Updated: 2024-12-31 07:09:10
While most of us are preparing the switch to a new year (If it's already the case for you: Happy New Year!), Attackers never stop and implement always new tricks to defeat our security controls. For a long time now, we have been flooded by sextortion emails. This is a kind of blackmail where someone threatens to share explicit images or videos unless the victim meets their demands. Even today, I receive regularly some of them.
Updated: 2024-12-27 10:25:02
It is again the time of the year when scammers are asking to verify banking information, whether it is credit cards, bank card, package shipping information, winning money, etc. Last night I received a text message to verify a credit card, it is case a Bank of Montreal (BMO) credit card.
Updated: 2024-12-26 00:14:28
By default, DShield Honeypots [1] collect firewall, web and cowrie (telnet/ssh) [2] data and log them on the local filesystem. A subset of this data is reported to the SANS Internet Storm Center (ISC) where it can be used by anyone [3]. A common question that comes up from new users is whether there is any benefit to collecting PCAP data from the honeypots if the active services are already being logged. One example I often give of a useful benefit of having PCAPs is HTTP POST data. This data is not currently captured within the web honeypot logs, but can be seen within the PCAP data.
Updated: 2024-12-25 07:58:25
Occasionaly I decompile Python code, with decompilers written in Python. Recently I discovered Decompyle++, a Python disassembler & decompiler written in C++.
Updated: 2024-12-23 06:25:57
My last investigation is a file called “Albertsons_payment.GZâ€, received via email. The file looks like an archive but is identified as a picture by TrID:
Updated: 2024-12-20 11:01:29
Christmas is at our doors and Attackers use the holiday season to deliver always more and more gifts into our mailboxes&#;x26;#;x21; I found this interesting file this morning: "christmas&#;x26;#;x5f;slab.pdf.lnk"&#;x26;#;x5b;1&#;x26;#;x5d;. Link files (.lnk) are a classic way to execute something malicious on the victim&#;x26;#;39;s computer but the technique used here is interesting.
Updated: 2024-12-20 02:00:02
Christmas is at our doors and Attackers use the holiday season to deliver always more and more gifts into our mailboxes&#;x26;#;x21; I found this interesting file this morning: "christmas&#;x26;#;x5f;slab.pdf.lnk"&#;x26;#;x5b;1&#;x26;#;x5d;. Link files (.lnk) are a classic way to execute something malicious on the victim&#;x26;#;39;s computer but the technique used here is interesting.
