Domain Names are the center piece of locating services on the internet and they can be used for a variety of purposes and services. Understanding the type of services a Domain Name offers is one of the key aspects of Internet Security. In another post last year we already introduced tag2domain, our tagging / labelling … Read more
This release does not add any major features to IntelMQ but is considered purely a maintenance release. It addresses some minor errors and contains usability enhancements for the new API. Some notable changes are listed below. Below we present a short summary of the changes. We thank all contributors who participated in this release! As … Read more
After looking at the recitals a few weeks ago, here is my feedback on the normative text of the NIS2 proposal: Art. 1(2)(c) […] lays down obligations on cybersecurity information sharing. It doesn’t just provide obligations, it also provides a legal basis for information sharing. From our perspective, that’s even more important than the obligation. … Read more
Today we released the newest IntelMQ version 2.3.0 along with its companion tools – the IntelMQ Manager and the new IntelMQ API. This version comes with significant changes, being an important intermediate step for the 3.0 release scheduled for summer 2021. We moved the documentation to a new home, see our previous blog post “IntelMQ … Read more
The EU commission dropped a large cyber security package on December 16th 2020, including a first draft for a new version of the NIS Directive. In front of the actual normative legal text, there are 84 recitals, describing the intents of the regulation. I’ve now read through them and this blogpost is my first reaction … Read more
Since Wednesday January 13th, 2021 we are sending data of the URLhaus Feeds of the abuse.ch-project as part of our regular notifications to network owners. The feeds contain URLs to malware files of multiple malware families. To our knowledge, the feeds are of very high quality. Any feedback on the new data source, as well … Read more
The IntelMQ tutorial guiding through various features and tools of IntelMQ is available in the IntelMQ Tutorial GitHub repository.Lesson one introduces the architecture, concepts and terminology of the project. Lessons two and three delve hands-on into working with IntelMQ. Starting with installation and basic usage & configuration they go on to tackle progressively more advanced … Read more
Dieser Blogpost ist auch auf Deutsch verfügbar. Our partner Intevation GmbH develops the next generation of the “Consituency-Portal”, our tool for administration of contact information. The new version follows the current version, which is a further developed „do-portal“ (originally developed by CERT-EU). Since 2017 we adapted this software to our needs within the scope of CEF … Read more
Tag2domain – doing proper statistics on domain names In the course of nic.at’s Connecting Europe Facilities (CEF) project CEF-TC-2018-3 we were able to focus on some long overdue but relevant research: a tagging / labeling database of domain names (in the following, we will use the words “tag” and “label” interchangeably). This project was also presented … Read more
The Austrian Energy CERT and the GovCERT Austria monitor the Certificate Transparency Logs (“CTL”) for their constituents’ domains. These Logs contain any newly issued server certificates and monitoring those lists allows for timely detection of abuse. Our processing chain of this data involves several steps which can be useful for other CERTs and security teams. … Read more
On 26th of May we released the IntelMQ Maintenance Version 2.1.3 and on 18th June the Feature Release 2.2.0. Both versions include various changes, both error corrections and new functionality. We thank all contributors and members of the IntelMQ community for their participation in this community-led project. The Version 2.1.3 mainly fixes errors, for example … Read more
The IntelMQ Manager version 2.1.1 released yesterday fixes a Remote Code Execution flaw (CWE-78: ‘OS Command Injection’). The documentation for version 2.1.1 and installation instructions can be found on our GitHub repository. Always run IntelMQ Manager instances in private networks with proper authentication & TLS. Further, restrict access to the tool to web-browsers which can … Read more
On 28th January, we released the IntelMQ maintenance version 2.1.2 containing only bugfixes for the 2.1.x release series. The documentation for version 2.1.2 and installation instructions can be found on our github repository. The upcoming version 2.2.0 – and current development version – will have several new features to offer. This blog post is part … Read more
I had the pleasure to take part in the TRANSITS II training in Utrecht in January 2020. One of the great things about these trainings is that they are not just about tools and techniques, but about getting to know people from other CERTs/CSIRTs, especially from the European community. However, the training part was also … Read more
Sextortion scams are one of the big newcomers in Internet fraud of the last year. In these campaigns spammers send e-mails which claim that they have hacked into the victim’s computer and used its webcam to film the victim masturbating while surfing adult websites. In order to prevent the crooks from publishing the compromising material … Read more
TL;DR: Block outgoing SMB traffic if you can. Hunt or Monitor for event ID 106 in “Microsoft-Windows-TaskScheduler%4Operational.evtx”. Think about enabling “Audit Process creation” in “Security.evtx” and command line logging. Hunt or monitor for event ID 4688 in “Security.evtx”. While reading through the recent Kaspersky report on the renewed arsenal of the Turla group, I was … Read more
From March 11th to March 13th CERT.at hosted an introductory MeliCERTes Training which covered the basic functionalities of the applications used in MeliCERTes as well as the topic of CSIRT maturity as laid down in the SIM3 model and covered by the CSIRT maturity self-assessment survey by ENISA. Together with teams from the Czech Republic, … Read more
Since our “old” (2014 vintage) PGP-keys are near their expiry date, we have generated a new set of keys. They are available via our usual CERT.at PGP keyring. A transition-document, (inline) signed with both old & new keys, can be found at key-transition-2019.txt. Author: Robert Waldner Source: Read More CERT.at – Blog
On Tuesday we have released IntelMQ version 1.1.1 which is a pure maintenance release with bugfixes only. The documentation for the version 1.1.1 and the installation instructions can be found on our github repository. The development of the next minor release 1.2.0 including new features is happening in parallel and already has a long list … Read more
CERT.at submitted a proposal under objective 1 for the CEF-TC-2018-3 call. We hope we will get funding, since this will allow us to improve the MeliCERTes platform and also work on a set of nice new cool features for IntelMQ, which is maintained at CERT.at and widely used throughout the community. Author: L. Aaron … Read more
The NIS Directive built upon previous work in the space of network and information security and also tried to use the established language of the field. This worked – up to a point. I’m trying to summarize the differences and pitfalls regarding the term “national CSIRT”. “CERT” vs. “CSIRT” Initially, a team that took care … Read more
Based on some background knowledge that we received (update 2018/5/14 14:00 UTC+1: we now know it’s the efail.de bug. The researchers went forward with the public release today), I am taking the liberty to document a setup which protects an Apple Mail installation that I have. The security measure is simple: disable remote content on … Read more
Last week, Alexandre and Andras from CIRCL.lu gave a MISP workshop to a packed crowed of ~ 60-70 people in Vienna. Infosharing FTW! MISP stands for “Malware Information Sharing Platform”. See also misp-project.org. It allows us to synchronise IoCs with those who need the relevant information about attacks against their information systems. This blog post … Read more
Shodan recently published a report on the state of Heartbleed which was picked up by lots of media outlets. I took this as an opportunity to have a look at our statistics. Shodan performs its scan based on IP-addresses and makes the results searchable. CERT.at also runs daily scans, but these are based on the … Read more
As I wrote in our initial DROWN blogpost, we’re scanning .at for mail- and web-servers which are still supporting SSLv2. We’re notifying our constituency and we see a steady drop in the number of servers (as measured by IP-Addresses) that are vulnerable: So it is slowly getting better. Looking at the feedback we receive there … Read more
I wrote back in 2010 that ISPs should prepare for the inevitable backlash if their DNSSEC-aware resolvers black out an important domain. We now had just such a case: the protagonists make it even juicier than I imagined: Comcast customers could not access the new HBO website where they could get the HBO programming without … Read more
Wir leben nicht nur in einer technisch interessanten Zeit, sondern auch die gesellschaftliche Diskussion rund um Geheimdienste, Privatsphäre, Verschlüsselung, 0-Days bis hin zu “Cyberwar” ist für die Zukunft des Internets sehr relevant. Dazu wird viel geschrieben und publiziert, ich will hier auf einen aktuellen Artikel von Ron Deibert hinweisen, weil er auch die Rolle der … Read more
Because of required changes in our firewall infrastructure, all Internet-reachable services of CERT.at will be unavailable for some time on Tuesday, September 30th, 2014, starting at about 9am CEST. An “emergency” website with restricted functionality will be made available. In urgent cases please contact us by telephone: +43 1 505 64 16 78. We will … Read more
At the moment we are seeing a lot of automatic scanning and hacking of Elastic Search installations worldwide. Â Please make sure that port 9200 is locked down in case you run ES. IOCs: C&C IP address: Â 119.1.109.43 Â (China) C&C Port:Â 10991 AV analysis: Zillya: Trojan.Agent.Linux.5 Avast: ELF:Elknot-H [Trj] Kaspersky: Backdoor.Linux.Mayday.g DrWeb: Linux.DDoS.7 VIPRE: Backdoor.Linux.Elknot.f (v) … Read more
CERTs are all about processing information security notifications. Most of the time, these arrive in the form of CSV files. However, occasionally we do get some JSON data. While CSV is line oriented, JSON allows for more complex structures (arrays, objects, objects in objects, etc.) So how to you easily transform complex JSON structures to … Read more
At CERT.at we had to phase out some old 1024 bit DSA keys as well as create new master-signing keys. Â This turned out to be a major effort. Key roll-overs are never easy. In order to easy the key roll-over pains, we created a key transition document. This document is signed by the old keys … Read more
Because of required changes in our power-infrastructure, all Internet-reachable services of CERT.at will be unavailable for some time on Wednesday, December 4th, 2013. An “emergency” website with restricted functionality will be made available. In urgent cases please contact us by telephone: +43 1 505 64 16 78. We will update this post once the work … Read more
Because of necessary changes in our power-infrastructure, all Internet-reachable services of CERT.at will be unavailable for some time on Tuesday (July 30th, 2013). An “emergency” website with restricted functionality will be made available. In urgent cases please contact us by telephone: +43 1 505 64 16 78. We will update this post once the work … Read more
Because of urgent changes in our power-infrastructure, all Internet-reachable services of CERT.at will be unavailable for some time tomorrow (July 17th, 2013). An “emergency” website with restricted functionality will be made available. In urgent cases please contact us by telephone: +43 1 505 64 16 78. We will update this post once the work is … Read more
I am happy to announce that the first release (1.0) of my visual malware analysis tool ProcDOT (I already mentioned the beta in a recent blog post) is now available. Get it for free from our website: ProcDOT 1.0 Author: Christian Wojner Source: Read More CERT.at – Blog
Update: our full report on this incident is now available (in German) No, the Internet is not breaking down, we did not have a doomsday scenario over the last week. We did have an interesting situation, there were some disruption in some parts of the Internet, and there were a good number of overtime hours … Read more
Dear like-minded people, I’m very proud to announce that our latest contribution to the malware analysis community is finally available as open beta. It’s called ProcDOT – I already gave a preview of the alpha version some months ago at SANS Forensics Summit in Prague – and it is an absolute must have tool for … Read more
This blog post evolved over time – initially it was a mere scratchpad for notes during our initial research between 2012/11/29 and 11/30. Later, after Syria was back online again, I added a summary and some potential explanations of what might have happened at the end of this blog post. UPDATE 2014/8/13: It seems it … Read more
Microsoft’s Security Intelligence Report 12 uses the computers cleaned per mille (CCM) metric to compare the infection rates over time and between countries. This is, of course, no perfect measurement of the actual infection rates due to a number of factors, but nevertheless an interesting data-point. Austria usually sports a quite low CCM score, but … Read more
Internet Explorer 6 has outlived its “good-before”-date for years now and both Web-programmers (living hell to support) and Microsoft (a security-nightmare for them) were keen to put a stake through its heart for the last years. It finally seem to have worked: Austria is now at < 1% IE6 according to Microsoft’s IE6 Countdown page. … Read more
It’s not an everyday occurrence that an Austrian Company finds an important security issue. If they then follow responsible disclosure towards the vendor and also inform the local CERT, that’s something that should be openly acknowledged. Thus: A round of applause from CERT.at goes to Johannes Greil of SEC Consult Unternehmensberatung GmbH for finding a … Read more
This week, Comcast announced that they will enable DNSSEC validation on their production resolvers. One thing one might want to keep in mind if you do that: People make mistakes. Some domain owners will break their DNSSEC signatures. We’ve seen a good number of these in 1010, including TLDs like .arpa, .be, and .uk. I … Read more