Baanboard.com

Go Back   Baanboard.com > News > RSS Newsfeeds > Sources

User login

Frontpage Sponsor

Main

Poll
What version of Baan have you installed
Baan IV
35%
FP3
4%
FP4
0%
FP5
0%
FP6
0%
FP7
4%
10.2 (incl. 10.2.1)
0%
10.3
9%
10.4
17%
10.5
26%
Other
4%
Total votes: 23

Baanboard at LinkedIn


Reference Content

 
SANS Internet Storm Center
Syndicate content SANS Internet Storm Center, InfoCON: green
SANS Internet Storm Center - Cooperative Cyber Security Monitor
Updated: 36 min 39 sec ago

Followup to IPv6 brute force and IPv6 blocking, (Fri, Jan 19th)

January 19, 2018 - 9:52pm
My diary earlier this week led to some good discussion in the comments and on twitter. I want to, first off, apologize for not responding as much or as quickly as I would have liked, I've actually been ill most of this week since posting the previous diary (and signing up for this slot as handler on duty). Having said that, the discussion got me thinking about fail2ban (and denyhosts) and how I've used them over the years, which brings me to a number of points I'd like to make and some further discussion I hope we can have. As rightly pointed out, I am sure that the brute forcing I am seeing is not from any scanning but because I setup an IPv6 address in DNS for my wordpress site and the preference for IPv6 over IPv4 if both DNS returns both.. In fact, the attempts to login as 'jim' show that they have at least scraped some content off the site so they thought they could guess at a valid username (in fact, 'jim' is not a valid username on the site, but that is their problem, not mine).
Categories: Security

Comment your Packet Captures!, (Thu, Jan 18th)

January 18, 2018 - 1:28pm
When you are investigating a security incident, a key element is to take notes and to document as much as possible. There is no “best” way to take notes, some people use electronic solutions while others are using good old paper and pencil. Just keep in mind: it must be properly performed if your notes will be used as evidence later… With investigations, there are also chances to you will have to deal with packet captures. Many security tools can record samples of network traffic or you can maybe need a full-packet capture[1]. Some tools, like Moloch, allow you to “tag” some conversations. Later, you can search for them to find back interesting traffic:
Categories: Security

Reviewing the spam filters: Malspam pushing Gozi-ISFB, (Wed, Jan 17th)

January 17, 2018 - 11:51pm
Introduction
Categories: Security

Are you watching for brute force attacks on IPv6?, (Tue, Jan 9th)

January 16, 2018 - 6:13pm
For a number of years, I've had a personal blog that for the last 2 or 3 years has been pretty much dormant. A few years ago, I found a deal for a VPS instance for $5/month and decided to host my blog there using WordPress. One of the nice feature of this particular VPS setup is that it has good IPv6 connectivity, so I registered the IPv6 address in DNS. I use fail2ban to protect ssh against brute forcing, but I wanted to also protect my WordPress site, so I configured it to log all authentication attempts so that I could have fail2ban watch that log. For much of the last year, I've noticed something really odd. The vast majority of attempts against my WordPress site have come over IPv6. Here is a typical summary from the log (thank you logwatch, note, the IPs have NOT been changed to protect the guilty).
Categories: Security

Decrypting malicious PDFs with the key, (Mon, Jan 15th)

January 16, 2018 - 12:12am
Sometimes malicious documents are encrypted, like PDFs. If you know the user password, you can use a tool like QPDF to decrypt it. If it's encypted for DRM (with an owner password), QPDF can decrypt it without you knowing the owner password.
Categories: Security

Peeking into Excel files, (Sun, Jan 14th)

January 14, 2018 - 10:42pm
Since late 2014, malicious Office documents with macros appeared in the wild again. Malware authors don't always rely on VBA macros to execute their payload, exploits and feature abuse are part of their bag of tricks too.
Categories: Security

Flaw in Intel's Active Management Technology (AMT), (Sat, Jan 13th)

January 13, 2018 - 4:11am
It has been a rough week for Intel. Several media outlets are are reporting that researchers at F-Secure hav discovered a flaw in Intel's Active Management Technology (AMT) which is in most business laptops. AMT is the technology which is used by corporations to remotely manage their  deployed laptops.
Categories: Security

Those pesky registry keys required by critical security patches, (Fri, Jan 12th)

January 12, 2018 - 2:02pm
With the “storm” around Meldown and Spectre slowly winding down, I would like to remind everyone on registry changes that are required by the latest patches released by Microsoft.
Categories: Security

Mining or Nothing!, (Thu, Jan 11th)

January 11, 2018 - 8:37am
Cryptocurrencies mining has been a trending attack for a few weeks. Our idling CPUs are now targeted by bad guys who are looked to generate some extra revenue by abusing our resources. Other fellow handlers already posted diaries about this topic. Renato found a campaign based on a WebLogic exploit[1] and Jim detected a peak of activity on port %%port:3333%%[2]. Yesterday, while reviewed alerts generated by my hunting scripts, I found an interesting snippet of code on Pastebin. Here is a copy of the script with some added comments in blue:
Categories: Security

GitHub InfoSec Threepeat: HELK, ptf, and VulnWhisperer, (Wed, Jan 10th)

January 10, 2018 - 7:20am
There are numerous and exciting information security-related projects on GitHub; one can dive quickly down the rabbit hole, never to be seen again, in an effort to identify the best of breed for use in their security practices. In the last three days, three separate projects have hit my radar screen via social media that I thought readers might find intriguing and likely beneficial. I'm listing the projects in alphabetic order, not order of preference, each project represents a unique discipline and opportunity. 
Categories: Security

Microsoft January 2018 Patch Tuesday, (Tue, Jan 9th)

January 10, 2018 - 2:38am
Microsoft, as expected included last weeks Meltdown/Spectre update in this months patch Tuesday. But note that in addition to these two flaws, we have a number of other "traditional" privilege escalation and even remote code execution flaws that are probably easier to exploit and should be treated probably with a higher priority. Regardless, I doubt that as many people will work overtime for these run of the mill flaws. For example:
Categories: Security

What is going on with port 3333?, (Tue, Jan 9th)

January 10, 2018 - 1:10am
We've seen a spike over the last day or so in reports of apparent scanning on TCP %%port:3333%%. I have serious doubts that anyone is actually looking for DEC Notes which is the registered IANA use for this port. While we're getting our own honeypots set up, I figured I'd ask our readers, do you have packets and/or any idea what is going on here? Please let us know in the comments or via our contact page. Thanx in advance.
Categories: Security

All times are GMT +2. The time now is 22:51.


©2001-2017 - Baanboard.com - Baanforums.com