An RTF phish, (Sat, Jan 20th)

I received another RTF file (with .doc extension) via email. Let&#;x26;#;39;s take a look with rtfdump:

Posted on: 20 January 2018 | 4:36 pm

Followup to IPv6 brute force and IPv6 blocking, (Fri, Jan 19th)

My diary earlier this week led to some good discussion in the comments and on twitter. I want to, first off, apologize for not responding as much or as quickly as I would have liked, I&#;x26;#;39;ve actually been ill most of this week since posting the previous diary (and signing up for this slot as handler on duty). Having said that, the discussion got me thinking about fail2ban (and denyhosts) and how I&#;x26;#;39;ve used them over the years, which brings me to a number of points I&#;x26;#;39;d like to make and some further discussion I hope we can have. As rightly pointed out, I am sure that the brute forcing I am seeing is not from any scanning but because I setup an IPv6 address in DNS for my wordpress site and the preference for IPv6 over IPv4 if both DNS returns both.. In fact, the attempts to login as &#;x26;#;39;jim&#;x26;#;39; show that they have at least scraped some content off the site so they thought they could guess at a valid username (in fact, &#;x26;#;39;jim&#;x26;#;39; is not a valid username on the site, but that is their problem, not mine).

Posted on: 19 January 2018 | 2:52 pm

Comment your Packet Captures!, (Thu, Jan 18th)

When you are investigating a security incident, a key element is to take notes and to document as much as possible. There is no “best” way to take notes, some people use electronic solutions while others are using good old paper and pencil. Just keep in mind: it must be properly performed if your notes will be used as evidence later… With investigations, there are also chances to you will have to deal with packet captures. Many security tools can record samples of network traffic or you can maybe need a full-packet capture[1]. Some tools, like Moloch, allow you to “tag” some conversations. Later, you can search for them to find back interesting traffic:

Posted on: 18 January 2018 | 6:28 am

Reviewing the spam filters: Malspam pushing Gozi-ISFB, (Wed, Jan 17th)


Posted on: 17 January 2018 | 4:51 pm

Are you watching for brute force attacks on IPv6?, (Tue, Jan 9th)

For a number of years, I&#;x26;#;39;ve had a personal blog that for the last 2 or 3 years has been pretty much dormant. A few years ago, I found a deal for a VPS instance for $5/month and decided to host my blog there using WordPress. One of the nice feature of this particular VPS setup is that it has good IPv6 connectivity, so I registered the IPv6 address in DNS. I use fail2ban to protect ssh against brute forcing, but I wanted to also protect my WordPress site, so I configured it to log all authentication attempts so that I could have fail2ban watch that log. For much of the last year, I&#;x26;#;39;ve noticed something really odd. The vast majority of attempts against my WordPress site have come over IPv6. Here is a typical summary from the log (thank you logwatch, note, the IPs have NOT been changed to protect the guilty).

Posted on: 16 January 2018 | 11:13 am

Decrypting malicious PDFs with the key, (Mon, Jan 15th)

Sometimes malicious documents are encrypted, like PDFs. If you know the user password, you can use a tool like QPDF to decrypt it. If it&#;x26;#;39;s encypted for DRM (with an owner password), QPDF can decrypt it without you knowing the owner password.

Posted on: 15 January 2018 | 5:12 pm