CERTs / CSIRTs

Shortly after the 3.0.1 release, an IntelMQ user reported general performance issues, which we investigated over the following days. We identified two causes for them at the heart of IntelMQ: As it turned out, they just affected the data feed-collection components “collectors” with high load (streaming data or just a few big reports were not … Read more

During the development of the next feature release IntelMQ 3.1.0, we corrected some issues that were found in the IntelMQ 3.0.0 release together with the IntelMQ community. We release new versions of IntelMQ, the IntelMQ API and the graphical user-interface IntelMQ Manager. The upgrade-instructions can be found in the documentation. An important upgrade hint is … Read more

The new Constituency Portal “Tuency” was designed by CERT.at and the development has been delegated to the software development company Intevation. Tuency’s web portal allows you to manage your constituency members who then can manage their relevant data themselves. This is important, for example, if IP subnets or email addresses change. Highlights In order to … Read more

We are happy to announce the completion of the IntelMQ 3.0 milestone. The addition of 2 developers to the IntelMQ development team in October 2020 allowed us to work on major IntelMQ 3.0 changes – new features as well as architectural changes. The most important new features are: Domain-based workflow (Capability to use domain-based data) … Read more

Due to the COVID-19 pandemic the FIRST conference 2021 moved online and so did the annual CTF organized by the FIRST Security Lounge SIG. Thomas Pribitzer, Dimitri Robl, and Sebastian Waldbauer from CERT.at participated as a team, scoring the 9. place out of 42 teams. This post is a writeup of the challenges we were … Read more

While the development of the next major version 3.0.0 of IntelMQ is in the final spurt, we released a small maintenance version of IntelMQ: version 2.3.3. It marks the end of the 2.x development cycle and is an important milestone of our project “Enhancing Cybersecurity in Austria” (2018-AT-IA-0111). Beside small error corrections it comes with … Read more

This release does not add any major features to IntelMQ but is considered purely a maintenance release. It addresses some minor errors and contains usability enhancements for the new API. Some notable changes are listed below. Below we present a short summary of the changes. We thank all contributors who participated in this release! As … Read more

After looking at the recitals a few weeks ago, here is my feedback on the normative text of the NIS2 proposal: Art. 1(2)(c) […] lays down obligations on cybersecurity information sharing. It doesn’t just provide obligations, it also provides a legal basis for information sharing. From our perspective, that’s even more important than the obligation. … Read more

Today we released the newest IntelMQ version 2.3.0 along with its companion tools – the IntelMQ Manager and the new IntelMQ API. This version comes with significant changes, being an important intermediate step for the 3.0 release scheduled for summer 2021. We moved the documentation to a new home, see our previous blog post “IntelMQ … Read more

The EU commission dropped a large cyber security package on December 16th 2020, including a first draft for a new version of the NIS Directive. In front of the actual normative legal text, there are 84 recitals, describing the intents of the regulation. I’ve now read through them and this blogpost is my first reaction … Read more

Since Wednesday January 13th, 2021 we are sending data of the URLhaus Feeds of the abuse.ch-project as part of our regular notifications to network owners. The feeds contain URLs to malware files of multiple malware families. To our knowledge, the feeds are of very high quality. Any feedback on the new data source, as well … Read more

The IntelMQ tutorial guiding through various features and tools of IntelMQ is available in the IntelMQ Tutorial GitHub repository.Lesson one introduces the architecture, concepts and terminology of the project. Lessons two and three delve hands-on into working with IntelMQ. Starting with installation and basic usage & configuration they go on to tackle progressively more advanced … Read more

Dieser Blogpost ist auch auf Deutsch verfügbar. Our partner Intevation GmbH develops the next generation of the “Consituency-Portal”, our tool for administration of contact information. The new version follows the current version, which is a further developed „do-portal“ (originally developed by CERT-EU). Since 2017 we adapted this software to our needs within the scope of CEF … Read more

Tag2domain – doing proper statistics on domain names In the course of nic.at’s Connecting Europe Facilities (CEF) project CEF-TC-2018-3 we were able to focus on some long overdue but relevant research: a tagging / labeling database of domain names (in the following, we will use the words “tag” and “label” interchangeably). This project was also presented … Read more

The Austrian Energy CERT and the GovCERT Austria monitor the Certificate Transparency Logs (“CTL”) for their constituents’ domains. These Logs contain any newly issued server certificates and monitoring those lists allows for timely detection of abuse. Our processing chain of this data involves several steps which can be useful for other CERTs and security teams. … Read more

On 26th of May we released the IntelMQ Maintenance Version 2.1.3 and on 18th June the Feature Release 2.2.0. Both versions include various changes, both error corrections and new functionality. We thank all contributors and members of the IntelMQ community for their participation in this community-led project. The Version 2.1.3 mainly fixes errors, for example … Read more

The IntelMQ Manager version 2.1.1 released yesterday fixes a Remote Code Execution flaw (CWE-78: ‘OS Command Injection’). The documentation for version 2.1.1 and installation instructions can be found on our GitHub repository. Always run IntelMQ Manager instances in private networks with proper authentication & TLS. Further, restrict access to the tool to web-browsers which can … Read more

On 28th January, we released the IntelMQ maintenance version 2.1.2 containing only bugfixes for the 2.1.x release series. The documentation for version 2.1.2 and installation instructions can be found on our github repository. The upcoming version 2.2.0 – and current development version – will have several new features to offer. This blog post is part … Read more

I had the pleasure to take part in the TRANSITS II training in Utrecht in January 2020. One of the great things about these trainings is that they are not just about tools and techniques, but about getting to know people from other CERTs/CSIRTs, especially from the European community. However, the training part was also … Read more

Sextortion scams are one of the big newcomers in Internet fraud of the last year. In these campaigns spammers send e-mails which claim that they have hacked into the victim’s computer and used its webcam to film the victim masturbating while surfing adult websites. In order to prevent the crooks from publishing the compromising material … Read more

From March 11th to March 13th CERT.at hosted an introductory MeliCERTes Training which covered the basic functionalities of the applications used in MeliCERTes as well as the topic of CSIRT maturity as laid down in the SIM3 model and covered by the CSIRT maturity self-assessment survey by ENISA. Together with teams from the Czech Republic, … Read more

On Tuesday we have released IntelMQ version 1.1.1 which is a pure maintenance release with bugfixes only. The documentation for the version 1.1.1 and the installation instructions can be found on our github repository. The development of the next minor release 1.2.0 including new features is happening in parallel and already has a long list … Read more

The NIS Directive built upon previous work in the space of network and information security and also tried to use the established language of the field. This worked – up to a point. I’m trying to summarize the differences and pitfalls regarding the term “national CSIRT”. “CERT” vs. “CSIRT” Initially, a team that took care … Read more

Last week, Alexandre and Andras from CIRCL.lu gave a MISP workshop to a packed crowed of ~ 60-70 people in Vienna. Infosharing FTW! MISP stands for “Malware Information Sharing Platform”. See also misp-project.org. It allows us to synchronise IoCs with those who need the relevant information about attacks against their information systems. This blog post … Read more