TheNewbie TL;DR: Block outgoing SMB traffic if you can. Hunt or Monitor for event ID 106 in “Microsoft-Windows-TaskScheduler%4Operational.evtx”. Think about enabling “Audit Process creation” in “Security.evtx” and command line logging. Hunt or monitor for event ID 4688 in “Security.evtx”. While reading through the recent Kaspersky report on the renewed arsenal of the Turla group, I was … Read more
From March 11th to March 13th CERT.at hosted an introductory MeliCERTes Training which covered the basic functionalities of the applications used in MeliCERTes as well as the topic of CSIRT maturity as laid down in the SIM3 model and covered by the CSIRT maturity self-assessment survey by ENISA. Together with teams from the Czech Republic, … Read more
Since our “old” (2014 vintage) PGP-keys are near their expiry date, we have generated a new set of keys. They are available via our usual CERT.at PGP keyring. A transition-document, (inline) signed with both old & new keys, can be found at key-transition-2019.txt. Author: Robert Waldner Source: Read More CERT.at – Blog
On Tuesday we have released IntelMQ version 1.1.1 which is a pure maintenance release with bugfixes only. The documentation for the version 1.1.1 and the installation instructions can be found on our github repository. The development of the next minor release 1.2.0 including new features is happening in parallel and already has a long list … Read more
CERT.at submitted a proposal under objective 1 for the CEF-TC-2018-3 call. We hope we will get funding, since this will allow us to improve the MeliCERTes platform and also work on a set of nice new cool features for IntelMQ, which is maintained at CERT.at and widely used throughout the community. Author: L. Aaron … Read more
The NIS Directive built upon previous work in the space of network and information security and also tried to use the established language of the field. This worked – up to a point. I’m trying to summarize the differences and pitfalls regarding the term “national CSIRT”. “CERT” vs. “CSIRT” Initially, a team that took care … Read more
Based on some background knowledge that we received (update 2018/5/14 14:00 UTC+1: we now know it’s the efail.de bug. The researchers went forward with the public release today), I am taking the liberty to document a setup which protects an Apple Mail installation that I have. The security measure is simple: disable remote content on … Read more
Last week, Alexandre and Andras from CIRCL.lu gave a MISP workshop to a packed crowed of ~ 60-70 people in Vienna. Infosharing FTW! MISP stands for “Malware Information Sharing Platform”. See also misp-project.org. It allows us to synchronise IoCs with those who need the relevant information about attacks against their information systems. This blog post … Read more
Shodan recently published a report on the state of Heartbleed which was picked up by lots of media outlets. I took this as an opportunity to have a look at our statistics. Shodan performs its scan based on IP-addresses and makes the results searchable. CERT.at also runs daily scans, but these are based on the … Read more
As I wrote in our initial DROWN blogpost, we’re scanning .at for mail- and web-servers which are still supporting SSLv2. We’re notifying our constituency and we see a steady drop in the number of servers (as measured by IP-Addresses) that are vulnerable: So it is slowly getting better. Looking at the feedback we receive there … Read more
I wrote back in 2010 that ISPs should prepare for the inevitable backlash if their DNSSEC-aware resolvers black out an important domain. We now had just such a case: the protagonists make it even juicier than I imagined: Comcast customers could not access the new HBO website where they could get the HBO programming without … Read more
Wir leben nicht nur in einer technisch interessanten Zeit, sondern auch die gesellschaftliche Diskussion rund um Geheimdienste, Privatsphäre, Verschlüsselung, 0-Days bis hin zu “Cyberwar” ist für die Zukunft des Internets sehr relevant. Dazu wird viel geschrieben und publiziert, ich will hier auf einen aktuellen Artikel von Ron Deibert hinweisen, weil er auch die Rolle der … Read more
Because of required changes in our firewall infrastructure, all Internet-reachable services of CERT.at will be unavailable for some time on Tuesday, September 30th, 2014, starting at about 9am CEST. An “emergency” website with restricted functionality will be made available. In urgent cases please contact us by telephone: +43 1 505 64 16 78. We will … Read more
At the moment we are seeing a lot of automatic scanning and hacking of Elastic Search installations worldwide. Â Please make sure that port 9200 is locked down in case you run ES. IOCs: C&C IP address: Â 119.1.109.43 Â (China) C&C Port:Â 10991 AV analysis: Zillya: Trojan.Agent.Linux.5 Avast: ELF:Elknot-H [Trj] Kaspersky: Backdoor.Linux.Mayday.g DrWeb: Linux.DDoS.7 VIPRE: Backdoor.Linux.Elknot.f (v) … Read more
CERTs are all about processing information security notifications. Most of the time, these arrive in the form of CSV files. However, occasionally we do get some JSON data. While CSV is line oriented, JSON allows for more complex structures (arrays, objects, objects in objects, etc.) So how to you easily transform complex JSON structures to … Read more
At CERT.at we had to phase out some old 1024 bit DSA keys as well as create new master-signing keys. Â This turned out to be a major effort. Key roll-overs are never easy. In order to easy the key roll-over pains, we created a key transition document. This document is signed by the old keys … Read more
Because of required changes in our power-infrastructure, all Internet-reachable services of CERT.at will be unavailable for some time on Wednesday, December 4th, 2013. An “emergency” website with restricted functionality will be made available. In urgent cases please contact us by telephone: +43 1 505 64 16 78. We will update this post once the work … Read more
Because of necessary changes in our power-infrastructure, all Internet-reachable services of CERT.at will be unavailable for some time on Tuesday (July 30th, 2013). An “emergency” website with restricted functionality will be made available. In urgent cases please contact us by telephone: +43 1 505 64 16 78. We will update this post once the work … Read more
Because of urgent changes in our power-infrastructure, all Internet-reachable services of CERT.at will be unavailable for some time tomorrow (July 17th, 2013). An “emergency” website with restricted functionality will be made available. In urgent cases please contact us by telephone: +43 1 505 64 16 78. We will update this post once the work is … Read more
I am happy to announce that the first release (1.0) of my visual malware analysis tool ProcDOT (I already mentioned the beta in a recent blog post) is now available. Get it for free from our website: ProcDOT 1.0 Author: Christian Wojner Source: Read More CERT.at – Blog
Update: our full report on this incident is now available (in German) No, the Internet is not breaking down, we did not have a doomsday scenario over the last week. We did have an interesting situation, there were some disruption in some parts of the Internet, and there were a good number of overtime hours … Read more
Dear like-minded people, I’m very proud to announce that our latest contribution to the malware analysis community is finally available as open beta. It’s called ProcDOT – I already gave a preview of the alpha version some months ago at SANS Forensics Summit in Prague – and it is an absolute must have tool for … Read more
This blog post evolved over time – initially it was a mere scratchpad for notes during our initial research between 2012/11/29 and 11/30. Later, after Syria was back online again, I added a summary and some potential explanations of what might have happened at the end of this blog post. UPDATE 2014/8/13: It seems it … Read more
Microsoft’s Security Intelligence Report 12 uses the computers cleaned per mille (CCM) metric to compare the infection rates over time and between countries. This is, of course, no perfect measurement of the actual infection rates due to a number of factors, but nevertheless an interesting data-point. Austria usually sports a quite low CCM score, but … Read more
Internet Explorer 6 has outlived its “good-before”-date for years now and both Web-programmers (living hell to support) and Microsoft (a security-nightmare for them) were keen to put a stake through its heart for the last years. It finally seem to have worked: Austria is now at < 1% IE6 according to Microsoft’s IE6 Countdown page. … Read more
It’s not an everyday occurrence that an Austrian Company finds an important security issue. If they then follow responsible disclosure towards the vendor and also inform the local CERT, that’s something that should be openly acknowledged. Thus: A round of applause from CERT.at goes to Johannes Greil of SEC Consult Unternehmensberatung GmbH for finding a … Read more
This week, Comcast announced that they will enable DNSSEC validation on their production resolvers. One thing one might want to keep in mind if you do that: People make mistakes. Some domain owners will break their DNSSEC signatures. We’ve seen a good number of these in 1010, including TLDs like .arpa, .be, and .uk. I … Read more
The holiday season is nearing for many of us, and soon millions of people around the world will be looking to buy the perfect gifts. Many of us will choose to shop online in search of great deals and to avoid long lines and impatient crowds. Unfortunately, this is also the time of year many … Read more
Puteți descărca mașini virtuale de Windows (7, 8.1 si 10) direct de la Microsoft, pentru VirtualBox, VMWare, Parallels, Vagrant sau HyperV de aici: – https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/
There are several types of SQL injection, but they all involve an attacker inserting arbitrary SQL into a web application database query. The good news? SQLi is the lowest of the low-hanging fruit for both attackers and defenders.
– Securitatea cibernetică este o responsabilitate comună: începe Luna europeană a securității cibernetice 2018 – Aproximativ 50 de milioane de utilizatori ai rețelelor sociale Facebook și Instagram, afectați de o breșă de securitate – Vulnerabilitate Zero-Day în noua variantă a sistemului de operare MacOS Mojave – Black Rose Lucy, un nou malware-as-a-service afectează utilizatorii de … Read more
EnGenius routers were recently found in a Mirai-like botnet with a distinct network traffic fingerprint. Locating this botnet subset was a joint effort between myself and Dr. Neal Krawetz. This Mirai-like botnet traffic was fingerprinted after a distinct pattern in the packets received was identified by Dr. Krawetz. While the source port was usually randomized, … Read more
Google Project Zero this week disclosed the details and released a proof-of-concept (PoC) exploit for a potentially serious Linux kernel vulnerability. The flaw, tracked as CVE-2018-17182 and assigned a severity rating of “high,” was discovered by Google Project Zero’s Jann Horn. The security hole is a use-after-free introduced in August 2014 with the release of … Read more
The new White House cybersecurity strategy makes one message was clear: America will not sit back and watch when attacked in cyberspace. On the contrary, in areas ranging from critical infrastructure to space exploration to intellectual property protection, the USA will respond offensively as well as defensively in cyberspace. The best defense is a good … Read more
Cybersecurity researchers at ESET have unveiled what they claim to be the first-ever UEFI rootkit being used in the wild, allowing hackers to implant persistent malware on the targeted computers that could survive a complete hard-drive wipe. Dubbed LoJax, the UEFI rootkit is part of a malware campaign conducted by the infamous Sednit group, also … Read more
Vulnerabilities revealed in smart home devices prompt 1 manufacturer to immediately beef up protections All it took was a white van, a team of three hackers and a phishing email to remotely unlock Johanna Kenwood and Peter Yarema’s front door. The couple’s home in Oakville, Ont., is automated with a number of smart devices, including … Read more
Facebook is already facing immense fallout from revelations this morning that a hacker exploited a security flaw in a popular feature of the social network to steal account credentials of as many as 50 million users. The company is now facing a class-action complaint filed on behalf of one California resident, Carla Echavarria, and one … Read more
Que se passe-t-il lorsque des entreprises privées disposent d’armes informatiques aussi puissantes que celles des États? Le premier SMS arriva sur le portable d’Ahmed Mansoor à 9h38, par un étouffant matin d’août 2016. «Nouvelles preuves de tortures d’Émiriens dans les prisons d’État», annonçait le message laconique, rédigé en arabe. Un lien hypertexte suivait la phrase. … Read more
The Executive Yuan’s Department of Cyber Security has drafted six sets of regulations to complement the Information and Communication Security Management Act (資通安全管理法) passed by the Legislative Yuan in May. The regulations are to take effect on Jan. 1 next year alongside the act. Under the act, central and local government agency heads must appoint … Read more
Știre în curs de actualizare. “Our investigation is still in its early stages. But it’s clear that attackers exploited a vulnerability in Facebook’s code that impacted ‘View As’, a feature that lets people see what their own profile looks like to someone else. This allowed them to steal Facebook access tokens which they could then … Read more
Ce trebuie să știm despre Meltdown și Spectre, grupat într-o singură pagină (actualizată periodic). https://www.welivesecurity.com/2018/01/05/meltdown-spectre-cpu-vulnerabilities/#vendors
Cybersecurity business Darktrace has raised $50m (£38m) in new funding, bringing the company’s valuation to $1.65bn, up from a valuation of $1.25bn in May. Darktrace uses artificial intelligence software to automatically detect cyber threats to customers’ networks. The business says its Antigena product can respond automatically to cybersecurity problems within two seconds. Clients include Gatwick … Read more
AXIS Specialty UK Holdings Limited announced today it has been certified as a GCHQ Certified Training provider for its course “Understanding Cybersecurity and Insurance.” AXIS offers GCHQ Certified Training and related resources to insureds and brokers through the AXIS Cyber Center of Excellence, a global resource that provides mentorship, education, consulting services and solutions to … Read more
Roma, 27 set. (askanews) – L’industria della cyber-security muoverà circa 153 miliardi di dollari in tutto il 2018, con la previsione che questa cifra potrebbe salire ad oltre 248 miliardi nel 2023. E’ quanto emerge da uno studio di esperti del settore, che attribuisce alla Sanità e alle soluzioni di crittografia il primato degli investimenti.
Retail website SheIn.com has notified customers of a serious data breach after malicious hackers stole the details of 6.42 million people. The ‘affordable fashion’ site, which ships worldwide, was made aware of the cyber-attack on August 22, though it is believed to have started in June. During an investigation, the company’s servers were scanned and … Read more
España ha conseguido avances, peor aún está lejos de contar con un auténtico ‘ejército’ cibernético
Stresul ne urmărește acum și în mediul online, nu doar la serviciu ori acasă, în fiecare zi. În pas cu vremurile, specialiștii l-au numit “stres cibernetic”. Un studiu recent arată că 73% dintre angajații din Europa sunt stresați de numărul de parole pe care trebuie să le țină minte, mai ales că 54% recunosc că … Read more
Un ancien employé de la NSA, qui s’était fait voler par négligence des documents confidentiels sur son ordinateur personnel piraté via l’antivirus russe Kaspersky, a été condamné mardi à 66 mois de prison. Nghia Hoang Pho, 68 ans, était employé d’une unité spécialisée contre la cybercriminalité de la NSA, l’agence de renseignement militaire américaine. Il … Read more
Semana Naval: Tecnologías de ciberseguridad CN Cubeiro (MCCD): “Un ciberataque es una amenaza tan seria como un torpedo” Jornada Las tecnologías de la ciberseguridad en el ámbito naval en el ETSIT de la UPM. La Armada española pone el foco en la octava edición de la Semana Naval -entre el 20 y
The CyberWar Map is a visual guide to some of the most prominent players and events in state-to-state cyberconflict created as a part of the National Security Archive’s Cyber Vault Project. This resource focuses on state-sponsored hacking and cyber-attacks.