesters Love Video Conferencing Units Too! |
| 2013-01-09/a> | Rob VandenBrink | SQL Injection Flaw in Ruby on Rails |
| 2013-01-05/a> | Guy Bruneau | D-link Wireless-G Router Year Issue (Y2K-plus-13) |
| 2013-01-02/a> | Russ McRee | EMET 3.5: The Value of Looking Through an Attacker's Eyes |
| 2013-01-01/a> | Johannes Ullrich | FixIt Available for Internet Explorer Vulnerability |
| 2012-12-20/a> | Daniel Wesemann | White House strategy on security information sharing and safeguarding |
| 2012-12-13/a> | Johannes Ullrich | What if Tomorrow Was the Day? |
| 2012-12-06/a> | Daniel Wesemann | Fake tech support calls - revisited |
| 2012-12-06/a> | Daniel Wesemann | Rich Quick Make Money! |
| 2012-12-03/a> | John Bambenek | John McAfee Exposes His Location in Photo About His Being on Run |
| 2012-12-02/a> | Guy Bruneau | Collecting Logs from Security Devices at Home |
| 2012-11-30/a> | Daniel Wesemann | Nmap 6.25 released - lots of new goodies, see http://nmap.org/changelog.html |
| 2012-11-29/a> | Kevin Shortt | New Apple Security Update: APPLE-SA-2012-11-29-1 Apple TV 5.1.1 |
| 2012-11-28/a> | Mark Hofman | McAfee releases extraDAT for W32/Autorun.worm.aaeb-h |
| 2012-11-28/a> | Mark Hofman | New version of wireshark is available (1.8.4), some security fixes included. |
| 2012-11-27/a> | Chris Mohan | Can users' phish emails be a security admin's catch of the day? |
| 2012-11-26/a> | John Bambenek | Online Shopping for the Holidays? Tips, News and a Fair Warning |
| 2012-11-20/a> | John Bambenek | Behind the Random NTP Bizarreness of Incorrect Year Being Set |
| 2012-11-20/a> | John Bambenek | Firefox v 17.0 just released, more here: http://www.mozilla.org/en-US/firefox/17.0/releasenotes/ |
| 2012-11-19/a> | John Bambenek | MoneyGram fined $100 million for aiding wire fraud - http://krebsonsecurity.com/2012/11/moneygram-fined-100-million-for-wire-fraud/ |
| 2012-11-19/a> | John Bambenek | New Poll: Top 5 Unresolved Security Problems of 2012 |
| 2012-11-17/a> | Manuel Humberto Santander Pelaez | New Sysinternal Updates: AdExplorer v1.44, Contig v1.7, Coreinfo v3.2, Procdump v5.1. See http://blogs.technet.com/b/sysinternals/archive/2012/11/16/updates-adexplorer-v1-44-contig-v1-7-coreinfo-v3-2-procdump-v5-1.aspx?Redirected=true |
| 2012-11-16/a> | Manuel Humberto Santander Pelaez | Information Security Incidents are now a concern for colombian government |
| 2012-11-13/a> | Jim Clausing | Microsoft November 2012 Black Tuesday Update - Overview |
| 2012-11-12/a> | John Bambenek | Request for info: Robocall Phishing Against Local/Regional Banks |
| 2012-11-09/a> | Mark Baggett | Remote Diagnostics with PSR |
| 2012-11-09/a> | Mark Baggett | Fresh batch of Microsoft patches next week |
| 2012-11-08/a> | Daniel Wesemann | Get a 40% discount on your hotel room! |
| 2012-11-07/a> | Mark Baggett | Help eliminate unquoted path vulnerabilities |
| 2012-11-07/a> | Mark Baggett | Multiple 0-Days Reported! |
| 2012-11-07/a> | Mark Baggett | Cisco TACACS+ Authentication Bypass |
| 2012-11-05/a> | Johannes Ullrich | Reminder: Ongoing SMTP Brute Forcing Attacks |
| 2012-11-05/a> | Johannes Ullrich | Possible Fake-AV Ads from Doubleclick Servers |
| 2012-11-04/a> | Lorna Hutcheson | What's important on your network? |
| 2012-10-31/a> | Johannes Ullrich | Cyber Security Awareness Month - Day 31 - Business Continuity and Disaster Recovery |
| 2012-10-30/a> | Johannes Ullrich | Hurricane Sandy Update |
| 2012-10-30/a> | Richard Porter | Splunk 5.0 SP-CAAAHB4 http://www.splunk.com/view/SP-CAAAHB4 |
| 2012-10-30/a> | Mark Hofman | Cyber Security Awareness Month - Day 30 - DSD 35 mitigating controls |
| 2012-10-28/a> | Tony Carothers | Firefox 16.02 Released |
| 2012-10-26/a> | Adam Swanger | Securing the Human Special Webcast - October 30, 2012 |
| 2012-10-26/a> | Russ McRee | Cyber Security Awareness Month - Day 26 - Attackers use trusted domain to propagate Citadel Zeus variant |
| 2012-10-25/a> | Richard Porter | Cyber Security Awareness Month - Day 25 - Pro Audio & Video Packets on the Wire |
| 2012-10-24/a> | Rob VandenBrink | Time to run Windows Update - - Microsoft Updates KB2755801 for Windows RT / IE10 / Flash Player - http://technet.microsoft.com/en-us/security/advisory/2755801 |
| 2012-10-24/a> | Russ McRee | Ongoing Windstream outage in the midwest - https://twitter.com/search?q=windstream |
| 2012-10-23/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 23: Character Encoding Standards - ASCII and Successors |
| 2012-10-21/a> | Johannes Ullrich | Cyber Security Awareness Month - Day 22: Connectors |
| 2012-10-21/a> | Lorna Hutcheson | Potential Phish for Regular Webmail Accounts |
| 2012-10-19/a> | Johannes Ullrich | Cyber Security Awareness Month - Day 19: Standard log formats and CEE. |
| 2012-10-18/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 18 - Vendor Standards: The vSphere Hardening Guide |
| 2012-10-17/a> | Mark Hofman | Oracle Critical Patch Update October |
| 2012-10-17/a> | Mark Hofman | New Acrobat release (including reader) available. Version 11. Some security improvements more here -->http://blogs.adobe.com/adobereader/ |
| 2012-10-16/a> | Richard Porter | CyberAwareness Month - Day 15, Standards Body Soup (pt2), Same Soup Different Cook. |
| 2012-10-16/a> | Johannes Ullrich | Cyber Security Awareness Month - Day 16: W3C and HTML |
| 2012-10-14/a> | Pedro Bueno | Cyber Security Awareness Month - Day 14 - Poor Man's File Analysis System - Part 1 |
| 2012-10-11/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 11 - Vendor Agnostic Standards (Center for Internet Security) |
| 2012-10-09/a> | Johannes Ullrich | Microsoft October 2012 Black Tuesday Update - Overview |
| 2012-10-07/a> | Tony Carothers | Cyber Security Awareness Month - Day 7 - Rollup Review of CSAM Week 1 |
| 2012-10-05/a> | Johannes Ullrich | Cyber Security Awareness Month - Day 5: Standards Body Soup, So many Flavors in the bowl. |
| 2012-10-05/a> | Richard Porter | VMWare Security Advisory: VMSA-2012-0014 - http://www.vmware.com/security/advisories/VMSA-2012-0014.html |
| 2012-10-05/a> | Richard Porter | Reports of a Distributed Injection Scan |
| 2012-10-04/a> | Mark Hofman | And the SHA-3 title goes to .....Keccak |
| 2012-10-04/a> | Johannes Ullrich | Cyber Security Awareness Month - Day 4: Crypto Standards |
| 2012-10-03/a> | Kevin Shortt | Fake Support Calls Reported |
| 2012-10-02/a> | Russ McRee | Cyber Security Awareness Month - Day 2 - PCI Security Standard: Mobile Payment Acceptance Security Guidelines |
| 2012-10-01/a> | Johannes Ullrich | Cyber Security Awareness Month |
| 2012-09-28/a> | Joel Esler | Adobe certification revocation for October 4th |
| 2012-09-26/a> | Johannes Ullrich | Some Android phones can be reset to factory default by clicking on links |
| 2012-09-26/a> | Johannes Ullrich | More Java Woes |
| 2012-09-21/a> | Johannes Ullrich | iOS 6 Security Roundup |
| 2012-09-20/a> | Russ McRee | Flash Player update but no announcement, check your version http://www.adobe.com/software/flash/about/ |
| 2012-09-20/a> | Russ McRee | Apple and Cisco Security Advisories 19 SEP 2012 |
| 2012-09-20/a> | Russ McRee | Financial sector advisory: attacks and threats against financial institutions |
| 2012-09-19/a> | Russ McRee | Script kiddie scavenging with Shellbot.S |
| 2012-09-17/a> | Rob VandenBrink | What's on your iPad? |
| 2012-09-14/a> | Lenny Zeltser | Analyzing Malicious RTF Files Using OfficeMalScanner's RTFScan |
| 2012-09-14/a> | Lenny Zeltser | Scam Report - Fake Voice Mail Email Notification Redirects to Malicious Site |
| 2012-09-13/a> | Mark Baggett | TCP Fuzzing with Scapy |
| 2012-09-13/a> | Mark Baggett | Microsoft disrupts traffic associated with the Nitol botnet |
| 2012-09-13/a> | Mark Baggett | More SSL trouble |
| 2012-09-11/a> | Adam Swanger | Microsoft September 2012 Black Tuesday Update - Overview |
| 2012-09-10/a> | Johannes Ullrich | Microsoft Patch Tuesday Pre-Release |
| 2012-09-10/a> | Johannes Ullrich | Godaddy DDoS Attack |
| 2012-09-10/a> | donald smith | Blue Toad publishing co compromise lead to UDID release. http://redtape.nbcnews.com/_news/2012/09/10/13781440-exclusive-the-real-source-of-apple-device-ids-leaked-by-anonymous-last-week?lite |
| 2012-09-09/a> | Guy Bruneau | Phishing/Spam Pretending to be from BBB |
| 2012-09-08/a> | Guy Bruneau | Webmin Input Validation Vulnerabilities |
| 2012-09-06/a> | Johannes Ullrich | SSL Requests sent to port 80 (request for help/input) |
| 2012-09-04/a> | Johannes Ullrich | Another round of "Spot the Exploit E-Mail" |
| 2012-09-02/a> | Lorna Hutcheson | Demonstrating the value of your Intrusion Detection Program and Analysts |
| 2012-09-01/a> | Russ McRee | Blackhole targeting Java vulnerability via fake Microsoft Services Agreement email phish |
| 2012-08-31/a> | Russ McRee | Not so fast: Java 7 Update 7 critical vulnerability discovered in less than 24 hours |
| 2012-08-30/a> | Bojan Zdrnja | Analyzing outgoing network traffic (part 2) |
| 2012-08-30/a> | Johannes Ullrich | Editorial: The Slumlord Approach to Network Security http://isc.sans.edu/j/editorial |
| 2012-08-29/a> | Johannes Ullrich | "Data" URLs used for in-URL phishing |
| 2012-08-27/a> | Johannes Ullrich | The Good, Bad and Ugly about Assigning IPv6 Addresses |
| 2012-08-27/a> | Johannes Ullrich | Malware Spam harvesting Facebook Information |
| 2012-08-26/a> | Lorna Hutcheson | Who ya gonna contact? |
| 2012-08-23/a> | Bojan Zdrnja | Analyzing outgoing network traffic |
| 2012-08-22/a> | Adrien de Beaupre | Apple Remote Desktop update fixes no encryption issue |
| 2012-08-22/a> | Adrien de Beaupre | Phishing/spam via SMS |
| 2012-08-21/a> | Adrien de Beaupre | YYABCAFU - Yes Yet Another Bleeping Critical Adobe Flash Update |
| 2012-08-21/a> | Adrien de Beaupre | RuggedCom fails key management 101 on Rugged Operating System (ROS) |
| 2012-08-20/a> | Manuel Humberto Santander Pelaez | Do we need test procedures in our companies before implementing Antivirus signatures? |
| 2012-08-19/a> | Manuel Humberto Santander Pelaez | Authentication Issues between entities during protocol message exchange in SCADA Systems |
| 2012-08-17/a> | Guy Bruneau | Suspicious eFax Spear Phishing Messages |
| 2012-08-14/a> | Rick Wanner | Microsoft August 2012 Black Tuesday Update - Overview |
| 2012-08-12/a> | Tony Carothers | Layers of the Defense-in-Depth Onion |
| 2012-08-12/a> | Tony Carothers | Oracle Security Alert for CVE-2012-3132 |
| 2012-08-09/a> | Mark Hofman | Zeus/Citadel variant causing issues in the Netherlands |
| 2012-08-09/a> | Mark Hofman | SQL Injection Lilupophilupop style, Part 2 |
| 2012-08-07/a> | Adrien de Beaupre | Who protects small business? |
| 2012-08-05/a> | Daniel Wesemann | Phishing for Payroll with unpatched Java |
| 2012-08-04/a> | Kevin Liston | Vendors: More Patch-Release Options Please |
| 2012-07-31/a> | Daniel Wesemann | SQL injection, lilupophilupop-style |
| 2012-07-30/a> | Guy Bruneau | BIND 9 Security Updates |
| 2012-07-27/a> | Daniel Wesemann | Cuckoo 0.4 is out - cool new features for malware analysis http://www.cuckoosandbox.org/ |
| 2012-07-25/a> | Johannes Ullrich | Apple OS X 10.8 (Mountain Lion) released |
| 2012-07-25/a> | Johannes Ullrich | Microsoft Exchange/Sharepoint and others: Oracle Outside In Vulnerability |
| 2012-07-24/a> | Richard Porter | Wireshark 1.8.1 Released http://www.wireshark.org/ |
| 2012-07-24/a> | Richard Porter | Report of spike in DNS Queries gd21.net |
| 2012-07-21/a> | Rick Wanner | TippingPoint DNS Version Request increase |
| 2012-07-20/a> | Mark Baggett | Syria Internet connection cut? |
| 2012-07-19/a> | Mark Baggett | Diagnosing Malware with Resource Monitor |
| 2012-07-19/a> | Mark Baggett | A Heap of Overflows? |
| 2012-07-16/a> | Richard Porter | Sysinternals Update @ http://blogs.technet.com/b/sysinternals/archive/2012/07/16/updates-handle-v3-5-process-explorer-v15-22-process-monitor-v3-03-rammap-v1-21-zoomit-v4-3.aspx |
| 2012-07-16/a> | Jim Clausing | An analysis of the Yahoo! passwords |
| 2012-07-13/a> | Russ McRee | 2 for 1: SANSFIRE & MSRA presentations |
| 2012-07-13/a> | Russ McRee | Yahoo service SQL injection vuln leads to account exposure |
| 2012-07-13/a> | Richard Porter | Yesterday (not as on the ball as Rob) at SANSFire |
| 2012-07-12/a> | Rick Wanner | Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Multipoint Switch - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-ctms |
| 2012-07-12/a> | Rick Wanner | Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Recording Server - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-ctrs |
| 2012-07-12/a> | Rick Wanner | Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Immersive Endpoint Devices - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-cts |
| 2012-07-12/a> | Rick Wanner | Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Manager - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-ctsman |
| 2012-07-10/a> | Rob VandenBrink | Today at SANSFIRE (09 July 2012) - ISC Panel Discussion on the State of the Internet |
| 2012-07-09/a> | Johannes Ullrich | The FBI will turn off the Internet on Monday (or not) |
| 2012-07-09/a> | Manuel Humberto Santander Pelaez | Internet Storm Center panel tonight at SANSFIRE 2012! |
| 2012-07-05/a> | Adrien de Beaupre | New OS X trojan backdoor MaControl variant reported |
| 2012-07-05/a> | Adrien de Beaupre | Microsoft advanced notification for July 2012 patch Tuesday |
| 2012-07-02/a> | Joel Esler | A rough guide to keeping your website up |
| 2012-07-02/a> | Dan Goldberg | Storms of June 29th 2012 in Mid Atlantic region of the USA |
| 2012-07-02/a> | Joel Esler | Linux & Java leap second bug |
| 2012-06-29/a> | Jim Clausing | Updated SysInternals tools - Autoruns, Process Explorer, Process Monitor, PSKill -- http://blogs.technet.com/b/sysinternals/archive/2012/06/28/updates-autoruns-v11-32-process-explorer-v15-21-process-monitor-v3-02-pskill-v1-15-rammap-v1-2.aspx |
| 2012-06-28/a> | Chris Mohan | Massive spike in BGP traffic - Possible BGP poisoning? |
| 2012-06-27/a> | Daniel Wesemann | What's up with port 79 ? |
| 2012-06-25/a> | Rick Wanner | Targeted Malware for Industrial Espionage? |
| 2012-06-25/a> | Guy Bruneau | Issues with Windows Update Agent |
| 2012-06-22/a> | Kevin Liston | Investigator's Tool-kit: Timeline |
| 2012-06-21/a> | Raul Siles | Print Bomb? (Take 2) |
| 2012-06-21/a> | Russ McRee | Analysis of drive-by attack sample set |
| 2012-06-21/a> | Russ McRee | Wireshark 1.8.0 released 21 JUN 2012 http://www.wireshark.org/download.html |
| 2012-06-19/a> | Daniel Wesemann | Vulnerabilityqueerprocessbrittleness |
| 2012-06-14/a> | Johannes Ullrich | Spot the Phish: Verizon Wireless |
| 2012-06-10/a> | Scott Fendley | Preying on Users After Major Security Incidents |
| 2012-06-06/a> | Jim Clausing | BIND 9 Update - DoS or information disclosure vulnerability |
| 2012-06-06/a> | Jim Clausing | Potential leak of 6.5+ million LinkedIn password hashes |
| 2012-06-04/a> | Lenny Zeltser | Decoding Common XOR Obfuscation in Malicious Code |
| 2012-06-04/a> | Rob VandenBrink | vSphere 5.0 Hardening Guide Officially Released |
| 2012-05-30/a> | Rob VandenBrink | It's Phishing Season! In fact, it's ALWAYS Phishing Season! |
| 2012-05-23/a> | Mark Baggett | Problems with MS12-035 affecting XP, SBS and Windows 2003? |
| 2012-05-14/a> | Chris Mohan | Laptops at Security Conferences |
| 2012-05-08/a> | Bojan Zdrnja | Windows Firewall Bypass Vulnerability and NetBIOS NS |
| 2012-05-06/a> | Jim Clausing | Tool updates and Win 8 |
| 2012-04-30/a> | Rob VandenBrink | FCC posts Enquiry Documents on Google Wardriving |
| 2012-04-23/a> | Russ McRee | Emergency Operations Centers & Security Incident Management: A Correlation |
| 2012-04-18/a> | Kevin Shortt | Sysinternals Updates - 2012 Apr 17 |
| 2012-04-10/a> | Swa Frantzen | Windows Vista RIP |
| 2012-04-06/a> | Johannes Ullrich | Social Share Privacy |
| 2012-03-16/a> | Swa Frantzen | INFOCON Yellow - Microsoft RDP - MS12-020 |
| 2012-03-13/a> | Lenny Zeltser | Please transfer this email to your CEO or appropriate person, thanks |
| 2012-02-20/a> | Johannes Ullrich | The Ultimate OS X Hardening Guide Collection |
| 2012-02-20/a> | Pedro Bueno | Simple Malware Research Tools |
| 2012-01-31/a> | Russ McRee | OSINT tactics: parsing from FOCA for Maltego |
| 2012-01-24/a> | Bojan Zdrnja | Is it time to get rid of NetBIOS? |
| 2012-01-21/a> | Guy Bruneau | DNS Sinkhole Scripts Fixes/Update |
| 2012-01-19/a> | Chris Mohan | WHOIS contacts are your friends |
| 2012-01-13/a> | Guy Bruneau | Sysinternals Updates - http://blogs.technet.com/b/sysinternals/archive/2012/01/13/updates-autoruns-v11-21-coreinfo-v3-03-portmon-v-3-03-process-explorer-v15-12-mark-s-blog-and-mark-at-rsa-2012.aspx |
| 2012-01-12/a> | Rob VandenBrink | Stuff I Learned Scripting - Fun with STDERR |
| 2011-12-25/a> | Deborah Hale | Merry Christmas, Happy Holidays |
| 2011-12-23/a> | Daniel Wesemann | Printer Pranks |
| 2011-12-21/a> | Johannes Ullrich | New Vulnerability in Windows 7 64 bit |
| 2011-12-12/a> | Daniel Wesemann | You won 100$ or a free iPad! |
| 2011-12-08/a> | Adrien de Beaupre | Microsoft Security Bulletin Advance Notification for December 2011 |
| 2011-12-06/a> | Kevin Shortt | Cain & Abel v4.9.43 Released - http://www.oxid.it/ |
| 2011-12-05/a> | Stephen Hall | ISC describe DNS crash bug analysis |
| 2011-12-01/a> | Mark Hofman | SQL Injection Attack happening ATM |
| 2011-11-29/a> | John Bambenek | Hacking HP Printers for Fun and Profit |
| 2011-11-28/a> | Tom Liston | A Puzzlement... |
| 2011-11-24/a> | Russ McRee | Quick Tip: Pastebin Monitoring & Recon |
| 2011-11-23/a> | Johannes Ullrich | SCADA hacks published on Pastebin |
| 2011-11-16/a> | Jason Lam | Potential 0-day on Bind 9 |
| 2011-11-11/a> | Rick Wanner | Yay! More Sysinternals updates! http://technet.microsoft.com/en-us/sysinternals |
| 2011-11-10/a> | Rob VandenBrink | Stuff I Learned Scripting - - Parsing XML in a One-Liner |
| 2011-10-29/a> | Richard Porter | The Sub Critical Control? Evidence Collection |
| 2011-10-28/a> | Russ McRee | Critical Control 19: Data Recovery Capability |
| 2011-10-27/a> | Mark Baggett | Critical Control 18: Incident Response Capabilities |
| 2011-10-26/a> | Rick Wanner | Critical Control 17:Penetration Tests and Red Team Exercises |
| 2011-10-25/a> | Chris Mohan | Recurring reporting made easy? |
| 2011-10-21/a> | Johannes Ullrich | New Flash Click Jacking Exploit |
| 2011-10-17/a> | Rob VandenBrink | Critical Control 11: Account Monitoring and Control |
| 2011-10-15/a> | Guy Bruneau | DNS Sinkhole Parser Script Update |
| 2011-10-10/a> | Tom Liston | What's In A Name? |
| 2011-10-02/a> | Mark Hofman | Cyber Security Awareness Month Day 1/2 - Schedule |
| 2011-10-02/a> | Mark Hofman | Cyber Security Awareness Month Day 1/2 - Introduction to the controls |
| 2011-09-29/a> | Daniel Wesemann | The SSD dilemma |
| 2011-09-20/a> | Swa Frantzen | Diginotar declared bankrupt |
| 2011-09-19/a> | Guy Bruneau | MS Security Advisory Update - Fraudulent DigiNotar Certificates |
| 2011-09-15/a> | Swa Frantzen | DigiNotar looses their accreditation for qualified certificates |
| 2011-09-13/a> | Swa Frantzen | More DigiNotar intermediate certificates blocklisted at Microsoft |
| 2011-09-13/a> | Swa Frantzen | GlobalSign back in operation |
| 2011-09-09/a> | Guy Bruneau | IPv6 and DNS Sinkhole |
| 2011-09-07/a> | Lenny Zeltser | GlobalSign Temporarily Stops Issuing Certificates to Investigate a Potential Breach |
| 2011-09-06/a> | Swa Frantzen | DigiNotar audit - intermediate report available |
| 2011-09-06/a> | Johannes Ullrich | Microsoft Releases Diginotar Related Patch and Advisory |
| 2011-09-05/a> | Bojan Zdrnja | Bitcoin – crypto currency of future or heaven for criminals? |
| 2011-09-01/a> | Swa Frantzen | DigiNotar breach - the story so far |
| 2011-08-31/a> | Johannes Ullrich | Firefox/Thunderbird 6.0.1 released to blocklist bad DigiNotar SSL certificates |
| 2011-08-31/a> | Johannes Ullrich | Phishing e-mail to custom e-mail addresses |
| 2011-08-31/a> | Johannes Ullrich | Kernel.org Compromise |
| 2011-08-26/a> | Daniel Wesemann | User Agent 007 |
| 2011-08-25/a> | Kevin Shortt | Increased Traffic on Port 3389 |
| 2011-08-24/a> | Rob VandenBrink | Citrix Access Gateway Cross Site Scripting vulnerability and fix ==> http://support.citrix.com/article/CTX129971 |
| 2011-08-17/a> | Rob VandenBrink | Putting all of Your Eggs in One Basket - or How NOT to do Layoffs |
| 2011-08-17/a> | Rob VandenBrink | Sysinternal updates for ProcDump v4.0, Process Monitor v2.96, Process Explorer v15.02 ==> http://blogs.technet.com/b/sysinternals/ |
| 2011-08-16/a> | Scott Fendley | Phishing Scam Victim Response |
| 2011-08-15/a> | Rob VandenBrink | 8 Years since the Eastern Seaboard Blackout - Has it Been that Long? |
| 2011-08-08/a> | Rob VandenBrink | Ping is Bad (Sometimes) |
| 2011-08-05/a> | Johannes Ullrich | Microsoft Patch Tuesday Advance Notification: 13 Bulletins coming http://www.microsoft.com/technet/security/Bulletin/MS11-aug.mspx |
| 2011-07-31/a> | Daniel Wesemann | Anatomy of a Unix breach |
| 2011-07-25/a> | Chris Mohan | Monday morning incident handler practice |
| 2011-07-17/a> | Mark Hofman | SSH Brute Force |
| 2011-07-09/a> | Chris Mohan | Safer Windows Incident Response |
| 2011-07-07/a> | Rob VandenBrink | "There's a Patch for that" (or maybe not) |
| 2011-07-06/a> | Rob VandenBrink | "Too Important to Patch" - Wait? What? |
| 2011-07-05/a> | Raul Siles | Two DoS remotely exploitable vulnerabilities affect BIND 9: http://www.isc.org/advisories/bind Updgrade to 9.8.0-P4. |
| 2011-07-03/a> | Deborah Hale | Business Continuation in the Face of Disaster |
| 2011-06-30/a> | Rob VandenBrink | Update for RSA Authentication Manager |
| 2011-06-28/a> | Johannes Ullrich | DNSSEC Tips |
| 2011-06-22/a> | Guy Bruneau | How Good is your Employee Termination Policy? |
| 2011-06-17/a> | Richard Porter | When do you stop owning Technology? |
| 2011-06-12/a> | Mark Hofman | Cloud thoughts |
| 2011-06-09/a> | Richard Porter | One Browser to Rule them All? |
| 2011-06-08/a> | Johannes Ullrich | Spam from compromised Hotmail accounts |
| 2011-06-06/a> | Manuel Humberto Santander Pelaez | Phishing: Same goal, same techniques and people still falling for such scams |
| 2011-06-06/a> | Johannes Ullrich | The Havij SQL Injection Tool |
| 2011-06-03/a> | Guy Bruneau | SonyPictures Site Compromised |
| 2011-06-01/a> | Johannes Ullrich | Enabling Privacy Enhanced Addresses for IPv6 |
| 2011-05-30/a> | Johannes Ullrich | Lockheed Martin and RSA Tokens |
| 2011-05-25/a> | Lenny Zeltser | Monitoring Social Media for Security References to Your Organization |
| 2011-05-20/a> | Guy Bruneau | Sysinternals Updates, Analyzing Stuxnet Infection with Sysinternals Tools Part 3 |
| 2011-05-10/a> | Swa Frantzen | Changing MO in scamming our users ? |
| 2011-05-09/a> | Johannes Ullrich | Patch for BIND 9.8.0 DoS Vulnerability |
| 2011-05-06/a> | Richard Porter | Updated Exploit Index for Microsoft |
| 2011-05-04/a> | Richard Porter | Microsoft Sysinterals Update |
| 2011-05-03/a> | Johannes Ullrich | Update on Osama Bin Laden themed Malware |
| 2011-05-02/a> | Johannes Ullrich | Bin Laden Death Related Malware |
| 2011-05-01/a> | Deborah Hale | Droid MarketPlace Has a New App |
| 2011-04-26/a> | John Bambenek | Is the Insider Threat Really Over? |
| 2011-04-25/a> | Rob VandenBrink | Sony PlayStation Network Outage - Day 5 |
| 2011-04-19/a> | Bojan Zdrnja | SQL injection: why can’t we learn? |
| 2011-04-14/a> | Adrien de Beaupre | Sysinternals updates, a new blog post, and webcast |
| 2011-04-11/a> | Johannes Ullrich | GMail User Using 2FA Warned of Access From China |
| 2011-04-07/a> | Chris Mohan | Being a good internet neighbour |
| 2011-04-01/a> | John Bambenek | LizaMoon Mass SQL-Injection Attack Infected at least 500k Websites |
| 2011-03-27/a> | Guy Bruneau | Strange Shockwave File with Surprising Attachments |
| 2011-03-25/a> | Kevin Liston | APT Tabletop Exercise |
| 2011-03-22/a> | Chris Mohan | Read only USB stick trick |
| 2011-03-15/a> | Lenny Zeltser | Limiting Exploit Capabilities by Using Windows Integrity Levels |
| 2011-03-07/a> | Bojan Zdrnja | Oracle padding attacks (Codegate crypto 400 writeup) |
| 2011-02-28/a> | Deborah Hale | Possible Botnet Scanning |
| 2011-02-25/a> | Johannes Ullrich | Thunderbolt Security Speculations |
| 2011-02-24/a> | Johannes Ullrich | Windows 7 / 2008 R2 Service Pack 1 Problems |
| 2011-02-23/a> | Manuel Humberto Santander Pelaez | Bind DOS vulnerability (CVE-2011-0414) |
| 2011-02-23/a> | Johannes Ullrich | Windows 7 Service Pack 1 out |
| 2011-02-21/a> | Adrien de Beaupre | Winamp forums compromised |
| 2011-02-16/a> | Jason Lam | Windows 0-day SMB mrxsmb.dll vulnerability |
| 2011-02-10/a> | Chris Mohan | Befriending Windows Security Log Events |
| 2011-02-09/a> | Mark Hofman | Adobe Patches (shockwave, Flash, Reader & Coldfusion) |
| 2011-02-08/a> | Johannes Ullrich | Tippingpoint Releases Details on Unpatched Bugs |
| 2011-02-07/a> | Richard Porter | Crime is still Crime! Pt 2 |
| 2011-02-05/a> | Guy Bruneau | OpenSSH Legacy Certificate Information Disclosure Vulnerability |
| 2011-02-02/a> | Johannes Ullrich | Having Phish on Friday |
| 2011-01-30/a> | Richard Porter | The Modern Dark Ages? |
| 2011-01-27/a> | Robert Danford | Microsoft Security Advisory for MHTML via Internet Explorer (MS2501696/CVE-2011-0096) |
| 2011-01-25/a> | Chris Mohan | Reviewing our preconceptions |
| 2011-01-24/a> | Rob VandenBrink | Where have all the COM Ports Gone? - How enumerating COM ports led to me finding a “misplaced” Microsoft tool |
| 2011-01-23/a> | Richard Porter | Crime is still Crime! |
| 2011-01-12/a> | Richard Porter | How Many Loyalty Cards do you Carry? |
| 2011-01-12/a> | Richard Porter | Yet Another Data Broker? AOL Lifestream. |
| 2011-01-10/a> | Manuel Humberto Santander Pelaez | VirusTotal VTzilla firefox/chrome plugin |
| 2011-01-05/a> | Johannes Ullrich | Currently Unpatched Windows / Internet Explorer Vulnerabilities |
| 2011-01-04/a> | Johannes Ullrich | Microsoft Advisory: Vulnerability in Graphics Rendering Engine |
| 2010-12-29/a> | Daniel Wesemann | Beware of strange web sites bearing gifts ... |
| 2010-12-26/a> | Manuel Humberto Santander Pelaez | ISC infocon monitor app for OS X |
| 2010-12-23/a> | Mark Hofman | Skoudis' Annual Xmas Hacking Challenge - The Nightmare Before Charlie Brown's Christmas |
| 2010-12-21/a> | Rob VandenBrink | Network Reliability, Part 2 - HSRP Attacks and Defenses |
| 2010-12-19/a> | Raul Siles | Intel's new processors have a remote kill switch (Anti-Theft 3.0) |
| 2010-12-10/a> | Mark Hofman | Microsoft patches |
| 2010-12-05/a> | Jim Clausing | Updates to a couple of Sysinternals tools |
| 2010-12-02/a> | Kevin Johnson | Robert Hansen and our happiness |
| 2010-12-02/a> | Kevin Johnson | SQL Injection: Wordpress 3.0.2 released |
| 2010-11-29/a> | Stephen Hall | iPhone phishing - What you see, isn't what you get |
| 2010-11-26/a> | Mark Hofman | Using password cracking as metric/indicator for the organisation's security posture |
| 2010-11-24/a> | Bojan Zdrnja | Privilege escalation 0-day in almost all Windows versions |
| 2010-11-22/a> | Lenny Zeltser | Brand Impersonations On-Line: Brandjacking and Social Networks |
| 2010-11-19/a> | Jason Lam | Exchanging and sharing of assessment results |
| 2010-11-18/a> | Chris Carboni | Stopping the ZeroAccess Rootkit |
| 2010-11-17/a> | Guy Bruneau | Cisco Unified Videoconferencing Affected by Multiple Vulnerabilities |
| 2010-11-15/a> | Stephen Hall | Minibis hits beta with Version 2.1 |
| 2010-11-01/a> | Manuel Humberto Santander Pelaez | Checkpoint UTM-1 edge VPN boxes worldwide did an unscheduled reboot |
| 2010-10-26/a> | Pedro Bueno | Be (even more) careful with public hotspots. Firesheep released yesterday. Brilliant and scary. |
| 2010-10-22/a> | Manuel Humberto Santander Pelaez | Intypedia project |
| 2010-10-18/a> | Manuel Humberto Santander Pelaez | Cyber Security Awareness Month - Day 18 - What you should tell your boss when there's a crisis |
| 2010-10-11/a> | Adrien de Beaupre | OT: Happy Thanksgiving Day Canada |
| 2010-10-04/a> | Mark Hofman | Online Voting |
| 2010-09-25/a> | Rick Wanner | Guest Diary: Andrew Hunt - Visualizing the Hosting Patterns of Modern Cybercriminals |
| 2010-09-17/a> | Robert Danford | Circa 2007 Linux Kernel Vulnerability Resurfaces (Was CVE-2007-4573, Now CVE-2010-3301) |
| 2010-09-16/a> | Johannes Ullrich | Facebook "Like Pages" |
| 2010-09-04/a> | Kevin Liston | Investigating Malicious Website Reports |
| 2010-08-27/a> | Mark Hofman | FTP Brute Password guessing attacks |
| 2010-08-23/a> | Bojan Zdrnja | DLL hijacking vulnerabilities |
| 2010-08-23/a> | Manuel Humberto Santander Pelaez | Firefox plugins to perform penetration testing activities |
| 2010-08-16/a> | Raul Siles | Blind Elephant: A New Web Application Fingerprinting Tool |
| 2010-08-15/a> | Manuel Humberto Santander Pelaez | Obfuscated SQL Injection attacks |
| 2010-08-13/a> | Guy Bruneau | Shadowserver Binary Whitelisting Service |
| 2010-08-10/a> | Daniel Wesemann | SSH - new brute force tool? |
| 2010-08-07/a> | Stephen Hall | Countdown to Tuesday... |
| 2010-08-05/a> | Rob VandenBrink | Access Controls for Network Infrastructure |
| 2010-08-04/a> | Tom Liston | Incident Reporting - Liston's "How-To" Guide |
| 2010-08-03/a> | Johannes Ullrich | When Lightning Strikes |
| 2010-08-02/a> | Manuel Humberto Santander Pelaez | Securing Windows Internet Kiosk |
| 2010-07-29/a> | Rob VandenBrink | NoScript 2.0 released |
| 2010-07-26/a> | Guy Bruneau | SophosLabs Released Free Tool to Validate Microsoft Shortcut |
| 2010-07-24/a> | Manuel Humberto Santander Pelaez | Transmiting logon information unsecured in the network |
| 2010-07-23/a> | Mark Hofman | vBulletin vB 3.8.6 vulnerability |
| 2010-07-23/a> | Mark Hofman | Some of our favourite sysinternals tools have been updated. TCPview, Autoruns, ProcDump and Disk2vhd have changed. More here http://blogs.technet.com/b/sysinternals/archive/2010/07/22/updates-tcpview-v3-0-autoruns-v10-02-procdump-v1-81-disk2vhd-v1-61.aspx |
| 2010-07-20/a> | Manuel Humberto Santander Pelaez | Lowering infocon back to green |
| 2010-07-07/a> | Kevin Shortt | Facebook, Facebook, What Do YOU See? |
| 2010-07-04/a> | Manuel Humberto Santander Pelaez | New Winpcap Version |
| 2010-06-27/a> | Manuel Humberto Santander Pelaez | Study of clickjacking vulerabilities on popular sites |
| 2010-06-19/a> | Guy Bruneau | DNS Sinkhole ISO Available for Download |
| 2010-06-18/a> | Tom Liston | IMPORTANT INFORMATION: Distributed SSH Brute Force Attacks |
| 2010-06-17/a> | Deborah Hale | Digital Copy Machines - Security Risk? |
| 2010-06-17/a> | Deborah Hale | Internet Fraud Alert Kicks Off Today |
| 2010-06-15/a> | Manuel Humberto Santander Pelaez | Microsoft Windows Help and Support Center vulnerability (CVE 2010-1885) exploit in the wild |
| 2010-06-15/a> | Manuel Humberto Santander Pelaez | iPhone 4 Order Security Breach Exposes Private Information |
| 2010-06-14/a> | Manuel Humberto Santander Pelaez | New way of social engineering on IRC |
| 2010-06-10/a> | Deborah Hale | Top 5 Social Networking Media Risks |
| 2010-06-09/a> | Deborah Hale | Mass Infection of IIS/ASP Sites |
| 2010-06-07/a> | Manuel Humberto Santander Pelaez | Software Restriction Policy to keep malware away |
| 2010-06-06/a> | Manuel Humberto Santander Pelaez | Nice OS X exploit tutorial |
| 2010-06-04/a> | Johannes Ullrich | Changes to Internet Storm Center Host Name |
| 2010-06-02/a> | Bojan Zdrnja | Clickjacking attacks on Facebook's Like plugin |
| 2010-05-25/a> | donald smith | Face book “joke” leads to firing. |
| 2010-05-19/a> | Jason Lam | EFF paper about browser tracking |
| 2010-05-07/a> | Johannes Ullrich | Stock market "wipe out" may be due to computer error |
| 2010-05-04/a> | Rick Wanner | SIFT review in the ISSA Toolsmith |
| 2010-05-02/a> | Mari Nichols | Zbot Social Engineering |
| 2010-04-30/a> | Johannes Ullrich | Sharepoint XSS Vulnerability |
| 2010-04-30/a> | Kevin Liston | CVE-2010-0817 SharePoint XSS Scorecard |
| 2010-04-29/a> | Bojan Zdrnja | Who needs exploits when you have social engineering? |
| 2010-04-21/a> | Guy Bruneau | Google Chrome Security Update v4.1.249.1059 Released: http://googlechromereleases.blogspot.com/2010/04/stable-update-security-fixes.html |
| 2010-04-20/a> | Raul Siles | Are You Ready for a Transportation Collapse...? |
| 2010-04-19/a> | Daniel Wesemann | Linked into scams? |
| 2010-04-14/a> | Mark Hofman | And let the patching games continue |
| 2010-04-13/a> | Adrien de Beaupre | Web App Testing Tools |
| 2010-04-13/a> | Johannes Ullrich | More Legal Threat Malware E-Mail |
| 2010-04-02/a> | Guy Bruneau | Oracle Java SE and Java for Business Critical Patch Update Advisory |
| 2010-03-27/a> | Guy Bruneau | Create a Summary of IP Addresses from PCAP Files using Unix Tools |
| 2010-03-27/a> | Guy Bruneau | HP-UX Running NFS/ONCplus, Inadvertently Enabled NFS |
| 2010-03-21/a> | Chris Carboni | Responding To The Unexpected |
| 2010-03-18/a> | Bojan Zdrnja | Dangers of copy&paste |
| 2010-03-15/a> | Adrien de Beaupre | Spamassassin Milter Plugin Remote Root Attack |
| 2010-03-06/a> | Tony Carothers | Integration and the Security of New Technologies |
| 2010-02-22/a> | Rob VandenBrink | New Risks in Penetration Testing |
| 2010-02-17/a> | Rob VandenBrink | Multiple Security Updates for ESX 3.x and ESXi 3.x |
| 2010-02-15/a> | Johannes Ullrich | Various Olympics Related Dangerous Google Searches |
| 2010-02-12/a> | G. N. White | Time to update those IP Bogon Filters (again) |
| 2010-02-11/a> | Deborah Hale | The Mysterious Blue Screen |
| 2010-02-06/a> | Guy Bruneau | LANDesk Management Gateway Vulnerability |
| 2010-02-03/a> | Johannes Ullrich | Information Disclosure Vulnerability in Internet Explorer |
| 2010-02-02/a> | Johannes Ullrich | Twitter Mass Password Reset due to Phishing |
| 2010-02-01/a> | Rob VandenBrink | NMAP 5.21 - Is UDP Protocol Specific Scanning Important? Why Should I Care? |
| 2010-01-27/a> | Raul Siles | Command Line Kung Fu |
| 2010-01-26/a> | Rob VandenBrink | VMware vSphere Hardening Guide Draft posted for public review |
| 2010-01-22/a> | Mari Nichols | Pass-down for a Successful Incident Response |
| 2010-01-17/a> | Mark Hofman | Why not Yellow? |
| 2010-01-14/a> | Bojan Zdrnja | 0-day vulnerability in Internet Explorer 6, 7 and 8 |
| 2010-01-10/a> | Guy Bruneau | Easy DNS BIND Sinkhole Setup |
| 2010-01-09/a> | G. N. White | What's Up With All The Port Scanning Using TCP/6000 As A Source Port? |
| 2010-01-08/a> | Rob VandenBrink | Microsoft OfficeOnline, Searching for Trust and Malware |
| 2009-12-17/a> | Daniel Wesemann | overlay.xul is back |
| 2009-12-16/a> | Rob VandenBrink | Beware the Attack of the Christmas Greeting Cards ! |
| 2009-12-15/a> | Johannes Ullrich | Important BIND name server updates - DNSSEC |
| 2009-12-04/a> | Daniel Wesemann | The economics of security advice (MSFT research paper) |
| 2009-12-02/a> | Rob VandenBrink | SPAM and Malware taking advantage of H1N1 concerns |
| 2009-11-29/a> | Patrick Nolan | A Cloudy Weekend |
| 2009-11-25/a> | Jim Clausing | Tool updates |
| 2009-11-24/a> | Rick Wanner | Microsoft Security Advisory 977981 - IE 6 and IE 7 |
| 2009-11-24/a> | John Bambenek | BIND Security Advisory (DNSSEC only) |
| 2009-11-14/a> | Adrien de Beaupre | Microsoft advisory for Windows 7 / Windows Server 2008 R2 Remote SMB DoS Exploit released |
| 2009-11-13/a> | Adrien de Beaupre | Flash Origin Policy Attack |
| 2009-11-12/a> | Rob VandenBrink | Windows 7 / Windows Server 2008 Remote SMB Exploit |
| 2009-11-11/a> | Rob VandenBrink | Layer 2 Network Protections against Man in the Middle Attacks |
| 2009-11-09/a> | Chris Carboni | 80's Flashback on Jailbroken iPhones |
| 2009-11-05/a> | Swa Frantzen | Insider threat: The snapnames case |
| 2009-10-26/a> | Johannes Ullrich | Today: ISC Login bugfix day. If you have issues logging in using OpenID, please email a copy of your OpenID URL to jullrich\at\sans.edu |
| 2009-10-24/a> | Marcus Sachs | Windows 7 - How is it doing? |
| 2009-10-22/a> | Adrien de Beaupre | Sysinternals updates: Disk2vhd v1.1, ZoomIt v4.1, Coreinfo v2.0, VMMap v2.4 |
| 2009-10-19/a> | Daniel Wesemann | Scam Email |
| 2009-10-17/a> | Rick Wanner | Mozilla disables Microsoft plug-ins? |
| 2009-10-16/a> | Adrien de Beaupre | Disable MS09-054 patch, or Firefox Plugin? |
| 2009-10-13/a> | Daniel Wesemann | Adobe Reader and Acrobat - Black Tuesday continues |
| 2009-10-08/a> | Johannes Ullrich | Firefox Plugin Collections |
| 2009-10-04/a> | Guy Bruneau | Samba Security Information Disclosure and DoS |
| 2009-10-02/a> | Stephen Hall | New SysInternal fun for the weekend |
| 2009-09-27/a> | Stephen Hall | Use Emerging Threats signatures? READ THIS! |
| 2009-09-20/a> | Mari Nichols | Insider Threat and Security Awareness |
| 2009-09-19/a> | Rick Wanner | Sysinternals Tools Updates |
| 2009-09-08/a> | Guy Bruneau | Vista/2008/Windows 7 SMB2 BSOD 0Day |
| 2009-09-05/a> | Mark Hofman | Critical Infrastructure and dependencies |
| 2009-08-26/a> | Johannes Ullrich | WSUS 3.0 SP2 released |
| 2009-08-26/a> | Johannes Ullrich | Cisco over-the-air-provisioning skyjacking exploit |
| 2009-08-19/a> | Daniel Wesemann | Checking your protection |
| 2009-08-18/a> | Deborah Hale | Website compromises - what's happening? |
| 2009-08-18/a> | Deborah Hale | Sysinternals Procdump Updated |
| 2009-08-13/a> | Jim Clausing | New and updated cheat sheets |
| 2009-08-03/a> | Mark Hofman | Switch hardening on your network |
| 2009-08-01/a> | Deborah Hale | Website Warnings |
| 2009-07-31/a> | Deborah Hale | Don't forget to tell your SysAdmin Thanks |
| 2009-07-31/a> | Deborah Hale | Google Safe Browsing |
| 2009-07-29/a> | Bojan Zdrnja | BIND 9 DoS attacks in the wild |
| 2009-07-27/a> | Raul Siles | Filemon and Regmon are dead, long life to Procmon! |
| 2009-07-27/a> | Raul Siles | New Hacker Challenge: Prison Break - Breaking, Entering & Decoding |
| 2009-07-18/a> | Patrick Nolan | Chrome update contains Security fixes |
| 2009-07-17/a> | Bojan Zdrnja | A new fascinating Linux kernel vulnerability |
| 2009-07-16/a> | Guy Bruneau | Changes in Windows Security Center |
| 2009-07-16/a> | Bojan Zdrnja | OWC exploits used in SQL injection attacks |
| 2009-07-13/a> | Adrien de Beaupre | * Infocon raised to yellow for Excel Web Components ActiveX vulnerability |
| 2009-07-12/a> | Mari Nichols | CA Apologizes for False Positive |
| 2009-07-10/a> | Guy Bruneau | WordPress Fixes Multiple vulnerabilities |
| 2009-07-07/a> | Marcus Sachs | * INFOCON Status - staying green |
| 2009-07-03/a> | Adrien de Beaupre | Happy 4th of July! |
| 2009-07-02/a> | Daniel Wesemann | Time to update updating on PCs for 3rd party apps |
| 2009-07-02/a> | Daniel Wesemann | Unpatched Bloatware on new PCs |
| 2009-06-26/a> | Mark Hofman | PHPMYADMIN scans |
| 2009-06-24/a> | Kyle Haugsness | Exploit tools are publicly available for phpMyAdmin |
| 2009-06-24/a> | Kyle Haugsness | TCP scanning increase for 4899 |
| 2009-06-21/a> | Scott Fendley | phpMyAdmin Scans |
| 2009-06-20/a> | Scott Fendley | Situational Awareness: Spam Crisis and China |
| 2009-06-16/a> | John Bambenek | Iran Internet Blackout: Using Twitter for Operational Intelligence |
| 2009-06-16/a> | John Bambenek | URL Shortening Service Cligs Hacked |
| 2009-06-11/a> | Rick Wanner | MIR-ROR Motile Incident Response - Respond Objectively Remediate |
| 2009-06-10/a> | Rick Wanner | SysInternals Survey |
| 2009-06-01/a> | G. N. White | Yet another "Digital Certificate" malware campaign |
| 2009-05-24/a> | Raul Siles | Facebook phising using Belgium (.be) domains |
| 2009-05-22/a> | Mark Hofman | Patching and Adobe |
| 2009-05-22/a> | Mark Hofman | Patching and Apple - Java issue |
| 2009-05-20/a> | Pedro Bueno | Cyber Warfare and Kylin thoughts |
| 2009-05-19/a> | Bojan Zdrnja | Advanced blind SQL injection (with Oracle examples) |
| 2009-05-11/a> | Mari Nichols | Sysinternals Updates 3 Applications |
| 2009-05-09/a> | Patrick Nolan | Shared SQL Injection Lessons Learned blog item |
| 2009-05-06/a> | Tom Liston | Follow The Bouncing Malware: Gone With the WINS |
| 2009-05-04/a> | Tom Liston | Facebook phishing malware |
| 2009-05-02/a> | Rick Wanner | More Swine/Mexican/H1N1 related domains |
| 2009-05-01/a> | Adrien de Beaupre | Incident Management |
| 2009-04-30/a> | Marcus Sachs | ARIN Notification Concerning IPv6 |
| 2009-04-28/a> | Deborah Hale | Updated List of Domains - Swineflu related |
| 2009-04-27/a> | Johannes Ullrich | Swine Flu (Mexican Flu) related domains |
| 2009-04-26/a> | Johannes Ullrich | Pandemic Preparation - Swine Flu |
| 2009-04-24/a> | Pedro Bueno | Did you check your conference goodies? |
| 2009-04-21/a> | Bojan Zdrnja | Web application vulnerabilities |
| 2009-04-16/a> | Adrien de Beaupre | Incident Response vs. Incident Handling |
| 2009-04-16/a> | Adrien de Beaupre | Strange Windows Event Log entry |
| 2009-04-02/a> | Bojan Zdrnja | JavaScript insertion and log deletion attack tools |
| 2009-03-27/a> | Mark Hofman | There is some SMiShing going on in the EU |
| 2009-03-11/a> | Bojan Zdrnja | Massive ARP spoofing attacks on web sites |
| 2009-03-10/a> | Swa Frantzen | TinyURL and security |
| 2009-03-10/a> | Swa Frantzen | Browser plug-ins, transparent proxies and same origin policies |
| 2009-03-02/a> | Swa Frantzen | Obama's leaked chopper blueprints: anything we can learn? |
| 2009-02-25/a> | Swa Frantzen | Targeted link diversion attempts |
| 2009-02-22/a> | Mari Nichols | The Internet Safety Act of 2009 |
| 2009-02-20/a> | Mark Hofman | Phishing with a small twist |
| 2009-02-11/a> | Robert Danford | ProFTPd SQL Authentication Vulnerability exploit activity |
| 2009-02-06/a> | Adrien de Beaupre | Time to patch your HP printers |
| 2009-02-01/a> | Chris Carboni | Scanning for Trixbox vulnerabilities |
| 2009-01-31/a> | Swa Frantzen | DNS DDoS - let's use a long term solution |
| 2009-01-31/a> | Swa Frantzen | Windows 7 - not so secure ? |
| 2009-01-31/a> | John Bambenek | Google Search Engine's Malware Detection Broken |
| 2009-01-20/a> | Adrien de Beaupre | Obamamania |
| 2009-01-18/a> | Maarten Van Horenbeeck | Targeted social engineering |
| 2009-01-11/a> | Deborah Hale | The Frustration of Phishing Attacks |
| 2009-01-08/a> | Kyle Haugsness | BIND OpenSSL follow-up |
| 2009-01-07/a> | William Salusky | BIND 9.x security patch - resolves potentially new DNS poisoning vector |
| 2009-01-04/a> | Rick Wanner | Twitter/Facebook Phishing Attempt |
| 2009-01-02/a> | Rick Wanner | Tools on my Christmas list. |
| 2008-12-28/a> | Raul Siles | Level3 Outage? |
| 2008-12-17/a> | donald smith | Internet Explorer 960714 is released |
| 2008-12-12/a> | Johannes Ullrich | MSIE 0-day Spreading Via SQL Injection |
| 2008-12-12/a> | Swa Frantzen | Browser Security Handbook |
| 2008-12-10/a> | Bojan Zdrnja | 0-day exploit for Internet Explorer in the wild |
| 2008-12-02/a> | Deborah Hale | Sonicwall License Manager Failure |
| 2008-12-01/a> | Jason Lam | Input filtering and escaping in SQL injection mitigation |
| 2008-11-25/a> | Andre Ludwig | The beginnings of a collaborative approach to IDS |
| 2008-11-20/a> | Jason Lam | Large quantity SQL Injection mitigation |
| 2008-11-14/a> | Stephen Hall | More updated tools |
| 2008-11-12/a> | John Bambenek | Thoughts on Security Intelligence (McColo Corp alleged spam/malware host knocked offline) |
| 2008-11-11/a> | Swa Frantzen | Phishing for Google adwords |
| 2008-11-02/a> | Adrien de Beaupre | Daylight saving time |
| 2008-10-31/a> | Rick Wanner | Sprint-Cogent Peering Issue |
| 2008-10-30/a> | Kevin Liston | Making Intelligence Actionable: Part 2 |
| 2008-10-29/a> | Deborah Hale | Day 29 - Should I Switch Software Vendors? |
| 2008-10-29/a> | Deborah Hale | Enom Phishing - Caution Enom Registrars |
| 2008-10-20/a> | Johannes Ullrich | Fraudulent ATM Reactivation Phone Calls. |
| 2008-10-18/a> | Rick Wanner | Updates to SysInternals tools! |
| 2008-10-17/a> | Patrick Nolan | Day 17 - Containing a DNS Hijacking |
| 2008-10-17/a> | Rick Wanner | Day 18 - Containing Other Incidents |
| 2008-10-15/a> | Rick Wanner | Day 15 - Containing the Damage From a Lost or Stolen Laptop |
| 2008-10-12/a> | Mari Nichols | Day 12 Containment: Gathering Evidence That Can be Used in Court |
| 2008-10-10/a> | Marcus Sachs | Fake Microsoft Update Email |
| 2008-10-08/a> | Johannes Ullrich | Domaincontrol (GoDaddy) Nameservers DNS Poisoning |
| 2008-10-07/a> | Kyle Haugsness | Cogent peering problems |
| 2008-10-01/a> | Rick Wanner | Handler Mailbag |
| 2008-09-29/a> | Daniel Wesemann | ASPROX mutant |
| 2008-09-22/a> | Jim Clausing | Lessons learned from the Palin (and other) account hijacks |
| 2008-09-20/a> | Rick Wanner | New (to me) nmap Features |
| 2008-09-16/a> | donald smith | Don't open that invoice.zip file its not from UPS |
| 2008-09-11/a> | David Goldsmith | CookieMonster is coming to Pown (err, Town) |
| 2008-09-09/a> | Swa Frantzen | wordpress upgrade |
| 2008-09-01/a> | John Bambenek | The Number of Machines Controlled by Botnets Has Jumped 4x in Last 3 Months |
| 2008-08-23/a> | Mark Hofman | SQL injections - an update |
| 2008-08-15/a> | Jim Clausing | OMFW 2008 reflections |
| 2008-08-14/a> | Johannes Ullrich | DNSSEC for DShield.org |
| 2008-08-12/a> | Johannes Ullrich | Upcoming Infocon Test and new Color |
| 2008-08-08/a> | Mark Hofman | More SQL Injections - very active right now |
| 2008-08-02/a> | Maarten Van Horenbeeck | A little of that human touch |
| 2008-08-02/a> | Swa Frantzen | BIND: -P2 patches are released |
| 2008-07-31/a> | Swa Frantzen | Linus - Linux and Security - follow-up |
| 2008-07-29/a> | Swa Frantzen | Linus - Linux and Security |
| 2008-07-24/a> | Bojan Zdrnja | What's brewing in Danmec's pot? |
| 2008-07-24/a> | Kyle Haugsness | DNS cache poisoning vulnerability details confirmed |
| 2008-07-11/a> | Jim Clausing | And you thought the DNS issue was an old one... |
| 2008-07-08/a> | Johannes Ullrich | Mulitple Vendors DNS Spoofing Vulnerability |
| 2008-07-07/a> | Pedro Bueno | Bad url classification |
| 2008-07-02/a> | Jim Clausing | Another little script I threw together |
| 2008-06-30/a> | Marcus Sachs | More SQL Injection with Fast Flux hosting |
| 2008-06-25/a> | Deborah Hale | Report of Coreflood.dr Infection |
| 2008-06-24/a> | Jason Lam | SQL Injection mitigation in ASP |
| 2008-06-24/a> | Jason Lam | Microsoft SQL Injection Prevention Strategy |
| 2008-06-23/a> | donald smith | Preventing SQL injection |
| 2008-06-18/a> | Marcus Sachs | Olympics Part II |
| 2008-06-17/a> | Kyle Haugsness | Why go high-tech? |
| 2008-06-13/a> | Johannes Ullrich | SQL Injection: More of the same |
| 2008-06-12/a> | Bojan Zdrnja | Safari on Windows - not looking good |
| 2008-06-10/a> | Swa Frantzen | Linux ASN.1 BER kernel buffer overflow |
| 2008-06-02/a> | Jim Clausing | Emergingthreats.net and ThePlanet |
| 2008-06-01/a> | Mark Hofman | Free Yahoo email account! Sign me up, Ok well maybe not. |
| 2008-05-26/a> | Marcus Sachs | Predictable Response |
| 2008-05-20/a> | Raul Siles | List of malicious domains inserted through SQL injection |
| 2008-05-19/a> | Maarten Van Horenbeeck | Text message and telephone aid scams |
| 2008-05-17/a> | Lorna Hutcheson | XP SP3 Issues |
| 2008-05-13/a> | Swa Frantzen | OpenSSH: Predictable PRNG in debian and ubuntu Linux |
| 2008-05-06/a> | John Bambenek | Windows XP Service Pack 3 Released |
| 2008-05-01/a> | Adrien de Beaupre | Windows XP SteadyState |
| 2008-04-29/a> | Bojan Zdrnja | Windows Service Pack blocker tool |
| 2008-04-24/a> | donald smith | Hundreds of thousands of SQL injections |
| 2008-04-18/a> | John Bambenek | The Patch Window is Gone: Automated Patch-Based Exploit Generation |
| 2008-04-16/a> | Bojan Zdrnja | The 10.000 web sites infection mystery solved |
| 2008-04-16/a> | William Stearns | Windows XP Service Pack 3 - unofficial schedule: Apr 21-28 |
| 2008-04-16/a> | William Stearns | Passer, a aassive machine and service sniffer |
| 2008-04-14/a> | John Bambenek | A Federal Subpoena or Just Some More Spam & Malware? |
| 2008-04-11/a> | John Bambenek | ADSL Router / Cable Modem / Home Wireless AP Hardening in 5 Steps |
| 2008-04-07/a> | John Bambenek | HP USB Keys Shipped with Malware for your Proliant Server |
| 2008-03-27/a> | Pedro Bueno | Freedom of Speech...or not? |
| 2008-03-27/a> | Maarten Van Horenbeeck | Guarding the guardians: a story of PGP key ring theft |
| 2008-03-21/a> | donald smith | D-Link router based worm? |
| 2008-03-14/a> | Kevin Liston | 2117966.net-- mass iframe injection |
| 2008-03-13/a> | Jason Lam | Remote File Include spoof!? |
| 2008-03-12/a> | Joel Esler | Don't use G-Archiver |
| 2008-03-12/a> | Joel Esler | Adobe security updates |
| 2008-01-09/a> | Bojan Zdrnja | Mass exploits with SQL Injection |
| 2007-02-24/a> | Jason Lam | Prepared Statements and SQL injections |
| 2007-01-03/a> | Toby Kohlenberg | VLC Media Player udp URL handler Format String Vulnerability |
| 2006-12-12/a> | Swa Frantzen | Offline Microsoft Patching |
| 2006-10-05/a> | John Bambenek | There are no more Passive Exploits |
| 2006-10-02/a> | Jim Clausing | Back to green, but the exploits are still running wild |
| 2006-09-28/a> | Swa Frantzen | Powerpoint, yet another new vulnerability |
| 2006-09-06/a> | Johannes Ullrich | Updated Packet Attack flash animation |
THE |
| 2024-12-27/a> | Guy Bruneau | Phishing for Banking Information |
| 2024-06-20/a> | Guy Bruneau | No Excuses, Free Tools to Help Secure Authentication in Ubuntu Linux [Guest Diary] |
| 2024-03-17/a> | Guy Bruneau | Gamified Learning: Using Capture the Flag Challenges to Supplement Cybersecurity Training [Guest Diary] |
| 2023-02-16/a> | Jan Kopriva | HTML phishing attachment with browser-in-the-browser technique |
| 2022-02-05/a> | Didier Stevens | Power over Ethernet and Thermal Imaging |
| 2022-02-01/a> | Xavier Mertens | Automation is Nice But Don't Replace Your Knowledge |
| 2021-11-08/a> | Xavier Mertens | (Ab)Using Security Tools & Controls for the Bad |
| 2021-10-18/a> | Xavier Mertens | Malicious PowerShell Using Client Certificate Authentication |
| 2021-06-24/a> | Xavier Mertens | Do you Like Cookies? Some are for sale! |
| 2021-05-29/a> | Guy Bruneau | Spear-phishing Email Targeting Outlook Mail Clients |
| 2020-04-16/a> | Johannes Ullrich | Using AppLocker to Prevent Living off the Land Attacks |
| 2019-11-11/a> | Johannes Ullrich | Are We Going Back to TheMoon (and How is Liquor Involved)? |
| 2019-07-10/a> | Rob VandenBrink | Dumping File Contents in Hex (in PowerShell) |
| 2019-01-30/a> | Russ McRee | CR19-010: The United States vs. Huawei |
| 2018-11-20/a> | Xavier Mertens | Querying DShield from Cortex |
| 2018-11-11/a> | Pasquale Stirparo | Community contribution: joining forces or multiply solutions? |
| 2018-06-04/a> | Rob VandenBrink | Digging into Authenticode Certificates |
| 2017-12-05/a> | Tom Webb | IR using the Hive Project. |
| 2017-09-18/a> | Johannes Ullrich | SANS Securingthehuman posted a follow up to their Equifax breach webcast: https://securingthehuman.sans.org/blog/2017/09/15/equifax-webcast-follow-up |
| 2017-01-11/a> | Johannes Ullrich | January 2017 Edition of Ouch! Security Awareness Newsletter Released: https://securingthehuman.sans.org/ouch |
| 2016-11-02/a> | Rob VandenBrink | What Does a Pentest Look Like? |
| 2016-10-07/a> | Rick Wanner | First Hurricane Matthew related Phish |
| 2016-09-15/a> | Xavier Mertens | In Need of a OTP Manager Soon? |
| 2016-05-02/a> | Rick Wanner | Lean Threat Intelligence |
| 2015-12-15/a> | Russ McRee | Security Management vs Chaos: Understanding the Butterfly Effect to Manage Outcomes & Reduce Chaos |
| 2015-09-23/a> | Daniel Wesemann | Making our users unlearn what we taught them |
| 2015-08-16/a> | Guy Bruneau | Are you a "Hunter"? |
| 2015-02-06/a> | Johannes Ullrich | Anthem, TurboTax and How Things "Fit Together" Sometimes |
| 2014-07-02/a> | Johannes Ullrich | July Ouch! Security Awareness Newsletter Released. E-mail Do's and Don'ts http://www.securingthehuman.org/resources/newsletters/ouch/2014#july2014 |
| 2014-03-13/a> | Daniel Wesemann | Identification and authentication are hard ... finding out intention is even harder |
| 2014-02-18/a> | Johannes Ullrich | More Details About "TheMoon" Linksys Worm |
| 2014-02-05/a> | Johannes Ullrich | SANS Ouch Security Awareness Newsletter What is Malware http://www.securingthehuman.org/ouch |
| 2013-12-20/a> | Daniel Wesemann | authorized key lime pie |
| 2013-11-13/a> | Johannes Ullrich | Packet Challenge for the Hivemind: What's happening with this Ethernet header? |
| 2013-09-18/a> | Rob VandenBrink | Cisco DCNM Update Released |
| 2013-09-09/a> | Johannes Ullrich | SSL is broken. So what? |
| 2013-09-05/a> | Rob VandenBrink | Building Your Own GPU Enabled Private Cloud |
| 2013-08-09/a> | Kevin Shortt | Copy Machines - Changing Scanned Content |
| 2013-03-23/a> | Guy Bruneau | Apple ID Two-step Verification Now Available in some Countries |
| 2013-02-06/a> | Johannes Ullrich | Intel Network Card (82574L) Packet of Death |
| 2013-02-04/a> | Adam Swanger | SAN Securing The Human Monthly Awareness Video - Advanced Persistent Threat (APT) http://www.securingthehuman.org/resources/ncsam |
| 2012-10-26/a> | Adam Swanger | Securing the Human Special Webcast - October 30, 2012 |
| 2012-07-10/a> | Rob VandenBrink | Today at SANSFIRE (09 July 2012) - ISC Panel Discussion on the State of the Internet |
| 2012-07-02/a> | Dan Goldberg | Storms of June 29th 2012 in Mid Atlantic region of the USA |
| 2011-05-18/a> | Bojan Zdrnja | Android, HTTP and authentication tokens |
| 2011-04-28/a> | Chris Mohan | Gathering and use of location information fears - or is it all a bit too late |
| 2011-04-11/a> | Johannes Ullrich | Layer 2 DoS and other IPv6 Tricks |
| 2011-01-12/a> | Richard Porter | Has Big Brother gone Global? |
| 2010-12-21/a> | Rob VandenBrink | Network Reliability, Part 2 - HSRP Attacks and Defenses |
| 2010-09-21/a> | Johannes Ullrich | Implementing two Factor Authentication on the Cheap |
| 2010-07-24/a> | Manuel Humberto Santander Pelaez | Transmiting logon information unsecured in the network |
| 2010-07-21/a> | Adrien de Beaupre | Dell PowerEdge R410 replacement motherboard firmware contains malware |
| 2010-03-10/a> | Rob VandenBrink | Microsoft re-release of KB973811 - attacks on Extended Protection for Authentication |
| 2010-02-09/a> | Adrien de Beaupre | When is a 0day not a 0day? Samba symlink bad default config |
| 2009-11-11/a> | Rob VandenBrink | Layer 2 Network Protections against Man in the Middle Attacks |
| 2008-10-15/a> | Rick Wanner | Day 15 - Containing the Damage From a Lost or Stolen Laptop |
| 2006-10-05/a> | John Bambenek | There are no more Passive Exploits |
| 2006-09-29/a> | Kevin Liston | A Report from the Field |
MIDDLE |
| 2013-09-09/a> | Johannes Ullrich | SSL is broken. So what? |
| 2010-12-21/a> | Rob VandenBrink | Network Reliability, Part 2 - HSRP Attacks and Defenses |
| 2010-07-24/a> | Manuel Humberto Santander Pelaez | Transmiting logon information unsecured in the network |
| 2009-11-11/a> | Rob VandenBrink | Layer 2 Network Protections against Man in the Middle Attacks |
| 2006-10-05/a> | John Bambenek | There are no more Passive Exploits |
MITM |
| 2014-02-24/a> | Russ McRee | Explicit Trusted Proxy in HTTP/2.0 or...not so much |
| 2013-11-21/a> | Mark Baggett | Are large scale Man in The Middle attacks underway? |
| 2013-09-09/a> | Johannes Ullrich | SSL is broken. So what? |
| 2013-01-03/a> | Manuel Humberto Santander Pelaez | New year and new CA compromised |
| 2011-09-28/a> | Richard Porter | All Along the ARP Tower! |
| 2011-04-05/a> | Johannes Ullrich | IPv6 MITM via fake router advertisements |
| 2010-12-21/a> | Rob VandenBrink | Network Reliability, Part 2 - HSRP Attacks and Defenses |
| 2009-11-11/a> | Rob VandenBrink | Layer 2 Network Protections against Man in the Middle Attacks |
| 2009-11-05/a> | Swa Frantzen | TLS Man-in-the-middle on renegotiation vulnerability made public |
| 2009-08-28/a> | Adrien de Beaupre | WPA with TKIP done |
ATTACK |
| 2024-01-08/a> | Jesse La Grew | What is that User Agent? |
| 2022-08-10/a> | Johannes Ullrich | And Here They Come Again: DNS Reflection Attacks |
| 2022-03-26/a> | Guy Bruneau | Is buying Cyber Insurance a Must Now? |
| 2022-02-03/a> | Johannes Ullrich | Keeping Track of Your Attack Surface for Cheap |
| 2021-02-01/a> | Rob VandenBrink | Taking a Shot at Reverse Shell Attacks, CNC Phone Home and Data Exfil from Servers |
| 2019-08-25/a> | Guy Bruneau | Are there any Advantages of Buying Cyber Security Insurance? |
| 2019-07-20/a> | Guy Bruneau | Re-evaluating Network Security - It is Increasingly More Complex |
| 2017-09-06/a> | Adrien de Beaupre | Modern Web Application Penetration Testing , Hash Length Extension Attacks |
| 2016-11-02/a> | Rob VandenBrink | What Does a Pentest Look Like? |
| 2016-06-03/a> | Tom Liston | MySQL is YourSQL |
| 2015-03-18/a> | Daniel Wesemann | Pass the hash! |
| 2015-02-19/a> | Daniel Wesemann | DNS-based DDoS |
| 2014-02-26/a> | Russ McRee | Ongoing NTP Amplification Attacks |
| 2014-02-17/a> | Chris Mohan | NTP reflection attacks continue |
| 2013-12-02/a> | Richard Porter | Reports of higher than normal SSH Attacks |
| 2013-08-19/a> | Guy Bruneau | Business Risks and Cyber Attacks |
| 2013-07-27/a> | Scott Fendley | Defending Against Web Server Denial of Service Attacks |
| 2013-07-13/a> | Lenny Zeltser | Decoy Personas for Safeguarding Online Identity Using Deception |
| 2012-10-05/a> | Richard Porter | Reports of a Distributed Injection Scan |
| 2011-12-28/a> | Daniel Wesemann | Hash collisions vulnerability in web servers |
| 2011-12-01/a> | Mark Hofman | SQL Injection Attack happening ATM |
| 2011-09-28/a> | Richard Porter | All Along the ARP Tower! |
| 2011-01-23/a> | Richard Porter | Crime is still Crime! |
| 2010-12-23/a> | Mark Hofman | White house greeting cards |
| 2010-08-16/a> | Raul Siles | DDOS: State of the Art |
| 2010-08-15/a> | Manuel Humberto Santander Pelaez | Obfuscated SQL Injection attacks |
| 2010-08-13/a> | Tom Liston | The Strange Case of Doctor Jekyll and Mr. ED |
| 2010-03-15/a> | Adrien de Beaupre | Spamassassin Milter Plugin Remote Root Attack |
| 2010-01-29/a> | Johannes Ullrich | Analyzing isc.sans.org weblogs, part 2, RFI attacks |
| 2009-11-11/a> | Rob VandenBrink | Layer 2 Network Protections against Man in the Middle Attacks |
| 2009-08-28/a> | Adrien de Beaupre | WPA with TKIP done |
| 2009-06-04/a> | Raul Siles | Targeted e-mail attacks asking to verify wire transfer details |
| 2009-04-20/a> | Jason Lam | Digital Content on TV |
| 2009-04-02/a> | Bojan Zdrnja | JavaScript insertion and log deletion attack tools |
| 2009-03-20/a> | donald smith | Stealthier then a MBR rootkit, more powerful then ring 0 control, it’s the soon to be developed SMM root kit. |
| 2009-02-25/a> | Swa Frantzen | Targeted link diversion attempts |
| 2009-01-30/a> | Mark Hofman | Request for info - Scan and webmail |
| 2009-01-18/a> | Maarten Van Horenbeeck | Targeted social engineering |
| 2008-12-03/a> | Andre Ludwig | New ISC Poll! Has your organization suffered a DDoS (Distributed Denial of Service) attack in the last year? |
| 2008-07-09/a> | Johannes Ullrich | Unpatched Word Vulnerability |
| 2008-05-26/a> | Marcus Sachs | Predictable Response |
| 2008-03-27/a> | Maarten Van Horenbeeck | Guarding the guardians: a story of PGP key ring theft |
