Date Author Title
2024-04-25Jesse La GrewDoes it matter if iptables isn't running on my honeypot?
2024-04-17Xavier MertensMalicious PDF File Used As Delivery Mechanism
2024-04-15Johannes UllrichQuick Palo Alto Networks Global Protect Vulnerablity Update (CVE-2024-3400)
2024-04-13Johannes UllrichCritical Palo Alto GlobalProtect Vulnerability Exploited (CVE-2024-3400)
2024-03-10Guy BruneauWhat happens when you accidentally leak your AWS API keys? [Guest Diary]
2024-03-07Jesse La Grew[Guest Diary] AWS Deployment Risks - Configuration and Credential File Targeting
2024-03-03Guy BruneauCapturing DShield Packets with a LAN Tap [Guest Diary]
2024-02-28Johannes UllrichExploit Attempts for Unknown Password Reset Vulnerability
2024-02-25Guy BruneauUtilizing the VirusTotal API to Query Files Uploaded to DShield Honeypot [Guest Diary]
2024-02-18Guy BruneauMirai-Mirai On The Wall... [Guest Diary]
2024-02-15Jesse La Grew[Guest Diary] Learning by doing: Iterative adventures in troubleshooting
2024-02-03Guy BruneauDShield Sensor Log Collection with Elasticsearch
2024-01-30Johannes UllrichWhat did I say to make you stop talking to me?
2024-01-17Jesse La GrewNumber Usage in Passwords
2024-01-07Guy BruneauSuspicious Prometei Botnet Activity
2023-12-27Guy BruneauUnveiling the Mirai: Insights into Recent DShield Honeypot Activity [Guest Diary]
2023-12-13Guy BruneauT-shooting Terraform for DShield Honeypot in Azure [Guest Diary]
2023-12-10Guy BruneauHoneypots: From the Skeptical Beginner to the Tactical Enthusiast
2023-11-30John BambenekProphetic Post by Intern on CVE-2023-1389 Foreshadows Mirai Botnet Expansion Today
2023-11-27Guy BruneauDecoding the Patterns: Analyzing DShield Honeypot Activity [Guest Diary]
2023-11-22Guy BruneauCVE-2023-1389: A New Means to Expand Botnets
2023-11-20Jesse La GrewOverflowing Web Honeypot Logs
2023-11-09Guy BruneauRouters Targeted for Gafgyt Botnet [Guest Diary]
2023-10-15Guy BruneauDomain Name Used as Password Captured by DShield Sensor
2023-09-18Johannes UllrichInternet Wide Multi VPN Search From Single /24 Network
2023-09-14Jesse La GrewDShield and qemu Sitting in a Tree: L-O-G-G-I-N-G
2023-09-09Guy Bruneau?Anyone get the ASN of the Truck that Hit Me?!?: Creating a PowerShell Function to Make 3rd Party API Calls for Extending Honeypot Information [Guest Diary]
2023-09-05Jesse La GrewCommon usernames submitted to honeypots
2023-09-02Jesse La GrewWhat is the origin of passwords submitted to honeypots?
2023-08-31Guy BruneauPotential Weaponizing of Honeypot Logs [Guest Diary]
2023-08-21Xavier MertensQuick Malware Triage With Inotify Tools
2023-08-12Guy BruneauDShield Sensor Monitoring with a Docker ELK Stack [Guest Diary]
2023-07-23Guy BruneauInstall & Configure Filebeat on Raspberry Pi ARM64 to Parse DShield Sensor Logs
2023-07-13Jesse La GrewDShield Honeypot Maintenance and Data Retention
2023-07-06Jesse La GrewIDS Comparisons with DShield Honeypot Data
2023-06-22Brad DuncanQakbot (Qbot) activity, obama271 distribution tag
2023-06-11Guy BruneauDShield Honeypot Activity for May 2023
2023-05-22Johannes UllrichProbes for recent ABUS Security Camera Vulnerability: Attackers keep an eye on everything.
2023-05-14Guy BruneauDShield Sensor Update
2023-05-09Russ McReeExploratory Data Analysis with CISSM Cyber Attacks Database - Part 2
2023-04-17Jan KoprivaThe strange case of Great honeypot of China
2023-04-12Brad DuncanRecent IcedID (Bokbot) activity
2023-03-11Xavier MertensOverview of a Mirai Payload Generator
2023-03-02Didier StevensYARA: Detect The Unexpected ...
2023-02-28Brad DuncanBB17 distribution Qakbot (Qbot) activity
2023-02-24Brad DuncanURL files and WebDAV used for IcedID (Bokbot) infection
2023-02-09Xavier MertensA Backdoor with Smart Screenshot Capability
2023-02-07Yee Ching TokA Survey of Bluetooth Vulnerabilities Trends (2023 Edition)
2023-02-05Didier StevensVideo: Analyzing Malicious OneNote Documents
2023-02-01Didier StevensDetecting (Malicious) OneNote Files
2023-01-31Jesse La GrewDShield Honeypot Setup with pfSense
2023-01-25Xavier MertensA First Malicious OneNote Document
2023-01-05Brad DuncanMore Brazil malspam pushing Astaroth (Guildma) in January 2023
2022-12-29Jesse La GrewOpening the Door for a Knock: Creating a Custom DShield Listener
2022-12-21Guy BruneauDShield Sensor Setup in Azure
2022-12-20Xavier MertensLinux File System Monitoring & Actions
2022-12-02Brad Duncanobama224 distribution Qakbot tries .vhd (virtual hard disk) images
2022-11-02Brad DuncanWho put the "Dark" in DarkVNC?
2022-10-16Didier StevensVideo: Analysis of a Malicious HTML File (QBot)
2022-10-13Didier StevensAnalysis of a Malicious HTML File (QBot)
2022-10-07Xavier MertensCritical Fortinet Vulnerability Ahead
2022-09-18Didier StevensVideo: Grep & Tail -f With Notepad++
2022-09-12Johannes UllrichVirusTotal Result Comparisons for Honeypot Malware
2022-09-05Didier StevensQuickie: Grep & Tail -f With Notepad++
2022-08-30Johannes UllrichTwo things that will never die: bash scripts and IRC!
2022-08-24Brad DuncanMonster Libra (TA551/Shathak) --> IcedID (Bokbot) --> Cobalt Strike & DarkVNC
2022-08-19Brad DuncanBrazil malspam pushes Astaroth (Guildma) malware
2022-08-18Johannes UllrichHoneypot Attack Summaries with Python
2022-08-12Brad DuncanMonster Libra (TA551/Shathak) pushes IcedID (Bokbot) with Dark VNC and Cobalt Strike
2022-07-27Brad DuncanIcedID (Bokbot) with Dark VNC and Cobalt Strike
2022-07-10Guy BruneauExcel 4 Emotet Maldoc Analysis using CyberChef
2022-07-07Brad DuncanEmotet infection with Cobalt Strike
2022-07-05Jan KoprivaEternalBlue 5 years after WannaCry and NotPetya
2022-06-30Brad DuncanCase Study: Cobalt Strike Server Lives on After Its Domain Is Suspended
2022-06-28Johannes UllrichPossible Scans for HiByMusic Devices
2022-06-24Xavier MertensPython (ab)using The Windows GUI
2022-06-15Johannes UllrichTerraforming Honeypots. Installing DShield Sensors in the Cloud
2022-06-09Brad DuncanTA570 Qakbot (Qbot) tries CVE-2022-30190 (Follina) exploit (ms-msdt)
2022-05-30Xavier MertensNew Microsoft Office Attack Vector via "ms-msdt" Protocol Scheme (CVE-2022-30190)
2022-05-19Brad DuncanBumblebee Malware from TransferXL URLs
2022-05-12Rob VandenBrinkWhen Get-WebRequest Fails You
2022-05-03Johannes UllrichSome Honeypot Updates
2022-04-20Brad Duncan"aa" distribution Qakbot (Qbot) infection with DarkVNC traffic
2022-04-19Johannes UllrichResetting Linux Passwords with U-Boot Bootloaders
2022-03-31Johannes UllrichSpring Vulnerability Update - Exploitation Attempts CVE-2022-22965
2022-03-25Xavier MertensXLSB Files: Because Binary is Stealthier Than XML
2022-03-16Brad DuncanQakbot infection with Cobalt Strike and VNC activity
2022-03-10Xavier MertensCredentials Leaks on VirusTotal
2022-03-03Johannes UllrichAttackers Search For Exposed "LuCI" Folders: Help me understand this attack
2022-03-02Johannes UllrichThe More Often Something is Repeated, the More True It Becomes: Dealing with Social Media
2022-02-16Brad DuncanAstaroth (Guildma) infection
2022-02-15Xavier MertensWho Are Those Bots?
2022-02-09Brad DuncanExample of Cobalt Strike from Emotet infection
2022-01-25Brad DuncanEmotet Stops Using 0.0.0.0 in Spambot Traffic
2022-01-19Brad Duncan0.0.0.0 in Emotet Spambot Traffic
2022-01-07Xavier MertensCustom Python RAT Builder
2021-12-28Russ McReeLotL Classifier tests for shells, exfil, and miners
2021-12-22Brad DuncanDecember 2021 Forensic Contest: Answers and Analysis
2021-12-16Brad DuncanHow the "Contact Forms" campaign tricks people
2021-12-02Brad DuncanTA551 (Shathak) pushes IcedID (Bokbot)
2021-11-26Guy BruneauSearching for Exposed ASUS Routers Vulnerable to CVE-2021-20090
2021-11-20Guy BruneauHikvision Security Cameras Potentially Exposed to Remote Code Execution
2021-11-16Brad DuncanEmotet Returns
2021-11-04Brad DuncanOctober 2021 Forensic Contest: Answers and Analysis
2021-11-04Tom WebbXmount for Disk Images
2021-11-01Yee Ching TokRevisiting BrakTooth: Two Months Later
2021-10-20Xavier MertensThanks to COVID-19, New Types of Documents are Lost in The Wild
2021-10-04Johannes UllrichBoutique "Dark" Botnet Hunting for Crumbs
2021-09-23Xavier MertensExcel Recipe: Some VBA Code with a Touch of Excel4 Macro
2021-08-31Yee Ching TokBrakTooth: Impacts, Implications and Next Steps
2021-08-13Brad DuncanExample of Danabot distributed through malspam
2021-07-24Bojan ZdrnjaActive Directory Certificate Services (ADCS - PKI) domain admin vulnerability
2021-07-24Xavier MertensAgent.Tesla Dropped via a .daa Image and Talking to Telegram
2021-06-30Brad DuncanJune 2021 Forensic Contest: Answers and Analysis
2021-06-24Xavier MertensDo you Like Cookies? Some are for sale!
2021-05-14Xavier Mertens"Open" Access to Industrial Systems Interface is Also Far From Zero
2021-04-15Johannes UllrichWhy and How You Should be Using an Internal Certificate Authority
2021-04-06Jan KoprivaMalspam with Lokibot vs. Outlook and RFCs
2021-04-02Xavier MertensC2 Activity: Sandboxes or Real Victims?
2021-03-06Xavier MertensSpotting the Red Team on VirusTotal!
2021-03-03Brad DuncanQakbot infection with Cobalt Strike
2021-02-28Didier StevensMaldocs: Protection Passwords
2021-02-23Jan KoprivaQakbot in a response to Full Disclosure post
2021-02-22Didier StevensUnprotecting Malicious Documents For Inspection
2021-02-17Brad DuncanMalspam pushing Trickbot gtag rob13
2021-02-13Guy BruneauvSphere Replication updates address a command injection vulnerability (CVE-2021-21976) - https://www.vmware.com/security/advisories/VMSA-2021-0001.html
2021-01-28Daniel WesemannEmotet vs. Windows Attack Surface Reduction
2021-01-26Brad DuncanTA551 (Shathak) Word docs push Qakbot (Qbot)
2021-01-20Brad DuncanQakbot activity resumes after holiday break
2021-01-15Guy BruneauObfuscated DNS Queries
2020-12-09Brad DuncanRecent Qakbot (Qbot) activity
2020-12-04Guy BruneauDetecting Actors Activity with Threat Intel
2020-11-18Xavier MertensWhen Security Controls Lead to Security Issues
2020-11-03Brad DuncanEmotet -> Qakbot -> more Emotet
2020-10-23Russ McReeSooty: SOC Analyst's All-in-One Tool
2020-10-20Xavier MertensMirai-alike Python Scanner
2020-10-14Brad DuncanMore TA551 (Shathak) Word docs push IcedID (Bokbot)
2020-09-29Xavier MertensManaging Remote Access for Partners & Contractors
2020-08-24Xavier MertensTracking A Malware Campaign Through VT
2020-08-22Guy BruneauRemote Desktop (TCP/3389) and Telnet (TCP/23), What might they have in Common?
2020-08-19Xavier MertensExample of Word Document Delivering Qakbot
2020-08-03Xavier MertensPowershell Bot with Multiple C2 Protocols
2020-08-01Jan KoprivaWhat pages do bad bots look for?
2020-07-15Brad DuncanWord docs with macros for IcedID (Bokbot)
2020-07-01Jim ClausingSetting up the Dshield honeypot and tcp-honeypot.py
2020-06-28Guy Bruneautcp-honeypot.py Logstash Parser & Dashboard Update
2020-06-25Johannes UllrichTech Tuesday Recap / Recordings: Part 2 (Installing the Honeypot) release.
2020-06-20Tom WebbPi Zero HoneyPot
2020-06-13Guy BruneauMirai Botnet Activity
2020-06-05Remco VerhoefNot so FastCGI!
2020-06-05Johannes UllrichCyber Security for Protests
2020-05-20Brad DuncanMicrosoft Word document with malicious macro pushes IcedID (Bokbot)
2020-05-06Xavier MertensKeeping an Eye on Malicious Files Life Time
2020-05-01Jim ClausingAttack traffic on TCP port 9673
2020-04-20Didier StevensKPOT AutoIt Script: Analysis
2020-04-12Didier StevensReader Analysis: "Dynamic analysis technique to get decrypted KPOT Malware."
2020-04-02Tom WebbTPOT's Cowrie to ISC Logs
2020-04-01Brad DuncanQakbot malspam sent from an infected Windows host
2020-03-23Didier StevensKPOT Deployed via AutoIt Script
2020-03-22Didier StevensMore COVID-19 Themed Malware
2020-03-21Guy BruneauHoneypot - Scanning and Targeting Devices & Services
2020-03-18Brad DuncanTrickbot gtag red5 distributed as a DLL file
2020-01-28Brad DuncanEmotet epoch 1 infection with Trickbot gtag mor84
2020-01-23Xavier MertensComplex Obfuscation VS Simple Trick
2020-01-12Guy BruneauELK Dashboard and Logstash parser for tcp-honeypot Logs
2019-12-24Brad DuncanMalspam with links to Word docs pushes IcedID (Bokbot)
2019-12-18Brad DuncanEmotet infection with spambot activity
2019-12-15Didier StevensVirusTotal Email Submissions
2019-12-11Brad DuncanGerman language malspam pushes yet another wave of Trickbot
2019-11-13Brad DuncanAn example of malspam pushing Lokibot malware, November 2019
2019-11-03Didier StevensYou Too? "Unusual Activity with Double Base64 Encoding"
2019-10-30Xavier MertensKeep an Eye on Remote Access to Mailboxes
2019-10-02Brad DuncanA recent example of Emotet malspam
2019-09-24Xavier MertensHuge Amount of remotewebaccess.com Sites Found in Certificate Transparency Logs
2019-09-18Brad DuncanEmotet malspam is back
2019-09-03Johannes Ullrich[Guest Diary] Tricky LNK points to TrickBot
2019-08-14Brad DuncanRecent example of MedusaHTTP malware
2019-08-08Johannes Ullrich[Guest Diary] The good, the bad and the non-functional, or "how not to do an attack campaign"
2019-07-26Kevin ShorttDVRIP Port 34567 - Uptick
2019-06-28Rob VandenBrinkVerifying Running Processes against VirusTotal - Domain-Wide
2019-05-16Xavier MertensThe Risk of Authenticated Vulnerability Scans
2019-03-13Brad DuncanMalspam pushes Emotet with Qakbot as the follow-up malware
2019-03-06Brad DuncanMalspam with password-protected word docs still pushing IcedID (Bokbot) with Trickbot
2019-02-14Xavier MertensOld H-Worm Delivered Through GitHub
2019-01-16Brad DuncanEmotet infections and follow-up malware
2019-01-10Brad DuncanHeartbreaking Emails: "Love You" Malspam
2019-01-09Russ McReegganimate: Animate YouR Security Analysis
2018-12-23Guy BruneauScanning Activity, end Goal is to add Hosts to Mirai Botnet
2018-12-18Brad DuncanMalspam links to password-protected Word docs that push IcedID (Bokbot)
2018-12-05Brad DuncanCampaign evolution: Hancitor changes its Word macros
2018-12-04Brad DuncanMalspam pushing Lokibot malware
2018-11-15Brad DuncanEmotet infection with IcedID banking Trojan
2018-11-14Brad DuncanDay in the life of a researcher: Finding a wave of Trickbot malspam
2018-11-09Tom WebbPlaying with T-POT
2018-09-26Brad DuncanOne Emotet infection leads to three follow-up malware infections
2018-07-26Xavier MertensWindows Batch File Deobfuscation
2018-07-24Brad DuncanRecent Emotet activity
2018-06-27Renato MarinhoSilently Profiling Unknown Malware Samples
2018-06-16Russ McReeAnomaly Detection & Threat Hunting with Anomalize
2018-06-13Remco VerhoefFrom Microtik with Love
2018-05-27Guy BruneauCapture and Analysis of User Agents
2018-05-19Xavier MertensMalicious Powershell Targeting UK Bank Customers
2018-05-09Xavier MertensNice Phishing Sample Delivering Trickbot
2018-03-08Xavier MertensCRIMEB4NK IRC Bot
2017-11-30Brad DuncanMore Malspam pushing Emotet malware
2017-11-28Xavier MertensApple High Sierra Uses a Passwordless Root Account
2017-11-25Guy BruneauExim Remote Code Exploit
2017-11-11Xavier MertensKeep An Eye on your Root Certificates
2017-10-19Brad DuncanHSBC-themed malspam uses ISO attachments to push Loki Bot malware
2017-08-15Brad DuncanMalspam pushing Trickbot banking Trojan
2017-08-10Didier StevensMaldoc Analysis with ViperMonkey
2017-08-03Johannes UllrichUsing a Raspberry Pi honeypot to contribute data to DShield/ISC
2017-07-28Didier StevensStatic Analysis of Emotet Maldoc
2017-07-27Xavier MertensTinyPot, My Small Honeypot
2017-07-26Brad DuncanMalspam pushing Emotet malware
2017-07-19Xavier MertensBots Searching for Keys & Config Files
2017-06-28Brad DuncanPetya? I hardly know ya! - an ISC update on the 2017-06-27 ransomware outbreak
2017-05-08Renato MarinhoExploring a P2P Transient Botnet - From Discovery to Enumeration
2017-03-12Guy BruneauHoneypot Logs and Tracking a VBE Script
2017-02-21Jim ClausingQuick and dirty generic listener
2017-02-10Brad DuncanHancitor/Pony malspam
2017-01-10Johannes UllrichPort 37777 "MapTable" Requests
2017-01-07Xavier MertensUsing Security Tools to Compromize a Network
2017-01-06John BambenekGreat Misadventures of Security Vendors: Absurd Sandboxing Edition
2016-12-31Xavier MertensOngoing Scans Below the Radar
2016-12-07Xavier MertensThe Passwords You Should Never Use
2016-11-13Guy BruneauBitcoin Miner File Upload via FTP
2016-09-15Xavier MertensIn Need of a OTP Manager Soon?
2016-09-10Xavier MertensOngoing IMAP Scan, Anyone Else?
2016-08-22Russ McReeRed Team Tools Updates: hashcat and SpiderFoot
2016-07-27Xavier MertensAnalyze of a Linux botnet client source code
2016-07-07Johannes UllrichPatchwork: Is it still "Advanced" if all you have to do is Copy/Paste?
2016-06-15Richard PorterWarp Speed Ahead, L7 Open Source Packet Generator: Warp17
2016-06-03Tom ListonMySQL is YourSQL
2016-05-14Guy BruneauINetSim as a Basic Honeypot
2016-04-27Tom WebbKippos Cousin Cowrie
2016-03-15Xavier MertensDockerized DShield SSH Honeypot
2016-03-13Xavier MertensSSH Honeypots (Ab)used as Proxy
2016-02-26Xavier MertensQuick Audit of *NIX Systems
2016-01-31Guy BruneauWindows 10 and System Protection for DATA Default is OFF
2016-01-23Didier StevensSigcheck and VirusTotal for Offline Machine
2016-01-08Mark HofmanSLOTH, attack on TLS using MD5
2015-10-12Guy BruneauCritical Vulnerability in Multiple Cisco Products - Apache Struts 2 Command Execution http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2
2015-08-06Didier StevensSigcheck and virustotal-search
2015-07-21Didier StevensSearching Through the VirusTotal Database
2015-07-17Didier StevensProcess Explorer and VirusTotal
2015-07-17Didier StevensAutoruns and VirusTotal
2015-07-17Didier StevensSigcheck and VirusTotal
2015-04-14Johannes UllrichOdd POST Request To Web Honeypot
2015-04-08Tom WebbIs it a breach or not?
2015-03-16Johannes UllrichAutomatically Documenting Network Connections From New Devices Connected to Home Networks
2015-03-02Johannes UllrichHow Do You Control the Internet of Things Inside Your Network?
2015-02-12Johannes UllrichDid You Remove That Debug Code? Netatmo Weather Station Sending WPA Passphrase in the Clear
2015-02-06Johannes UllrichAnthem, TurboTax and How Things "Fit Together" Sometimes
2014-10-09Johannes UllrichCSAM: My servers started speaking IRC, and that is when I started to listen!
2014-10-03Johannes UllrichCSAM: The Power of Virustotal to Turn Harmless Binaries Malicious
2014-08-16Lenny ZeltserWeb Server Attack Investigation - Installing a Bot and Reverse Shell via a PHP Vulnerability
2014-07-31Chris MohanA Honeypot for home: Raspberry Pi
2014-07-30Rick WannerSymantec Endpoint Protection Privilege Escalation Zero Day
2014-07-28Johannes UllrichInteresting HTTP User Agent "chroot-apach0day"
2014-07-14Johannes UllrichThe Internet of Things: How do you "on-board" devices?
2014-06-30Johannes UllrichShould I setup a Honeypot? [SANSFIRE]
2014-06-28Mark HofmanNo more Microsoft advisory email notifications?
2014-06-04Richard Porterp0f, Got Packets?
2014-05-01Johannes UllrichBusybox Honeypot Fingerprinting and a new DVR scanner
2014-03-04Daniel WesemannTriple Handshake Cookie Cutter
2014-02-07Rob VandenBrinkHello Virustotal? It's Microsoft Calling.
2014-01-16Kevin ShorttPort 4028 - Interesting Activity
2013-12-07Guy BruneauSuspected Active Rovnix Botnet Controller
2013-11-22Rick WannerPort 0 DDOS
2013-11-02Rick WannerProtecting Your Family's Computers
2013-10-26Guy BruneauActive Perl/Shellbot Trojan
2013-10-05Richard PorterAdobe Breach Notification, Notifications?
2013-09-18Rob VandenBrinkCisco DCNM Update Released
2013-09-02Adrien de Beaupre[OT] Happy Labo(u)r Day USA and Canada!
2013-08-13Swa FrantzenMicrosoft security advisories: RDP and MD5 deprecation in Microsoft root certificates
2013-08-11Bojan ZdrnjaXATattacks (attacks on xat.com)
2013-08-09Kevin ShorttCopy Machines - Changing Scanned Content
2013-07-25Johannes UllrichA Couple of SSH Brute Force Compromises
2013-07-13Lenny ZeltserDecoy Personas for Safeguarding Online Identity Using Deception
2013-05-19Kevin ShorttPort 51616 - Got Packets?
2013-04-14Johannes UllrichProtocol 61 Packets Follow Up
2013-04-04Johannes UllrichMicrosoft April Patch Tuesday Advance Notification
2013-03-29Chris MohanDoes your breach email notification look like a phish?
2013-03-09Guy BruneauIPv6 Focus Month: IPv6 Encapsulation - Protocol 41
2013-03-02Scott FendleyEvernote Security Issue
2013-02-21Bojan ZdrnjaSSHD rootkit in the wild
2013-02-16Lorna HutchesonFedora RedHat Vulnerabilty Released
2013-01-15Russ McReeCisco introducing Cisco Security Notices 16 JAN 2013
2013-01-09Rob VandenBrinkHotmail seeing some temporary access issues
2013-01-08Richard PorterA picture worth a 1000 barcodes?
2012-12-06Johannes UllrichHow to identify if you are behind a "Transparent Proxy"
2012-10-26Russ McReeCyber Security Awareness Month - Day 26 - Attackers use trusted domain to propagate Citadel Zeus variant
2012-08-22Adrien de BeaupreApple Remote Desktop update fixes no encryption issue
2012-07-12Rob VandenBrinkToday at SANSFIRE - Dude Your Car is PWND !
2012-07-05Adrien de BeaupreMicrosoft advanced notification for July 2012 patch Tuesday
2012-05-22Johannes UllrichThe "Do Not Track" header
2012-05-22Johannes UllrichWhen factors collapse and two factor authentication becomes one.
2012-04-26Richard PorterDefine Irony: A medical device with a Virus?
2012-03-16Russ McReeMS12-020 RDP vulnerabilities: Patch, Mitigate, Detect
2012-02-28Russ McReeQOTD from securityburnout.org
2012-02-27Johannes UllrichOdd Vanishing Signatures in OS X XProtect
2011-12-08Adrien de BeaupreMicrosoft Security Bulletin Advance Notification for December 2011
2011-12-06Pedro BuenoThe RedRet connection...
2011-11-28Tom ListonA Puzzlement...
2011-11-22Pedro BuenoUpdates on ZeroAccess and BlackHole front...
2011-11-19Pedro BuenoDragon Research Group (DRG) announced the white paper entitled "VNC: Threats and Countermeasures" : https://dragonresearchgroup.org/insight/vnc-tac.html
2011-10-26Rob VandenBrinkThe Theoretical "SSL Renegotiation" Issue gets a Whole Lot More Real !
2011-10-01Mark HofmanAdobe Photoshop for Windows Vulnerability (CVE-2011-2443)
2011-09-20Swa FrantzenDiginotar declared bankrupt
2011-09-19Guy BruneauMS Security Advisory Update - Fraudulent DigiNotar Certificates
2011-09-15Swa FrantzenDigiNotar looses their accreditation for qualified certificates
2011-09-13Swa FrantzenMore DigiNotar intermediate certificates blocklisted at Microsoft
2011-09-07Lenny ZeltserGlobalSign Temporarily Stops Issuing Certificates to Investigate a Potential Breach
2011-09-06Swa FrantzenDigiNotar audit - intermediate report available
2011-09-06Johannes UllrichMicrosoft Releases Diginotar Related Patch and Advisory
2011-09-01Swa FrantzenDigiNotar breach - the story so far
2011-08-31Johannes UllrichFirefox/Thunderbird 6.0.1 released to blocklist bad DigiNotar SSL certificates
2011-08-11Guy BruneauBlackBerry Enterprise Server Critical Update
2011-08-04Johannes UllrichIRC traffic on non standard ports
2011-07-29Richard PorterApple Lion talking on TCP 5223
2011-07-02Pedro BuenoBootkits, they are back at full speed...
2011-06-21Chris MohanStartSSL, a web authentication authority, suspend services after a security breach
2011-06-08Johannes UllrichSpam from compromised Hotmail accounts
2011-05-14Guy BruneauWebsense Study Claims Canada Next Hotbed for Cybercrime Web Hosting Activity
2011-04-28Chris MohanGathering and use of location information fears - or is it all a bit too late
2011-04-28Chris MohanDSL Reports advise 9,000 accounts were compromised
2011-04-20Daniel WesemannVirustotal.com hiccup
2011-04-03Richard PorterExtreme Disclosure? Not yet but a great trend!
2011-02-28Deborah HalePossible Botnet Scanning
2011-02-14Richard PorterAnonymous Damage Control Anybody?
2011-01-12Richard PorterHow Many Loyalty Cards do you Carry?
2011-01-12Richard PorterHas Big Brother gone Global?
2011-01-11Kevin ShorttSpam Cannons on Holiday
2011-01-10Manuel Humberto Santander PelaezVirusTotal VTzilla firefox/chrome plugin
2010-12-19Raul SilesIntel's new processors have a remote kill switch (Anti-Theft 3.0)
2010-11-18Chris CarboniStopping the ZeroAccess Rootkit
2010-11-18Chris CarboniAll of your pages are belonging to us
2010-11-05Adrien de BeaupreBot honeypot
2010-11-01Manuel Humberto Santander PelaezCheckpoint UTM-1 edge VPN boxes worldwide did an unscheduled reboot
2010-10-19Rob VandenBrinkCyber Security Awareness Month - Day 19 - Remote Access Tools
2010-10-19Rob VandenBrinkCyber Security Awareness Month - Day 19 - Remote User VPN Tunnels - to Split or not to Split?
2010-10-19Rob VandenBrinkCyber Security Awareness Month - Day 19 - Remote User VPN Access – Are things getting too easy, or too hard?
2010-10-19Rob VandenBrinkCyber Security Awareness Month - Day 19 - VPN and Remote Access Tools
2010-10-11Adrien de BeaupreOT: Happy Thanksgiving Day Canada
2010-10-04Mark HofmanOnline Voting
2010-10-03Adrien de BeaupreH went down.
2010-08-19Daniel WesemannCasper the unfriendly ghost
2010-07-29Rob VandenBrinkFBI, Slovenian and Spanish Police announce more arrests of Mariposa Botnet Creator, Operators
2010-07-21Adrien de BeaupreAdobe Reader Protected Mode
2010-07-21Adrien de BeaupreDell PowerEdge R410 replacement motherboard firmware contains malware
2010-06-15Manuel Humberto Santander PelaezMastercard delivering cards with OTP device included
2010-06-14Manuel Humberto Santander PelaezNew way of social engineering on IRC
2010-05-12Rob VandenBrinkAdobe Shockwave Update
2010-05-07Johannes UllrichStock market "wipe out" may be due to computer error
2010-05-02Mari NicholsZbot Social Engineering
2010-04-23Adrien de BeaupreShadowserver botnet rules
2010-03-25Kevin ListonZeus wants to do your taxes
2010-03-15Adrien de BeaupreSpamassassin Milter Plugin Remote Root Attack
2010-03-11donald smithCert write up on Skype IMBot Logic and Functionality.
2010-03-10Rob VandenBrinkMicrosoft Security Advisory 981374 - Remote Code Execution Vulnerability for IE6 and IE7
2010-03-10Rob VandenBrinkMicrosoft re-release of KB973811 - attacks on Extended Protection for Authentication
2010-02-19Mark HofmanMS10-015 may cause Windows XP to blue screen (but only if you have malware on it)
2010-02-09Adrien de BeaupreWhen is a 0day not a 0day? Samba symlink bad default config
2010-02-02Johannes UllrichPushdo Update
2010-02-02Guy BruneauCisco Secure Desktop Remote XSS Vulnerability
2010-02-01Rob VandenBrinkNMAP 5.21 - Is UDP Protocol Specific Scanning Important? Why Should I Care?
2010-01-25William Salusky"Bots and Spiders and Crawlers, be gone!" - or - "New Open Source WebAppSec tools, Huzzah!"
2009-12-21Marcus SachsiPhone Botnet Analysis
2009-12-07Rob VandenBrinkLayer 2 Network Protections – reloaded!
2009-11-14Adrien de BeaupreMicrosoft advisory for Windows 7 / Windows Server 2008 R2 Remote SMB DoS Exploit released
2009-11-13Adrien de BeaupreTLS & SSLv3 renegotiation vulnerability explained
2009-11-13Deborah HalePushdo/Cutwail Spambot - A Little Known BIG Problem
2009-11-12Rob VandenBrinkWindows 7 / Windows Server 2008 Remote SMB Exploit
2009-11-11Rob VandenBrinkLayer 2 Network Protections against Man in the Middle Attacks
2009-11-08Kevin ListonFireEye takes on Ozdok and Recovery Ideas
2009-11-05Swa FrantzenTLS Man-in-the-middle on renegotiation vulnerability made public
2009-11-05Swa FrantzenRIM fixes random code execution vulnerability
2009-10-30Rob VandenBrinkNew version of NIST 800-41, Firewalls and Firewall Policy Guidelines
2009-10-26Johannes UllrichWeb honeypot Update
2009-10-10Tony CarothersUser Notification for Possible Infected Systems
2009-10-06Adrien de BeaupreCyber Security Awareness Month - Day 6 ports 67&68 udp - bootp and dhcp
2009-10-05Adrien de BeaupreTime to change your hotmail/gmail/yahoo password
2009-09-18Jason LamResults from Webhoneypot project
2009-09-16Raul SilesIETF Draft for Remediation of Bots in ISP Networks
2009-09-07Jim ClausingRequest for packets
2009-08-29Guy BruneauImmunet Protect - Cloud and Community Malware Protection
2009-08-18Deborah HaleSecurity Bulletin for ColdFusion and JRun
2009-07-23John BambenekMissouri Passes Breach Notification Law: Gap Still Exists for Banking Account Information
2009-06-27Tony CarothersNew NIAP Strategy on the Horizon
2009-06-11Jason LamDshield Web Honeypot going beta
2009-05-07Deborah HaleBotnet hijacking reveals 70GB of stolen data
2009-04-24John BambenekData Leak Prevention: Proactive Security Requirements of Breach Notification Laws
2009-03-26Mark HofmanWebhoneypot fun
2009-02-17Jason LamDShield Web Honeypot - Alpha Preview Release
2008-12-01Jason LamCall for volunteers - Web Honeypot Project
2008-11-05donald smithBot net hunters get an improved tool from SRI bothunters
2008-11-05donald smithhacking the election
2008-09-09Swa FrantzenThe complaint that's an attack
2008-09-01John BambenekThe Number of Machines Controlled by Botnets Has Jumped 4x in Last 3 Months
2008-08-16Marcus SachsAnother Infected Digital Photo Frame
2008-07-22Mari Nichols‘Cold Boot’ Attack Utility Tools
2008-07-19William SaluskyA twist in fluxnet operations. Enter Hydraflux
2008-07-15Maarten Van HorenbeeckBot controller mimicry
2008-05-25Stephen HallCisco's Response to Rootkit presentation
2008-05-23Mike PoorCisco IOS Rootkit thoughts
2008-05-06Marcus SachsIndustrial Control Systems Vulnerability
2008-04-08Swa FrantzenNotes file viewer vulnerabilities
2008-04-07John BambenekGot Kraken?
2008-04-07John BambenekKraken Technical Details: UPDATED x3
2008-03-13Jason LamRemote File Include spoof!?
2006-11-20Joel EslerMS06-070 Remote Exploit
2006-08-31Swa FrantzenNT botnet submitted
2006-08-31Joel EslerMS06-040 Worm