CERTs / CSIRTs

TL;DR: Block outgoing SMB traffic if you can. Hunt or Monitor for event ID 106 in “Microsoft-Windows-TaskScheduler%4Operational.evtx”. Think about enabling “Audit Process creation” in “Security.evtx” and command line logging. Hunt or monitor for event ID 4688 in “Security.evtx”. While reading through the recent Kaspersky report on the renewed arsenal of the Turla group, I was … Read more

Since our “old” (2014 vintage) PGP-keys are near their expiry date, we have generated a new set of keys. They are available via our usual CERT.at PGP keyring. A transition-document, (inline) signed with both old & new keys, can be found at key-transition-2019.txt. Author: Robert Waldner Source: Read More ​ CERT.at – Blog

CERT.at submitted a proposal under objective 1 for the CEF-TC-2018-3 call. We hope we will get funding, since this will allow us to improve the MeliCERTes platform and also work on a set of nice new cool features for IntelMQ, which is maintained at CERT.at and widely used throughout the community.   Author: L. Aaron … Read more

Based on some background knowledge that we received (update 2018/5/14 14:00 UTC+1: we now know it’s the efail.de bug. The researchers went forward with the public release today), I am taking the liberty to document a setup which protects an Apple Mail installation that I have. The security measure is simple: disable remote content on … Read more

Shodan recently published a report on the state of Heartbleed which was picked up by lots of media outlets. I took this as an opportunity to have a look at our statistics. Shodan performs its scan based on IP-addresses and makes the results searchable. CERT.at also runs daily scans, but these are based on the … Read more

As I wrote in our initial DROWN blogpost, we’re scanning .at for mail- and web-servers which are still supporting SSLv2. We’re notifying our constituency and we see a steady drop in the number of servers (as measured by IP-Addresses) that are vulnerable: So it is slowly getting better. Looking at the feedback we receive there … Read more

I wrote back in 2010 that ISPs should prepare for the inevitable backlash if their DNSSEC-aware resolvers black out an important domain. We now had just such a case: the protagonists make it even juicier than I imagined: Comcast customers could not access the new HBO website where they could get the HBO programming without … Read more

Wir leben nicht nur in einer technisch interessanten Zeit, sondern auch die gesellschaftliche Diskussion rund um Geheimdienste, Privatsphäre, Verschlüsselung, 0-Days bis hin zu “Cyberwar” ist für die Zukunft des Internets sehr relevant. Dazu wird viel geschrieben und publiziert, ich will hier auf einen aktuellen Artikel von Ron Deibert hinweisen, weil er auch die Rolle der … Read more

Because of required changes in our firewall infrastructure, all Internet-reachable services of CERT.at will be unavailable for some time on Tuesday, September 30th, 2014, starting at about 9am CEST. An “emergency” website with restricted functionality will be made available. In urgent cases please contact us by telephone: +43 1 505 64 16 78. We will … Read more

At the moment we are seeing a lot of automatic scanning and hacking of Elastic Search installations worldwide.  Please make sure that port 9200 is locked down in case you run ES. IOCs: C&C IP address:   119.1.109.43  (China) C&C Port: 10991 AV analysis: Zillya: Trojan.Agent.Linux.5 Avast: ELF:Elknot-H [Trj] Kaspersky: Backdoor.Linux.Mayday.g DrWeb: Linux.DDoS.7 VIPRE: Backdoor.Linux.Elknot.f (v) … Read more

CERTs are all about processing information security notifications. Most of the time, these arrive in the form of CSV files. However, occasionally we do get some JSON data. While CSV is line oriented, JSON allows for more complex structures (arrays, objects, objects in objects, etc.) So how to you easily transform complex JSON structures to … Read more

At CERT.at we had to phase out some old 1024 bit DSA keys as well as create new master-signing keys.  This turned out to be a major effort. Key roll-overs are never easy. In order to easy the key roll-over pains, we created a key transition document. This document is signed by the old keys … Read more

Because of required changes in our power-infrastructure, all Internet-reachable services of CERT.at will be unavailable for some time on Wednesday, December 4th, 2013. An “emergency” website with restricted functionality will be made available. In urgent cases please contact us by telephone: +43 1 505 64 16 78. We will update this post once the work … Read more

Because of necessary changes in our power-infrastructure, all Internet-reachable services of CERT.at will be unavailable for some time on Tuesday (July 30th, 2013). An “emergency” website with restricted functionality will be made available. In urgent cases please contact us by telephone: +43 1 505 64 16 78. We will update this post once the work … Read more

Because of urgent changes in our power-infrastructure, all Internet-reachable services of CERT.at will be unavailable for some time tomorrow (July 17th, 2013). An “emergency” website with restricted functionality will be made available. In urgent cases please contact us by telephone: +43 1 505 64 16 78. We will update this post once the work is … Read more

I am happy to announce that the first release (1.0) of my visual malware analysis tool ProcDOT (I already mentioned the beta in a recent blog post) is now available. Get it for free from our website: ProcDOT 1.0 Author: Christian Wojner Source: Read More ​ CERT.at – Blog

Update: our full report on this incident is now available (in German) No, the Internet is not breaking down, we did not have a doomsday scenario over the last week. We did have an interesting situation, there were some disruption in some parts of the Internet, and there were a good number of overtime hours … Read more

Dear like-minded people, I’m very proud to announce that our latest contribution to the malware analysis community is finally available as open beta. It’s called ProcDOT – I already gave a preview of the alpha version some months ago at SANS Forensics Summit in Prague – and it is an absolute must have tool for … Read more

This blog post evolved over time – initially it was a mere scratchpad for notes during our initial research between 2012/11/29 and 11/30. Later, after Syria was back online again, I added a summary and some potential explanations of what might have happened at the end of this blog post. UPDATE 2014/8/13: It seems it … Read more

Microsoft’s Security Intelligence Report 12 uses the computers cleaned per mille (CCM) metric to compare the infection rates over time and between countries. This is, of course, no perfect measurement of the actual infection rates due to a number of factors, but nevertheless an interesting data-point. Austria usually sports a quite low CCM score, but … Read more

Internet Explorer 6 has outlived its “good-before”-date for years now and both Web-programmers (living hell to support) and Microsoft (a security-nightmare for them) were keen to put a stake through its heart for the last years. It finally seem to have worked: Austria is now at < 1% IE6 according to Microsoft’s IE6 Countdown page. … Read more

It’s not an everyday occurrence that an Austrian Company finds an important security issue. If they then follow responsible disclosure towards the vendor and also inform the local CERT, that’s something that should be openly acknowledged. Thus: A round of applause from CERT.at goes to Johannes Greil of SEC Consult Unternehmensberatung GmbH for finding a … Read more

This week, Comcast announced that they will enable DNSSEC validation on their production resolvers. One thing one might want to keep in mind if you do that: People make mistakes. Some domain owners will break their DNSSEC signatures. We’ve seen a good number of these in 1010, including TLDs like .arpa, .be, and .uk. I … Read more