Binarly REsearch - Multiple Critical Vulnerabilities in Supermicro BMCs
🗣netsec_burn

Aren't we past this stuff yet:


Unfortunately, as usually happens during the disclosure process, the vendor tried to reduce the final impact of the documented vulnerabilities. We believe this to be an extremely wrong position, since end customers will have incorrect information when assessing the severity of a particular update. We encourage system administrators to keep their BMC systems up to date and follow NSA and CISA hardening guidelines.
👤derp6996


🎖@malwr

Exposing Infection Techniques Across Supply Chains and Codebases

This entry delves into threat actors' intricate methods to implant malicious payloads within seemingly legitimate applications and codebases.

https://www.trendmicro.com/en_us/research/23/j/infection-techniques-across-supply-chains-and-codebases.html


🎖@malwr

Qakbot-affiliated actors distribute Ransom Night malware despite infrastructure takedown

The threat actors behind the Qakbot malware have been conducting a campaign since early August 2023 in which they have been distributing Ransom Knight ransomware and the Remcos backdoor via phishing emails.

https://blog.talosintelligence.com/qakbot-affiliated-actors-distribute-ransom/


🎖@malwr

Is it bad to have a major security incident on your résumé? (Seriously I don’t know)

Plus, Qakbot appears to be still active, despite efforts from the FBI and other international law enforcement agencies to disrupt the massive botnet.

https://blog.talosintelligence.com/threat-source-newsletter-oct-5-2023/


🎖@malwr

How can I improve my chances of getting a role in DF?
I've worked for a while as a cop alongside university, and I'm really enjoying investigative work. By the end of the year I will have a BSc in Forensic Investigation, only one of the units was Digital Forensics which I scored a high first in. I've been working in IT for years now doing various repairs (hardware and software), soldering, including data recovery etc.

If I want to join as a Digital Forensics investigator in law enforcement, is there any hope, or have I sabotaged myself by not doing a computer science degree, as unsurprisingly it is a minimum starting point for a few positions I've found. Can accreditations like CompTIA or EC Council give me a better chance at these roles?
🗣Forensiss

That background would get you a job with us and any number of other agencies I know. Guy I work with, an amazing examiner, but his degree was in forensic science. He wanted and applied to be in crime scene, but they saw he had a computer class so they said this is forensics too! 22 years later he's still in the game and schooling us every day. I wish DF did a better job with delineating the positions and levels out there. I feel like a lot of people are thinking everyone is responding to a DDoS and then reverse engineering malware when the real world is vastly different. Some days it's converting VHS tapes to digital to make the examination faster. It's not a super hard program so you don't need to be a computer science degree, but you'll need more than the some decent excel skills and the ability to reboot stuff. Now yes some people are doing amazingly advanced stuff and are Cyber Spooks, but sometimes you're the guy doing a logical on the phone of a victim of insurance fraud. Noble work in the end and you are more than qualified.
👤JerseyJunto

What has your own investigation into DF told you so far?

Just being LE (on its own) doesn't really qualify you for anything DF related.

A college course with one unit in DF doesn't do really that much.Soldering? Haven't used it once in over 23 years.

So, it boils down to how much past the few pages of Google do you look?What can you do that the person next to you can't?

Same as going for Sgt., Lt. or Detective. You get to the boards, how can you articulate your skills to the person wanting to retain you?

Can you withstand having your skills questioned by a competent attorney or judge?

What I hear from people at conferences and boards is that people jump in and want to join the DF world, talk about investigative experience, then don't mention what that experience is. Branch out and talk about your skills to the group and maybe someone here can help guide ya.
👤clarkwgriswoldjr

Do colleges have career centers to help students anymore?
👤MDCDF


🎖@malwr

Preserve Microsoft Teams Messages
Hey everyone,

I was hoping someone could point me in the right direction for preserving Microsoft Teams messages.

Would it be easiest to collect the messages as a .PST via O365 Security & Compliance center then process the .PST in Axiom / Intella? Any other recommendations for preserving / displaying the message threads?

Thanks in advance.
🗣hotsausce01

In terms of preserving my approach would be to export the PST from O365 as you state, generate a hash for the PST and preserve the PST and the hash.


More along the lines of analyzing the data than displaying it -
Once I have the pst I use pffexport https://manpages.ubuntu.com/manpages/xenial/man1/pffexport.1.html
to extract all the data out of the file.
pffexport creates a directory hierarchy that contains a folder for each item in the PST file. Within that folder you find a text or html file with the message, text files with metadata (like the SMTP headers and Outlook headers) and an attachments subfolder with all attachments saved in their native formats (pdf, png, docx, etc.)


I find this approach super useful for analysis. I can use tools like Grep, RipGrepAll or AgentRansack to do quick searches for patterns, or I can write simple perl or python scripts for more complicated bulk analysis (e.g. create a CSV file with the sender, date, recipient, subject and first line of message text for every email/meeting/teams message that has a jpg attachment with EXIF data matching phone model XXXXX).
👤AdCautious851

Message Crawler can convert the .pst files to RSMF. There are two flavors of .psts: Team Channel psts and the Team DMs from the personal mailbox for each user. I am still testing Message Crawler via the trial version (just download the program from their website).

It's a bit confusing going through the data in Message Crawler, but the tool definitely does the RSMF conversion job pretty well. I am not sure if it threads conversations together. I have not reviewed the many output options, yet. I'm sure someone can answer that. Message Crawler has YouTube channel with demonstrations, as well.
👤zero-skill-samus


🎖@malwr

Discarded, not destroyed: Old routers reveal corporate secrets

When decommissioning their old hardware, many companies 'throw the baby out with the bathwater'

https://www.welivesecurity.com/2023/04/18/discarded-not-destroyed-old-routers-reveal-corporate-secrets/


🎖@malwr

Operation Jacana: Foundling hobbits in Guyana

ESET researchers discovered a cyberespionage campaign against a governmental entity in Guyana

https://www.welivesecurity.com/en/eset-research/operation-jacana-spying-guyana-entity/


🎖@malwr

Honeypot agent for malware curation with Siphon
I made this post about a tool a created to fetch the latest samples from threat intelligence platforms.

The tool has had a major upgrade, and now allows you to generate agents to deploy on honeypots, that can monitor folders for file activity (writes, creations).

Agents have exposed API endpoints to query and download indexed samples from, and are interacted with via Mutual TLS - allowing you to interact with it just how you'd interact with other integrations. If you try it out on your infrastructure, feel free to feedback on GitHub!

https://github.com/pygrum/siphon


The 1st sample in the image above represents an example file written to disk in a folder monitored by a Windows agent.
🗣pygrum


🎖@malwr