New Stimulus bill includes .gov legislation to help states & localities move to more secure top-level domain
🗣F1rstxLas7

Just one of a dozen unrelated things crammed into a whopping 5500 pages of legislation that's supposedly for giving all Americans a desperately needed and incredibly helpful checks notes $600.

Mandating states to use .gov is good. But should really be in a separate piece of legislation...
👤Barnacle_Ed

The new stimulus bill also included language to make illegal streaming of digital content a felony.

source
👤intoxicatednoob

Fucking finally, now I might be able to see Florida's government websites stop hosting on .com's with logos that say .org.
👤hi117


🎖@malwr

Identify Phishing Emails
Hi all,

Does anyone have an automated way of identifying a phishing email? I have a couple of PSTs and I’m trying to find the one or two emails that a user clicked on when they gave up their creds. (User doesn’t know which email it was.)

Short of manually going through the emails in the timeframe of interest, is there a tool or better approach to finding this needle in the haystack?

Thanks in advance!
🗣hotsausce01

Theoretically: it may be possible to rig an antimalware application on some non-standard port that checks incoming mail and classifies it by adding a mail header, or adding 'SPAM' to the subject line or ... . Then, push each individual mail through that software, and check the result. Unless there's good documentation, it would require considerable lab testing to ensure it does the needed job -- which is a bit of a drawback.
👤athulin1

Look for emails that didn't come from your organization, yet mentions it. Phishers often try to masquerade as someone higher up in the company asking for something, (and often like something written on a personal device), or it tries to look like an internal email.

Words to look for include "urgent" and "important", because getting someone to respond without thinking is key.

Tl;dr: run a search for mentions is the company, higher ups, keywords, and external links, in emails that originated outside the organisation.
👤h4xrk1m

I’m not great with automation, but...

Analyze the header with mxtoolbox

Check DMARC

Run any URLs through urlscan.io

Use a tool like HashIt to hash any attachments

Upload those hashes to something like VirusTotal

As for how to automate all of that from scratch, I’m really of no help. But those are some things I can think of to at least get you information that will help identify malicious emails. And those tools are all free, to my knowledge.
👤Great-Big-Pwner


🎖@malwr

Reverse DNS lookup is different than forward" DNS lookup
Reverse DNS: example.com \-> 12.345.678.910

Forward DNS: 12.345.678.910 -> nc1234.server.net

example.com is a website hosted into a VPS.

It has an A record pointing towards its IP.

nc1234.server.net display nothing but the logo of the hosting company.

It also has an A record pointing towards its IP.

What I am trying to understand is

1. Why and How the IP isn't forwarding me towards example.com but only towards nc1234.server.net ?

Thanks.
🗣Capeya92

I'm not understanding your use of "forward" and "reverse".

Generally speaking, DNS is used to lookup an IP address from a presented hostname. To do this, it does an 'A' (IPv4 Address) or 'AAAA' (IPv6 Address) request to a DNS server, that does the needful (either via recursion to the SOA for the domain, or via a cache of a previous SOA look-up that has not expired). An A/AAAA record can have multiple IP addresses associated with it.

A 'PTR' (Pointer) request is done to lookup a domain name for a given IP address. The same recursion/caching is used, except for PTR records, it does some Kung Fu on the IP address (reversing the octets) and sends it to "in-addr.arpa." domain. Unlike A records, a PTR record can only point to one Fully-Qualified Domain Name (FQDN).

The person who owns the in-addr.arpa. zone for a particular IP subnet isn't required to be (and rarely is) the same person who owns a domain name that points to that IP. That is, A <-> PTR are not tightly bound. A whole industry (IPAM - IP Address Management) has been created to solve that problem.

Complicating this are CNAME (Cannonical Name) records, which are FQDN's that point to other FQDN's. When you ask for an A/AAAA record, but the SOA for the domain only has a CNAME record for it, it will generally return the FQDN it points to, plus the A/AAAA record of the pointed-to FQDN.

TL;DR: PTR records (that do IP Address->FQDN) can only point to one FQDN. In this case, the subnet owner has pointed their PTR records for that IP to nc1234.server.net. Anyone can point A/AAAA/CNAME records at anything, which is why example.com resolves to the IP address.
👤Ottonym

The two records have no relationship to one another. The owner of a domain can point it to any IP she wishes. The owner of an IP can set the reverse record to any address they wish. Changing one has no effect on the other. Could be any number of reasons for the disparity, form different owners to sloppy records maintenance.
👤Benoit_In_Heaven


🎖@malwr

Researchers found that accelerometer data (collected by smartphone apps without user permission) can be used to infer parameters such as user height & weight, age & gender, tobacco and alcohol consumption, driving style, location, and more.
🗣bayashad

Overview of all information categories that can be inferred from accelerometer data: https://riot.weizenbaum-institut.de/blog/wp-content/uploads/2020/07/neu-diagramm.png
👤bayashad


🎖@malwr

Another Humble Bundle: Cybersecurity & Cryptography by Wiley


Every time they release two books that are on my list this saves me so much money. My hacking skills are gonna get so good
👤tdavetech


🎖@malwr

MITRE ATT&CK for Kubernetes: 4+1 Threat Vectors for the Defense Evasion Tactic
Read the whole article.

TL;DR

The defense evasion tactic consists of techniques that are used by attackers to avoid detection and stay under the radar by concealing any evidence of their presence.
Tactic #1: Clear container logs - deleting relevant logs from an application or an operating system that would record traces of an attacker’s activity. Mitigating Tactic #1 by limiting or denying completely the host mounts, and by using a real-time, automated analysis tool for Kubernetes audit logs.
Tactic #2: Deleting Kubernetes Events - Deleting these events reduces the risk of detecting security-related activities performed by the attacker. Mitigating Tactic #2 by configuring continuous audit logging and preferably exporting it to an external SIEM tool and the likes of it.
Tactics #3: Container name similarity - Attackers can create pods with a random suffix in their names, hiding the presence of unauthorized pods within a cluster. Mitigate Tactic #3 with Role-Based Access Control (RBAC) configurations, keeping the principle of least privilege.
Tactic #4: Connect from proxy server - Proxy servers and anonymous networks such as TOR are often used by attackers to hide their origin IP and initiate communication channels with applications or directly to the API server. Mitigate Tactic #4 by restricting network access to the Kubernetes API server and implementing proper firewall rules at the cloud provider level.
Bonus Tactic not in MITRE ATT&CK: DNS Resolution - A common practice for establishing covert channels is to exploit inherent weaknesses in the DNS protocol messages exchange. Monitor DNS activity within your Kubernetes cluster to detect and potentially prevent C2 channels from establishing covert channels.
🗣alcideio


🎖@malwr

Understanding "Solorigate"'s Identity IOCs
🗣Wireless_Life

The Solarwinds attack is an ongoing investigation, and teams at Microsoft continue to act as first responders to these attacks. The following post shares how they leverage threat intelligence and monitor for new indicators that could signal attacker activity.
👤Wireless_Life


🎖@malwr

🚨 CVE-2020-28641
In Malwarebytes Free 4.1.0.56, a symbolic link may be used delete an arbitrary file on the system by exploiting the local quarantine system.

🎖@cveNotify

DirectX creator Eric Engstrom dies aged 55, leaving behind a game-changing legacy
🗣instilledbee

According to wikipedia, he died from complications from dropping a monitor on his foot. Talk about unlucky. Damn.
👤turniphat


🎖@malwr

BlueTeam Online Training
I’m looking to have continuous training for a blue team and I’m curious as to what the group would recommend. Outside of Cybrary and SANS what do you recommend?

I’m personally interested in core disciplines and not aimed towards a certification. Also, being continuous is also helpful.
🗣nullsku

https://wildwesthackinfest.com/training-schedule/
👤Sho_nuff_

I haven’t used it but ISACA’s training looks solid. Was gonna try it before training budget was cut.

Maybe you can do a trial to see if you like it.

https://www.isaca.org/training-and-events/cybersecurity
👤Just_saying_brah


🎖@malwr

Reversing APT-28 64-bit Keylogger [Zebrocy Nim TLP: White ](https://0xthreatintel.medium.com/reversing-apt-28-64-bit-keylogger-zebrocy-nim-tlp-white-a77033f5c36b)
🗣digicat


🎖@malwr

Zelda Hit Detection - Behind the Code [YouTube](https://www.youtube.com/watch?v=FBk-QkzMeIk)
🗣rolfr


🎖@malwr