Diaries by Keyword - SANS Internet Storm Center

Handler on Duty: Xavier Mertens

Threat Level: green

Date	Author	Title
SPAMASSASIN MILTER PLUGIN REMOTE ROOT ATTACK
2010-03-15	Adrien de Beaupre	Spamassassin Milter Plugin Remote Root Attack
SPAMASSASIN
2010-03-15/a>	Adrien de Beaupre	Spamassassin Milter Plugin Remote Root Attack
MILTER
2010-03-15/a>	Adrien de Beaupre	Spamassassin Milter Plugin Remote Root Attack
PLUGIN
2021-07-08/a>	Xavier Mertens	Using Sudo with Python For More Security Controls
2020-10-11/a>	Didier Stevens	Analyzing MSG Files With plugin_msg_summary
2013-05-23/a>	Adrien de Beaupre	MoVP II
2013-03-02/a>	Scott Fendley	Apple Blocks Older Insecure Versions of Flash Player
2011-01-10/a>	Manuel Humberto Santander Pelaez	VirusTotal VTzilla firefox/chrome plugin
2010-08-23/a>	Manuel Humberto Santander Pelaez	Firefox plugins to perform penetration testing activities
2010-03-15/a>	Adrien de Beaupre	Spamassassin Milter Plugin Remote Root Attack
2009-10-17/a>	Rick Wanner	Mozilla disables Microsoft plug-ins?
2009-10-16/a>	Adrien de Beaupre	Disable MS09-054 patch, or Firefox Plugin?
2009-10-08/a>	Johannes Ullrich	Firefox Plugin Collections
2009-03-10/a>	Swa Frantzen	Browser plug-ins, transparent proxies and same origin policies
REMOTE
2024-06-17/a>	Xavier Mertens	New NetSupport Campaign Delivered Through MSIX Packages
2022-10-07/a>	Xavier Mertens	Critical Fortinet Vulnerability Ahead
2021-05-14/a>	Xavier Mertens	"Open" Access to Industrial Systems Interface is Also Far From Zero
2021-02-13/a>	Guy Bruneau	vSphere Replication updates address a command injection vulnerability (CVE-2021-21976) - https://www.vmware.com/security/advisories/VMSA-2021-0001.html
2020-09-29/a>	Xavier Mertens	Managing Remote Access for Partners & Contractors
2020-08-22/a>	Guy Bruneau	Remote Desktop (TCP/3389) and Telnet (TCP/23), What might they have in Common?
2019-09-24/a>	Xavier Mertens	Huge Amount of remotewebaccess.com Sites Found in Certificate Transparency Logs
2017-11-25/a>	Guy Bruneau	Exim Remote Code Exploit
2015-10-12/a>	Guy Bruneau	Critical Vulnerability in Multiple Cisco Products - Apache Struts 2 Command Execution http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2
2013-09-18/a>	Rob VandenBrink	Cisco DCNM Update Released
2013-02-16/a>	Lorna Hutcheson	Fedora RedHat Vulnerabilty Released
2012-08-22/a>	Adrien de Beaupre	Apple Remote Desktop update fixes no encryption issue
2012-03-16/a>	Russ McRee	MS12-020 RDP vulnerabilities: Patch, Mitigate, Detect
2011-11-28/a>	Tom Liston	A Puzzlement...
2011-11-19/a>	Pedro Bueno	Dragon Research Group (DRG) announced the white paper entitled "VNC: Threats and Countermeasures" : https://dragonresearchgroup.org/insight/vnc-tac.html
2011-08-11/a>	Guy Bruneau	BlackBerry Enterprise Server Critical Update
2010-12-19/a>	Raul Siles	Intel's new processors have a remote kill switch (Anti-Theft 3.0)
2010-10-19/a>	Rob VandenBrink	Cyber Security Awareness Month - Day 19 - Remote User VPN Tunnels - to Split or not to Split?
2010-10-19/a>	Rob VandenBrink	Cyber Security Awareness Month - Day 19 - Remote User VPN Access – Are things getting too easy, or too hard?
2010-10-19/a>	Rob VandenBrink	Cyber Security Awareness Month - Day 19 - VPN and Remote Access Tools
2010-10-19/a>	Rob VandenBrink	Cyber Security Awareness Month - Day 19 - Remote Access Tools
2010-05-12/a>	Rob VandenBrink	Adobe Shockwave Update
2010-03-15/a>	Adrien de Beaupre	Spamassassin Milter Plugin Remote Root Attack
2010-03-10/a>	Rob VandenBrink	Microsoft Security Advisory 981374 - Remote Code Execution Vulnerability for IE6 and IE7
2010-02-02/a>	Guy Bruneau	Cisco Secure Desktop Remote XSS Vulnerability
2009-11-14/a>	Adrien de Beaupre	Microsoft advisory for Windows 7 / Windows Server 2008 R2 Remote SMB DoS Exploit released
2009-11-12/a>	Rob VandenBrink	Windows 7 / Windows Server 2008 Remote SMB Exploit
2008-05-06/a>	Marcus Sachs	Industrial Control Systems Vulnerability
2008-03-13/a>	Jason Lam	Remote File Include spoof!?
2006-11-20/a>	Joel Esler	MS06-070 Remote Exploit
ROOT
2024-10-09/a>	Xavier Mertens	From Perfctl to InfoStealer
2017-11-28/a>	Xavier Mertens	Apple High Sierra Uses a Passwordless Root Account
2017-11-11/a>	Xavier Mertens	Keep An Eye on your Root Certificates
2016-02-26/a>	Xavier Mertens	Quick Audit of *NIX Systems
2014-07-28/a>	Johannes Ullrich	Interesting HTTP User Agent "chroot-apach0day"
2013-08-13/a>	Swa Frantzen	Microsoft security advisories: RDP and MD5 deprecation in Microsoft root certificates
2013-02-21/a>	Bojan Zdrnja	SSHD rootkit in the wild
2011-12-06/a>	Pedro Bueno	The RedRet connection...
2011-11-22/a>	Pedro Bueno	Updates on ZeroAccess and BlackHole front...
2011-07-02/a>	Pedro Bueno	Bootkits, they are back at full speed...
2011-02-14/a>	Richard Porter	Anonymous Damage Control Anybody?
2010-11-18/a>	Chris Carboni	Stopping the ZeroAccess Rootkit
2010-10-03/a>	Adrien de Beaupre	H went down.
2010-03-15/a>	Adrien de Beaupre	Spamassassin Milter Plugin Remote Root Attack
2010-02-19/a>	Mark Hofman	MS10-015 may cause Windows XP to blue screen (but only if you have malware on it)
2008-05-25/a>	Stephen Hall	Cisco's Response to Rootkit presentation
2008-05-23/a>	Mike Poor	Cisco IOS Rootkit thoughts
ATTACK
2024-01-08/a>	Jesse La Grew	What is that User Agent?
2022-08-10/a>	Johannes Ullrich	And Here They Come Again: DNS Reflection Attacks
2022-03-26/a>	Guy Bruneau	Is buying Cyber Insurance a Must Now?
2022-02-03/a>	Johannes Ullrich	Keeping Track of Your Attack Surface for Cheap
2021-02-01/a>	Rob VandenBrink	Taking a Shot at Reverse Shell Attacks, CNC Phone Home and Data Exfil from Servers
2019-08-25/a>	Guy Bruneau	Are there any Advantages of Buying Cyber Security Insurance?
2019-07-20/a>	Guy Bruneau	Re-evaluating Network Security - It is Increasingly More Complex
2017-09-06/a>	Adrien de Beaupre	Modern Web Application Penetration Testing , Hash Length Extension Attacks
2016-11-02/a>	Rob VandenBrink	What Does a Pentest Look Like?
2016-06-03/a>	Tom Liston	MySQL is YourSQL
2015-03-18/a>	Daniel Wesemann	Pass the hash!
2015-02-19/a>	Daniel Wesemann	DNS-based DDoS
2014-02-26/a>	Russ McRee	Ongoing NTP Amplification Attacks
2014-02-17/a>	Chris Mohan	NTP reflection attacks continue
2013-12-02/a>	Richard Porter	Reports of higher than normal SSH Attacks
2013-08-19/a>	Guy Bruneau	Business Risks and Cyber Attacks
2013-07-27/a>	Scott Fendley	Defending Against Web Server Denial of Service Attacks
2013-07-13/a>	Lenny Zeltser	Decoy Personas for Safeguarding Online Identity Using Deception
2012-10-05/a>	Richard Porter	Reports of a Distributed Injection Scan
2011-12-28/a>	Daniel Wesemann	Hash collisions vulnerability in web servers
2011-12-01/a>	Mark Hofman	SQL Injection Attack happening ATM
2011-09-28/a>	Richard Porter	All Along the ARP Tower!
2011-01-23/a>	Richard Porter	Crime is still Crime!
2010-12-23/a>	Mark Hofman	White house greeting cards
2010-08-16/a>	Raul Siles	DDOS: State of the Art
2010-08-15/a>	Manuel Humberto Santander Pelaez	Obfuscated SQL Injection attacks
2010-08-13/a>	Tom Liston	The Strange Case of Doctor Jekyll and Mr. ED
2010-03-15/a>	Adrien de Beaupre	Spamassassin Milter Plugin Remote Root Attack
2010-01-29/a>	Johannes Ullrich	Analyzing isc.sans.org weblogs, part 2, RFI attacks
2009-11-11/a>	Rob VandenBrink	Layer 2 Network Protections against Man in the Middle Attacks
2009-08-28/a>	Adrien de Beaupre	WPA with TKIP done
2009-06-04/a>	Raul Siles	Targeted e-mail attacks asking to verify wire transfer details
2009-04-20/a>	Jason Lam	Digital Content on TV
2009-04-02/a>	Bojan Zdrnja	JavaScript insertion and log deletion attack tools
2009-03-20/a>	donald smith	Stealthier then a MBR rootkit, more powerful then ring 0 control, it’s the soon to be developed SMM root kit.
2009-02-25/a>	Swa Frantzen	Targeted link diversion attempts
2009-01-30/a>	Mark Hofman	Request for info - Scan and webmail
2009-01-18/a>	Maarten Van Horenbeeck	Targeted social engineering
2008-12-03/a>	Andre Ludwig	New ISC Poll! Has your organization suffered a DDoS (Distributed Denial of Service) attack in the last year?
2008-07-09/a>	Johannes Ullrich	Unpatched Word Vulnerability
2008-05-26/a>	Marcus Sachs	Predictable Response
2008-03-27/a>	Maarten Van Horenbeeck	Guarding the guardians: a story of PGP key ring theft

SPAMASSASIN MILTER PLUGIN REMOTE ROOT ATTACK

SPAMASSASIN

MILTER

PLUGIN

REMOTE

ROOT

ATTACK