Tag: SANS Internet Storm Center, InfoCON: green

Whois “geofeed” Data, (Thu, Mar 21st)

Attributing a particular IP address to a specific location is hard and often fails miserably. There are several difficulties that I have talked about before: Out-of-date whois data, data that is outright fake, or was never correct in the first…

Scans for Fortinet FortiOS and the CVE-2024-21762 vulnerability, (Wed, Mar 20th)

Late last week, an exploit surfaced on GitHub for CVE-2024-21762 [1]. This vulnerability affects Fortinet's FortiOS. A patch was released on February 8th. Owners of affected devices had over a month to patch [2]. A few days prior to the GitHub…

Attacker Hunting Firewalls, (Tue, Mar 19th)

Firewalls and other perimeter devices are a huge target these days. Ivanti, Forigate, Citrix, and others offer plenty of difficult-to-patch vulnerabilities for attackers to exploit. Ransomware actors and others are always on the lookout for new victims. However, being and…

Obfuscated Hexadecimal Payload, (Sat, Mar 16th)

This PE file contains an obfuscated hexadecimal-encoded payload. When I analyze it with base64dump.py searching for all supported encodings, a very long payload is detected: This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original…

5Ghoul Revisited: Three Months Later, (Fri, Mar 15th)

About three months ago, I wrote about the implications and impacts of 5Ghoul in a previous diary [1]. The 5Ghoul family of vulnerabilities could cause User Equipment (UEs) to be continuously exploited (e.g. dropping/freezing connections, which would require manual rebooting…

Microsoft Patch Tuesday – March 2024, (Tue, Mar 12th)

This month's patches are oddly “light”. We have patches for 60 vulnerabilities and 4 Chromium patches affecting Microsoft Edge. But only two of the vulnerabilities are rated as “Critical”: This article has been indexed from SANS Internet Storm Center, InfoCON:…

Why Your Firewall Will Kill You, (Tue, Mar 5th)

The last few years have been great for attackers exploiting basic web application vulnerabilities. Usually, home and small business products from companies like Linksys, D-Link, and Ubiquity are known to be favorite targets. But over the last couple of years,…

Take Downs and the Rest of Us: Do they matter?, (Tue, Feb 27th)

Last week, the US Department of Justice published a press release entitled “Justice Department Conducts Court-Authorized Disruption of Botnet Controlled by the Russian Federation&#x27s Main Intelligence Directorate of the General Staff (GRU)” [1]. The disruption targeted a botnet built using…

Takes Downs and the Rest of Us: Do they matter?, (Tue, Feb 27th)

Last week, the US Department of Justice published a press release entitled “Justice Department Conducts Court-Authorized Disruption of Botnet Controlled by the Russian Federation&#x27s Main Intelligence Directorate of the General Staff (GRU)” [1]. The disruption targeted a botnet built using…

Update: MGLNDD_* Scans, (Sat, Feb 24th)

Almost 2 years ago, a reader asked us about TCP connections they observed. The data of these TCP connections starts with “MGLNDD_”: “MGLNDD_* Scans”. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article:…