BROWSER IN THE BROWSER |
| 2023-02-16 | Jan Kopriva | HTML phishing attachment with browser-in-the-browser technique |
BROWSER |
| 2023-04-13/a> | Johannes Ullrich | HTTP: What's Left of it and the OCSP Problem |
| 2023-02-16/a> | Jan Kopriva | HTML phishing attachment with browser-in-the-browser technique |
| 2022-08-23/a> | Xavier Mertens | Who's Looking at Your security.txt File? |
| 2022-06-22/a> | Xavier Mertens | Malicious PowerShell Targeting Cryptocurrency Browser Extensions |
| 2022-05-17/a> | Xavier Mertens | Use Your Browser Internal Password Vault... or Not? |
| 2020-06-11/a> | Xavier Mertens | Anti-Debugging JavaScript Techniques |
| 2018-09-07/a> | Xavier Mertens | Crypto Mining in a Windows Headless Browser |
| 2018-05-30/a> | Bojan Zdrnja | The end of the lock icon |
| 2017-12-03/a> | Xavier Mertens | StartSSL: Termination of Services is Now Scheduled |
| 2015-05-20/a> | Brad Duncan | Logjam - vulnerabilities in Diffie-Hellman key exchange affect browsers and servers using TLS |
| 2013-12-11/a> | Johannes Ullrich | Browser Fingerprinting via SSL Client Hello Messages |
| 2013-09-13/a> | Rob VandenBrink | Update for Safari to version 5.1.10 is out - http://support.apple.com/kb/HT5921 |
| 2012-07-23/a> | Johannes Ullrich | Most Anti-Privacy Web Browsing Tool Ever? |
| 2012-06-04/a> | Rob VandenBrink | Browsers and SSL Security - a Race to the Bottom ! |
| 2012-05-22/a> | Johannes Ullrich | The "Do Not Track" header |
| 2011-08-26/a> | Daniel Wesemann | User Agent 007 |
| 2011-06-09/a> | Richard Porter | One Browser to Rule them All? |
| 2011-04-10/a> | Raul Siles | Recent security enhancements in web browsers (e.g. Google Chrome) |
| 2011-03-23/a> | Johannes Ullrich | Firefox 4 Security Features |
| 2011-01-27/a> | Chris Carboni | Opera Updates |
| 2010-12-18/a> | Raul Siles | Google Chrome (Stable and Beta) have been updated to 8.0.552.224 for all platforms (Chrome OS too). http://bit.ly/fW04cr |
| 2010-10-12/a> | Adrien de Beaupre | New version of Opera- Opera 10.63 is a recommended upgrade offering security and stability enhancements: http://www.opera.com/browser/download/ |
| 2010-06-23/a> | Scott Fendley | Opera Browser Update |
| 2010-05-19/a> | Jason Lam | EFF paper about browser tracking |
| 2010-02-03/a> | Rob VandenBrink | Support for Legacy Browsers |
| 2010-01-27/a> | Raul Siles | Google Chrome v4.0.249.78 Released: http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html |
| 2009-07-17/a> | John Bambenek | Cross-Platform, Cross-Browser DoS Vulnerability |
| 2009-03-19/a> | Mark Hofman | Browsers Tumble at CanSecWest |
| 2009-03-04/a> | Deborah Hale | Firefox Releases version 3.0.7 |
| 2008-12-17/a> | donald smith | Opera 9.6.3 released with security fixes |
| 2008-12-12/a> | Swa Frantzen | Browser Security Handbook |
| 2008-08-20/a> | Adrien de Beaupre | From the mailbag, Opera 9.52... |
| 2008-06-19/a> | William Stearns | Firefox vunerability |
| 2008-04-18/a> | John Bambenek | EV SSL Certificates - Just once, why can't one of our poorly considered quick fixes work? |
| 2008-03-24/a> | Raul Siles | Next-generation Web browsers? |
IN |
| 2025-04-02/a> | Guy Bruneau | Exploring Statistical Measures to Predict URLs as Legitimate or Intrusive [Guest Diary] |
| 2025-03-26/a> | Jesse La Grew | [Guest Diary] Leveraging CNNs and Entropy-Based Feature Selection to Identify Potential Malware Artifacts of Interest |
| 2025-03-20/a> | Johannes Ullrich | Some new Data Feeds, and a little "incident". |
| 2025-03-18/a> | Xavier Mertens | Python Bot Delivered Through DLL Side-Loading |
| 2025-03-12/a> | Guy Bruneau | File Hashes Analysis with Power BI from Data Stored in DShield SIEM |
| 2025-03-06/a> | Guy Bruneau | DShield Traffic Analysis using ELK |
| 2025-02-24/a> | Jim Clausing | Unfurl v2025.02 released |
| 2025-02-20/a> | Guy Bruneau | Using ES|QL in Kibana to Queries DShield Honeypot Logs |
| 2025-02-14/a> | Xavier Mertens | Fake BSOD Delivered by Malicious Python Script |
| 2025-02-13/a> | Guy Bruneau | DShield SIEM Docker Updates |
| 2025-02-12/a> | Yee Ching Tok | An ontology for threats, cybercrime and digital forensic investigation on Smart City Infrastructure |
| 2025-02-06/a> | Xavier Mertens | The Unbreakable Multi-Layer Anti-Debugging System |
| 2025-02-05/a> | Johannes Ullrich | Phishing via "com-" prefix domains |
| 2025-01-29/a> | Xavier Mertens | From PowerShell to a Python Obfuscation Race! |
| 2025-01-28/a> | Xavier Mertens | Fileless Python InfoStealer Targeting Exodus |
| 2025-01-21/a> | Johannes Ullrich | Geolocation and Starlink |
| 2025-01-18/a> | Jim Clausing | New tool: immutable.py |
| 2025-01-17/a> | Guy Bruneau | Leveraging Honeypot Data for Offensive Security Operations [Guest Diary] |
| 2025-01-15/a> | Yee Ching Tok | The Curious Case of a 12-Year-Old Netgear Router Vulnerability |
| 2025-01-09/a> | Guy Bruneau | Examining Redtail Analyzing a Sophisticated Cryptomining Malware and its Advanced Tactics [Guest Diary] |
| 2025-01-07/a> | Yee Ching Tok | PacketCrypt Classic Cryptocurrency Miner on PHP Servers |
| 2025-01-06/a> | Xavier Mertens | Make Malware Happy |
| 2024-12-27/a> | Guy Bruneau | Phishing for Banking Information |
| 2024-12-20/a> | Xavier Mertens | Christmas "Gift" Delivered Through SSH |
| 2024-12-17/a> | Guy Bruneau | Command Injection Exploit For PHPUnit before 4.8.28 and 5.x before 5.6.3 [Guest Diary] |
| 2024-12-05/a> | Jesse La Grew | [Guest Diary] Business Email Compromise |
| 2024-11-30/a> | Xavier Mertens | From a Regular Infostealer to its Obfuscated Version |
| 2024-11-26/a> | Jesse La Grew | [Guest Diary] Using Zeek, Snort, and Grafana to Detect Crypto Mining Malware |
| 2024-11-22/a> | Xavier Mertens | An Infostealer Searching for « BIP-0039 » Data |
| 2024-11-19/a> | Xavier Mertens | Detecting the Presence of a Debugger in Linux |
| 2024-11-17/a> | Johannes Ullrich | Ancient TP-Link Backdoor Discovered by Attackers |
| 2024-11-07/a> | Xavier Mertens | Steam Account Checker Poisoned with Infostealer |
| 2024-10-31/a> | Guy Bruneau | October 2024 Activity with Username chenzilong |
| 2024-10-14/a> | Xavier Mertens | Phishing Page Delivered Through a Blob URL |
| 2024-10-09/a> | Xavier Mertens | From Perfctl to InfoStealer |
| 2024-10-03/a> | Guy Bruneau | Kickstart Your DShield Honeypot [Guest Diary] |
| 2024-09-25/a> | Guy Bruneau | OSINT - Image Analysis or More Where, When, and Metadata [Guest Diary] |
| 2024-09-18/a> | Guy Bruneau | Time-to-Live Analysis of DShield Data with Vega-Lite |
| 2024-09-18/a> | Xavier Mertens | Python Infostealer Patching Windows Exodus App |
| 2024-09-11/a> | Guy Bruneau | Hygiene, Hygiene, Hygiene! [Guest Diary] |
| 2024-09-04/a> | Guy Bruneau | Attack Surface [Guest Diary] |
| 2024-08-30/a> | Jesse La Grew | Simulating Traffic With Scapy |
| 2024-08-29/a> | Xavier Mertens | Live Patching DLLs with Python |
| 2024-08-27/a> | Xavier Mertens | Why Is Python so Popular to Infect Windows Hosts? |
| 2024-08-27/a> | Guy Bruneau | Vega-Lite with Kibana to Parse and Display IP Activity over Time |
| 2024-08-26/a> | Xavier Mertens | From Highly Obfuscated Batch File to XWorm and Redline |
| 2024-08-20/a> | Guy Bruneau | Mapping Threats with DNSTwist and the Internet Storm Center [Guest Diary] |
| 2024-08-16/a> | Jesse La Grew | [Guest Diary] 7 minutes and 4 steps to a quick win: A write-up on custom tools |
| 2024-08-14/a> | Xavier Mertens | Multiple Malware Dropped Through MSI Package |
| 2024-08-07/a> | Guy Bruneau | Same Scripts, Different Day: What My DShield Honeypot Taught Me About the Importance of Security Fundamentals [Guest Diary] |
| 2024-07-25/a> | Xavier Mertens | XWorm Hidden With Process Hollowing |
| 2024-07-23/a> | Johannes Ullrich | New Exploit Variation Against D-Link NAS Devices (CVE-2024-3273) |
| 2024-07-16/a> | Jan Kopriva | "Reply-chain phishing" with a twist |
| 2024-07-16/a> | Guy Bruneau | Who You Gonna Call? AndroxGh0st Busters! [Guest Diary] |
| 2024-07-13/a> | Didier Stevens | 16-bit Hash Collisions in .xls Spreadsheets |
| 2024-07-10/a> | Jesse La Grew | Finding Honeypot Data Clusters Using DBSCAN: Part 1 |
| 2024-07-08/a> | Xavier Mertens | Kunai: Keep an Eye on your Linux Hosts Activity |
| 2024-06-26/a> | Guy Bruneau | What Setting Live Traps for Cybercriminals Taught Me About Security [Guest Diary] |
| 2024-06-20/a> | Guy Bruneau | No Excuses, Free Tools to Help Secure Authentication in Ubuntu Linux [Guest Diary] |
| 2024-06-13/a> | Guy Bruneau | The Art of JQ and Command-line Fu [Guest Diary] |
| 2024-05-31/a> | Xavier Mertens | "K1w1" InfoStealer Uses gofile.io for Exfiltration |
| 2024-05-30/a> | Xavier Mertens | Feeding MISP with OSSEC |
| 2024-05-28/a> | Guy Bruneau | Is that It? Finding the Unknown: Correlations Between Honeypot Logs & PCAPs [Guest Diary] |
| 2024-05-22/a> | Rob VandenBrink | NMAP Scanning without Scanning (Part 2) - The ipinfo API |
| 2024-05-22/a> | Guy Bruneau | Analysis of ?redtail? File Uploads to ICS Honeypot, a Multi-Architecture Coin Miner [Guest Diary] |
| 2024-05-16/a> | Rob VandenBrink | Why yq? Adventures in XML |
| 2024-05-15/a> | Rob VandenBrink | Got MFA? If not, Now is the Time! |
| 2024-05-06/a> | Johannes Ullrich | Detecting XFinity/Comcast DNS Spoofing |
| 2024-04-29/a> | Johannes Ullrich | D-Link NAS Device Backdoor Abused |
| 2024-04-29/a> | Guy Bruneau | Linux Trojan - Xorddos with Filename eyshcjdmzg |
| 2024-04-22/a> | Jan Kopriva | It appears that the number of industrial devices accessible from the internet has risen by 30 thousand over the past three years |
| 2024-04-17/a> | Xavier Mertens | Malicious PDF File Used As Delivery Mechanism |
| 2024-04-11/a> | Yee Ching Tok | Evolution of Artificial Intelligence Systems and Ensuring Trustworthiness |
| 2024-04-07/a> | Guy Bruneau | A Use Case for Adding Threat Hunting to Your Security Operations Team. Detecting Adversaries Abusing Legitimate Tools in A Customer Environment. [Guest Diary] |
| 2024-03-19/a> | Johannes Ullrich | Attacker Hunting Firewalls |
| 2024-03-17/a> | Guy Bruneau | Gamified Learning: Using Capture the Flag Challenges to Supplement Cybersecurity Training [Guest Diary] |
| 2024-03-14/a> | Jan Kopriva | Increase in the number of phishing messages pointing to IPFS and to R2 buckets |
| 2024-03-06/a> | Bojan Zdrnja | Scanning and abusing the QUIC protocol |
| 2024-02-21/a> | Jan Kopriva | Phishing pages hosted on archive.org |
| 2024-02-20/a> | Xavier Mertens | Python InfoStealer With Dynamic Sandbox Detection |
| 2024-02-15/a> | Jesse La Grew | [Guest Diary] Learning by doing: Iterative adventures in troubleshooting |
| 2024-01-31/a> | Johannes Ullrich | The Fun and Dangers of Top Level Domains (TLDs) |
| 2024-01-25/a> | Xavier Mertens | Facebook AdsManager Targeted by a Python Infostealer |
| 2024-01-24/a> | Johannes Ullrich | How Bad User Interfaces Make Security Tools Harmful |
| 2024-01-06/a> | Xavier Mertens | Are you sure of your password? |
| 2024-01-02/a> | Johannes Ullrich | Fingerprinting SSH Identification Strings |
| 2023-12-31/a> | Tom Webb | Pi-Hole Pi4 Docker Deployment |
| 2023-12-22/a> | Xavier Mertens | Shall We Play a Game? |
| 2023-12-06/a> | Guy Bruneau | Revealing the Hidden Risks of QR Codes [Guest Diary] |
| 2023-11-30/a> | John Bambenek | Prophetic Post by Intern on CVE-2023-1389 Foreshadows Mirai Botnet Expansion Today |
| 2023-11-22/a> | Guy Bruneau | CVE-2023-1389: A New Means to Expand Botnets |
| 2023-11-17/a> | Jan Kopriva | Phishing page with trivial anti-analysis features |
| 2023-11-15/a> | Xavier Mertens | Redline Dropped Through MSIX Package |
| 2023-11-09/a> | Xavier Mertens | Visual Examples of Code Injection |
| 2023-11-08/a> | Xavier Mertens | Example of Phishing Campaign Project File |
| 2023-10-29/a> | Guy Bruneau | Spam or Phishing? Looking for Credentials & Passwords |
| 2023-10-28/a> | Xavier Mertens | Size Matters for Many Security Controls |
| 2023-10-16/a> | Jan Kopriva | Are typos still relevant as an indicator of phishing? |
| 2023-10-15/a> | Guy Bruneau | Domain Name Used as Password Captured by DShield Sensor |
| 2023-10-03/a> | Tom Webb | Are Local LLMs Useful in Incident Response? |
| 2023-09-29/a> | Xavier Mertens | Are You Still Storing Passwords In Plain Text Files? |
| 2023-09-26/a> | Jan Kopriva | A new spin on the ZeroFont phishing technique |
| 2023-09-23/a> | Guy Bruneau | Scanning for Laravel - a PHP Framework for Web Artisants |
| 2023-09-03/a> | Didier Stevens | Analysis of a Defective Phishing PDF |
| 2023-08-31/a> | Jan Kopriva | The low, low cost of (committing) cybercrime |
| 2023-08-31/a> | Guy Bruneau | Potential Weaponizing of Honeypot Logs [Guest Diary] |
| 2023-08-21/a> | Xavier Mertens | Quick Malware Triage With Inotify Tools |
| 2023-08-20/a> | Guy Bruneau | SystemBC Malware Activity |
| 2023-08-18/a> | Xavier Mertens | From a Zalando Phishing to a RAT |
| 2023-08-17/a> | Jesse La Grew | Command Line Parsing - Are These Really Unique Strings? |
| 2023-08-11/a> | Xavier Mertens | Show me All Your Windows! |
| 2023-07-24/a> | Rob VandenBrink | JQ: Another Tool We Thought We Knew |
| 2023-07-18/a> | Johannes Ullrich | Exploit Attempts for "Stagil navigation for Jira Menus & Themes" CVE-2023-26255 and CVE-2023-26256 |
| 2023-07-13/a> | Jesse La Grew | DShield Honeypot Maintenance and Data Retention |
| 2023-07-01/a> | Russ McRee | Sandfly Security |
| 2023-06-29/a> | Brad Duncan | GuLoader- or DBatLoader/ModiLoader-style infection for Remcos RAT |
| 2023-06-21/a> | Yee Ching Tok | Analyzing a YouTube Sponsorship Phishing Mail and Malware Targeting Content Creators |
| 2023-06-19/a> | Xavier Mertens | Malware Delivered Through .inf File |
| 2023-06-16/a> | Xavier Mertens | Another RAT Delivered Through VBS |
| 2023-05-30/a> | Johannes Ullrich | Your Business Data and Machine Learning at Risk: Attacks Against Apache NiFi |
| 2023-05-28/a> | Guy Bruneau | We Can no Longer Ignore the Cost of Cybersecurity |
| 2023-05-26/a> | Xavier Mertens | Using DFIR Techniques To Recover From Infrastructure Outages |
| 2023-05-24/a> | Tom Webb | IR Case/Alert Management |
| 2023-05-20/a> | Xavier Mertens | Phishing Kit Collecting Victim's IP Address |
| 2023-05-19/a> | Xavier Mertens | When the Phisher Messes Up With Encoding |
| 2023-05-15/a> | Jan Kopriva | Ongoing Facebook phishing campaign without a sender and (almost) without links |
| 2023-05-04/a> | Xavier Mertens | Infostealer Embedded in a Word Document |
| 2023-05-01/a> | Jan Kopriva | "Passive" analysis of a phishing attachment |
| 2023-04-26/a> | Yee Ching Tok | Strolling through Cyberspace and Hunting for Phishing Sites |
| 2023-04-17/a> | Jan Kopriva | The strange case of Great honeypot of China |
| 2023-04-08/a> | Xavier Mertens | Microsoft Netlogon: Potential Upcoming Impacts of CVE-2022-38023 |
| 2023-04-03/a> | Johannes Ullrich | Tax Season Risks |
| 2023-03-31/a> | Guy Bruneau | Using Linux grep and Windows findstr to Manipulate Files |
| 2023-03-31/a> | Jan Kopriva | Use of X-Frame-Options and CSP frame-ancestors security headers on 1 million most popular domains |
| 2023-03-25/a> | Guy Bruneau | Microsoft Released an Update for Windows Snipping Tool Vulnerability |
| 2023-03-22/a> | Didier Stevens | Windows 11 Snipping Tool Privacy Bug: Inspecting PNG Files |
| 2023-03-20/a> | Xavier Mertens | From Phishing Kit To Telegram... or Not! |
| 2023-03-15/a> | Jan Kopriva | IPFS phishing and the need for correctly set HTTP security headers |
| 2023-03-12/a> | Guy Bruneau | AsynRAT Trojan - Bill Payment (Pago de la factura) |
| 2023-03-11/a> | Xavier Mertens | Overview of a Mirai Payload Generator |
| 2023-03-01/a> | Xavier Mertens | Python Infostealer Targeting Gamers |
| 2023-02-27/a> | Xavier Mertens | Phishing Again and Again |
| 2023-02-21/a> | Xavier Mertens | Phishing Page Branded with Your Corporate Website |
| 2023-02-19/a> | Didier Stevens | "Unsupported 16-bit Application" or HTML? |
| 2023-02-18/a> | Guy Bruneau | Spear Phishing Handlers for Username/Password |
| 2023-02-16/a> | Jan Kopriva | HTML phishing attachment with browser-in-the-browser technique |
| 2023-02-13/a> | Johannes Ullrich | Venmo Phishing Abusing LinkedIn "slink" |
| 2023-02-10/a> | Xavier Mertens | Obfuscated Deactivation of Script Block Logging |
| 2023-02-09/a> | Xavier Mertens | A Backdoor with Smart Screenshot Capability |
| 2023-02-04/a> | Guy Bruneau | Assemblyline as a Malware Analysis Sandbox |
| 2023-01-28/a> | Didier Stevens | Sysinternals Updates: RDCMan v2.92, Sysmon v14.14, and ZoomIt v6.12 |
| 2023-01-26/a> | Tom Webb | Live Linux IR with UAC |
| 2023-01-23/a> | Xavier Mertens | Who's Resolving This Domain? |
| 2023-01-21/a> | Guy Bruneau | DShield Sensor JSON Log to Elasticsearch |
| 2023-01-15/a> | Johannes Ullrich | Elon Musk Themed Crypto Scams Flooding YouTube Today |
| 2023-01-08/a> | Guy Bruneau | DShield Sensor JSON Log Analysis |
| 2023-01-02/a> | Xavier Mertens | NetworkMiner 2.8 Released |
| 2022-12-21/a> | Guy Bruneau | DShield Sensor Setup in Azure |
| 2022-12-20/a> | Xavier Mertens | Linux File System Monitoring & Actions |
| 2022-12-19/a> | Xavier Mertens | Hunting for Mastodon Servers |
| 2022-12-18/a> | Guy Bruneau | Infostealer Malware with Double Extension |
| 2022-12-04/a> | Didier Stevens | Finger.exe LOLBin |
| 2022-12-03/a> | Guy Bruneau | Linux LOLBins Applications Available in Windows |
| 2022-12-02/a> | Brad Duncan | obama224 distribution Qakbot tries .vhd (virtual hard disk) images |
| 2022-11-29/a> | Johannes Ullrich | Identifying Groups of "Bot" Accounts on LinkedIn |
| 2022-11-28/a> | Johannes Ullrich | Ukraine Themed Twitter Spam Pushing iOS Scareware |
| 2022-11-24/a> | Xavier Mertens | Attackers Keep Phishing Victims Under Stress |
| 2022-11-19/a> | Guy Bruneau | McAfee Fake Antivirus Phishing Campaign is Back! |
| 2022-11-10/a> | Xavier Mertens | Do you collect "Observables" or "IOCs"? |
| 2022-11-05/a> | Guy Bruneau | Windows Malware with VHD Extension |
| 2022-11-02/a> | Rob VandenBrink | Breakpoints in Burp |
| 2022-10-30/a> | Didier Stevens | Sysinternals Updates: Process Explorer v17.0, Handle v5.0, Process Monitor v3.92 and Sysmon v14.11 |
| 2022-10-27/a> | Tom Webb | Supersizing your DUO and 365 Integration |
| 2022-10-19/a> | Xavier Mertens | Are Internet Scanning Services Good or Bad for You? |
| 2022-10-15/a> | Guy Bruneau | Malware - Covid Vaccination Supplier Declaration |
| 2022-10-07/a> | Xavier Mertens | Powershell Backdoor with DGA Capability |
| 2022-10-07/a> | Xavier Mertens | Critical Fortinet Vulnerability Ahead |
| 2022-10-04/a> | Johannes Ullrich | Credential Harvesting with Telegram API |
| 2022-09-21/a> | Xavier Mertens | Phishing Campaigns Use Free Online Resources |
| 2022-09-19/a> | Russ McRee | Chainsaw: Hunt, search, and extract event log records |
| 2022-09-15/a> | Xavier Mertens | Malicious Word Document with a Frameset |
| 2022-09-14/a> | Xavier Mertens | Easy Process Injection within Python |
| 2022-09-10/a> | Guy Bruneau | Phishing Word Documents with Suspicious URL |
| 2022-08-28/a> | Didier Stevens | Sysinternals Updates: Sysmon v14.0 and ZoomIt v6.01 |
| 2022-08-26/a> | Xavier Mertens | Paypal Phishing/Coinbase in One Image |
| 2022-08-26/a> | Guy Bruneau | HTTP/2 Packet Analysis with Wireshark |
| 2022-08-13/a> | Guy Bruneau | Phishing HTML Attachment as Voicemail Audio Transcription |
| 2022-08-11/a> | Xavier Mertens | InfoStealer Script Based on Curl and NSudo |
| 2022-08-02/a> | Johannes Ullrich | A Little DDoS in the Morning - Followup |
| 2022-08-02/a> | Johannes Ullrich | Increase in Chinese "Hacktivism" Attacks |
| 2022-08-01/a> | Johannes Ullrich | A Little DDoS In the Morning |
| 2022-07-28/a> | Johannes Ullrich | Exfiltrating Data With Bookmarks |
| 2022-07-25/a> | Xavier Mertens | PowerShell Script with Fileless Capability |
| 2022-07-23/a> | Guy Bruneau | Analysis of SSH Honeypot Data with PowerBI |
| 2022-07-22/a> | Yee Ching Tok | An Analysis of a Discerning Phishing Website |
| 2022-07-20/a> | Xavier Mertens | Malicious Python Script Behaving Like a Rubber Ducky |
| 2022-07-20/a> | Johannes Ullrich | Apple Patches Everything Day |
| 2022-07-13/a> | Xavier Mertens | Using Referers to Detect Phishing Attacks |
| 2022-07-09/a> | Didier Stevens | 7-Zip Editing & MoW |
| 2022-06-26/a> | Didier Stevens | My Paste Command |
| 2022-06-24/a> | Xavier Mertens | Python (ab)using The Windows GUI |
| 2022-06-23/a> | Xavier Mertens | FLOSS 2.0 Has Been Released |
| 2022-06-21/a> | Johannes Ullrich | Experimental New Domain / Domain Age API |
| 2022-06-19/a> | Didier Stevens | Video: Decoding Obfuscated BASE64 Statistically |
| 2022-06-18/a> | Didier Stevens | Decoding Obfuscated BASE64 Statistically |
| 2022-06-16/a> | Xavier Mertens | Houdini is Back Delivered Through a JavaScript Dropper |
| 2022-06-12/a> | Didier Stevens | Quickie: Follina, RTF & Explorer Preview Pane |
| 2022-06-09/a> | Brad Duncan | TA570 Qakbot (Qbot) tries CVE-2022-30190 (Follina) exploit (ms-msdt) |
| 2022-06-02/a> | Johannes Ullrich | Quick Answers in Incident Response: RECmd.exe |
| 2022-06-01/a> | Jan Kopriva | HTML phishing attachments - now with anti-analysis features |
| 2022-05-31/a> | Xavier Mertens | First Exploitation of Follina Seen in the Wild |
| 2022-05-18/a> | Jan Kopriva | Do you want 30 BTC? Nothing is easier (or cheaper) in this phishing campaign... |
| 2022-05-14/a> | Didier Stevens | Quick Analysis Of Phishing MSG |
| 2022-05-07/a> | Guy Bruneau | Phishing PDF Received in my ISC Mailbox |
| 2022-04-28/a> | Johannes Ullrich | A Day of SMB: What does our SMB/RPC Honeypot see? CVE-2022-26809 |
| 2022-04-24/a> | Didier Stevens | Analyzing a Phishing Word Document |
| 2022-04-23/a> | Guy Bruneau | Are Roku Streaming Devices Safe from Exploitation? |
| 2022-04-14/a> | Johannes Ullrich | An Update on CVE-2022-26809 - MSRPC Vulnerabliity - PATCH NOW |
| 2022-04-13/a> | Jan Kopriva | How is Ukrainian internet holding up during the Russian invasion? |
| 2022-04-11/a> | Johannes Ullrich | Spring: It isn't just about Spring4Shell. Spring Cloud Function Vulnerabilities are being probed too. |
| 2022-04-10/a> | Didier Stevens | Video: Method For String Extraction Filtering |
| 2022-04-09/a> | Didier Stevens | Method For String Extraction Filtering |
| 2022-04-07/a> | Johannes Ullrich | What is BIMI and how is it supposed to help with Phishing. |
| 2022-04-06/a> | Brad Duncan | Windows MetaStealer Malware |
| 2022-04-05/a> | Johannes Ullrich | WebLogic Crypto Miner Malware Disabling Alibaba Cloud Monitoring Tools |
| 2022-04-04/a> | Johannes Ullrich | Emptying the Phishtank: Are WordPress sites the Mosquitoes of the Internet? |
| 2022-03-31/a> | Johannes Ullrich | Spring Vulnerability Update - Exploitation Attempts CVE-2022-22965 |
| 2022-03-30/a> | Johannes Ullrich | Possible new Java Spring Framework Vulnerability (Updated: not a Spring problem) |
| 2022-03-30/a> | Johannes Ullrich | Java Springtime Confusion: What Vulnerability are We Talking About |
| 2022-03-29/a> | Johannes Ullrich | More Fake/Typosquatting Twitter Accounts Asking for Ukraine Crytocurrency Donations |
| 2022-03-26/a> | Guy Bruneau | Is buying Cyber Insurance a Must Now? |
| 2022-03-25/a> | Xavier Mertens | XLSB Files: Because Binary is Stealthier Than XML |
| 2022-03-24/a> | Xavier Mertens | Malware Delivered Through Free Sharing Tool |
| 2022-03-23/a> | Brad Duncan | Arkei Variants: From Vidar to Mars Stealer |
| 2022-03-22/a> | Johannes Ullrich | Statement by President Biden: What you need to do (or not do) |
| 2022-03-15/a> | Xavier Mertens | Clean Binaries with Suspicious Behaviour |
| 2022-03-09/a> | Xavier Mertens | Infostealer in a Batch File |
| 2022-03-07/a> | Johannes Ullrich | No Bitcoin - No Problem: Follow Up to Last Weeks Donation Scam |
| 2022-03-04/a> | Johannes Ullrich | Scam E-Mail Impersonating Red Cross |
| 2022-03-02/a> | Johannes Ullrich | The More Often Something is Repeated, the More True It Becomes: Dealing with Social Media |
| 2022-02-25/a> | Didier Stevens | Windows, Fixed IPv4 Addresses and APIPA |
| 2022-02-24/a> | Xavier Mertens | Ukraine & Russia Situation From a Domain Names Perspective |
| 2022-02-13/a> | Guy Bruneau | DHL Spear Phishing to Capture Username/Password |
| 2022-02-11/a> | Xavier Mertens | CinaRAT Delivered Through HTML ID Attributes |
| 2022-02-10/a> | Johannes Ullrich | Zyxel Network Storage Devices Hunted By Mirai Variant |
| 2022-02-05/a> | Didier Stevens | Power over Ethernet and Thermal Imaging |
| 2022-02-02/a> | Johannes Ullrich | Finding elFinder: Who is looking for your files? |
| 2022-01-31/a> | Xavier Mertens | Be careful with RPMSG files |
| 2022-01-29/a> | Guy Bruneau | SIEM In this Decade, Are They Better than the Last? |
| 2022-01-28/a> | Xavier Mertens | Malicious ISO Embedded in an HTML Page |
| 2022-01-21/a> | Xavier Mertens | Obscure Wininet.dll Feature? |
| 2022-01-20/a> | Xavier Mertens | RedLine Stealer Delivered Through FTP |
| 2022-01-18/a> | Jan Kopriva | Phishing e-mail with...an advertisement? |
| 2022-01-05/a> | Xavier Mertens | Code Reuse In the Malware Landscape |
| 2022-01-04/a> | Xavier Mertens | A Simple Batch File That Blocks People |
| 2022-01-03/a> | Xavier Mertens | McAfee Phishing Campaign with a Nice Fake Scan |
| 2022-01-02/a> | Guy Bruneau | Exchange Server - Email Trapped in Transport Queues |
| 2021-12-28/a> | Russ McRee | LotL Classifier tests for shells, exfil, and miners |
| 2021-12-23/a> | Xavier Mertens | Nicely Crafted indeed.com Login Page |
| 2021-12-21/a> | Xavier Mertens | More Undetected PowerShell Dropper |
| 2021-12-20/a> | Jan Kopriva | PowerPoint attachments, Agent Tesla and code reuse in malware |
| 2021-12-14/a> | Johannes Ullrich | Log4j: Getting ready for the long haul (CVE-2021-44228) |
| 2021-12-10/a> | Xavier Mertens | Python Shellcode Injection From JSON Data |
| 2021-12-09/a> | Yee Ching Tok | Phishing Direct Messages via Discord |
| 2021-12-06/a> | Xavier Mertens | The Importance of Out-of-Band Networks |
| 2021-12-04/a> | Guy Bruneau | A Review of Year 2021 |
| 2021-12-01/a> | Xavier Mertens | Info-Stealer Using webhook.site to Exfiltrate Data |
| 2021-11-25/a> | Didier Stevens | YARA's Private Strings |
| 2021-11-24/a> | Jan Kopriva | Phishing page hiding itself using dynamically adjusted IP-based allow list |
| 2021-11-21/a> | Didier Stevens | Backdooring PAM |
| 2021-11-20/a> | Guy Bruneau | Hikvision Security Cameras Potentially Exposed to Remote Code Execution |
| 2021-11-19/a> | Xavier Mertens | Downloader Disguised as Excel Add-In (XLL) |
| 2021-11-10/a> | Xavier Mertens | Shadow IT Makes People More Vulnerable to Phishing |
| 2021-10-31/a> | Didier Stevens | Sysinternals: Autoruns and Sysmon updates |
| 2021-10-30/a> | Guy Bruneau | Remote Desktop Protocol (RDP) Discovery |
| 2021-10-26/a> | Yee Ching Tok | Hunting for Phishing Sites Masquerading as Outlook Web Access |
| 2021-10-14/a> | Xavier Mertens | Port-Forwarding with Windows for the Win |
| 2021-10-13/a> | Johannes Ullrich | Please fix your E-Mail Brute forcing tool! |
| 2021-10-09/a> | Guy Bruneau | Scanning for Previous Oracle WebLogic Vulnerabilities |
| 2021-10-07/a> | Johannes Ullrich | Who Is Hunting For Your IPTV Set-Top Box? |
| 2021-09-25/a> | Didier Stevens | Strings Analysis: VBA & Excel4 Maldoc |
| 2021-09-25/a> | Didier Stevens | Video: Strings Analysis: VBA & Excel4 Maldoc |
| 2021-09-24/a> | Xavier Mertens | Keep an Eye on Your Users Mobile Devices (Simple Inventory) |
| 2021-09-20/a> | Johannes Ullrich | #OMIGOD Exploits Captured in the Wild. Researchers responsible for half of scans for related ports. |
| 2021-09-16/a> | Jan Kopriva | Phishing 101: why depend on one suspicious message subject when you can use many? |
| 2021-09-09/a> | Johannes Ullrich | Updates to Our Datafeeds/API |
| 2021-09-07/a> | Johannes Ullrich | Why I Gave Up on IPv6. And no, it is not because of security issues. |
| 2021-09-02/a> | Xavier Mertens | Attackers Will Always Abuse Major Events in our Lifes |
| 2021-08-24/a> | Johannes Ullrich | Attackers Hunting For Twilio Credentials |
| 2021-08-21/a> | Didier Stevens | New Versions Of Sysinternals Tools |
| 2021-08-19/a> | Johannes Ullrich | When Lightning Strikes. What works and doesn't work. |
| 2021-08-13/a> | Guy Bruneau | Scanning for Microsoft Exchange eDiscovery |
| 2021-08-04/a> | Yee Ching Tok | Pivoting and Hunting for Shenanigans from a Reported Phishing Domain |
| 2021-08-03/a> | Johannes Ullrich | Is this the Weirdest Phishing (SMishing?) Attempt Ever? |
| 2021-08-01/a> | Didier Stevens | procdump Version 10.1 |
| 2021-07-31/a> | Guy Bruneau | Unsolicited DNS Queries |
| 2021-07-28/a> | Jan Kopriva | A sextortion e-mail from...IT support?! |
| 2021-07-24/a> | Bojan Zdrnja | Active Directory Certificate Services (ADCS - PKI) domain admin vulnerability |
| 2021-07-21/a> | Johannes Ullrich | "Summer of SAM": Microsoft Releases Guidance for CVE-2021-36934 |
| 2021-07-19/a> | Rick Wanner | New Windows Print Spooler Vulnerability - CVE-2021-34481 |
| 2021-07-16/a> | Xavier Mertens | Multiple BaseXX Obfuscations |
| 2021-07-14/a> | Jan Kopriva | One way to fail at malspam - give recipients the wrong password for an encrypted attachment |
| 2021-07-13/a> | Johannes Ullrich | USPS Phishing Using Telegram to Collect Data |
| 2021-07-10/a> | Guy Bruneau | Scanning for Microsoft Secure Socket Tunneling Protocol |
| 2021-07-08/a> | Xavier Mertens | Using Sudo with Python For More Security Controls |
| 2021-07-06/a> | Xavier Mertens | Python DLL Injection Check |
| 2021-07-03/a> | Didier Stevens | Finding Strings With oledump.py |
| 2021-07-02/a> | Xavier Mertens | "inception.py"... Multiple Base64 Encodings |
| 2021-06-30/a> | Johannes Ullrich | CVE-2021-1675: Incomplete Patch and Leaked RCE Exploit |
| 2021-06-28/a> | Didier Stevens | CFBF Files Strings Analysis |
| 2021-06-26/a> | Guy Bruneau | CVE-2019-9670: Zimbra Collaboration Suite XXE vulnerability |
| 2021-06-22/a> | Jan Kopriva | Phishing asking recipients not to report abuse |
| 2021-06-18/a> | Daniel Wesemann | Network Forensics on Azure VMs (Part #2) |
| 2021-06-18/a> | Daniel Wesemann | Open redirects ... and why Phishers love them |
| 2021-06-15/a> | Johannes Ullrich | Multi Perimeter Device Exploit Mirai Version Hunting For Sonicwall, DLink, Cisco and more |
| 2021-06-12/a> | Guy Bruneau | Fortinet Targeted for Unpatched SSL VPN Discovery Activity |
| 2021-05-30/a> | Didier Stevens | Sysinternals: Procmon, Sysmon, TcpView and Process Explorer update |
| 2021-05-29/a> | Guy Bruneau | Spear-phishing Email Targeting Outlook Mail Clients |
| 2021-05-27/a> | Jan Kopriva | All your Base are...nearly equal when it comes to AV evasion, but 64-bit executables are not |
| 2021-05-22/a> | Xavier Mertens | "Serverless" Phishing Campaign |
| 2021-05-21/a> | Xavier Mertens | Locking Kernel32.dll As Anti-Debugging Technique |
| 2021-05-14/a> | Xavier Mertens | "Open" Access to Industrial Systems Interface is Also Far From Zero |
| 2021-05-12/a> | Jan Kopriva | Number of industrial control systems on the internet is lower then in 2020...but still far from zero |
| 2021-05-10/a> | Johannes Ullrich | Correctly Validating IP Addresses: Why encoding matters for input validation. |
| 2021-05-08/a> | Guy Bruneau | Who is Probing the Internet for Research Purposes? |
| 2021-05-07/a> | Daniel Wesemann | Exposed Azure Storage Containers |
| 2021-05-06/a> | Xavier Mertens | Alternative Ways To Perform Basic Tasks |
| 2021-05-02/a> | Didier Stevens | PuTTY And FileZilla Use The Same Fingerprint Registry Keys |
| 2021-04-30/a> | Remco Verhoef | Qiling: A true instrumentable binary emulation framework |
| 2021-04-29/a> | Xavier Mertens | From Python to .Net |
| 2021-04-24/a> | Guy Bruneau | Base64 Hashes Used in Web Scanning |
| 2021-04-23/a> | Xavier Mertens | Malicious PowerPoint Add-On: "Small Is Beautiful" |
| 2021-04-22/a> | Xavier Mertens | How Safe Are Your Docker Images? |
| 2021-04-19/a> | Jan Kopriva | Hunting phishing websites with favicon hashes |
| 2021-04-09/a> | Xavier Mertens | No Python Interpreter? This Simple RAT Installs Its Own Copy |
| 2021-04-06/a> | Jan Kopriva | Malspam with Lokibot vs. Outlook and RFCs |
| 2021-03-31/a> | Xavier Mertens | Quick Analysis of a Modular InfoStealer |
| 2021-03-19/a> | Xavier Mertens | Pastebin.com Used As a Simple C2 Channel |
| 2021-03-17/a> | Xavier Mertens | Defenders, Know Your Operating System Like Attackers Do! |
| 2021-03-12/a> | Guy Bruneau | Microsoft DHCP Logs Shipped to ELK |
| 2021-03-11/a> | Johannes Ullrich | Piktochart - Phishing with Infographics |
| 2021-03-06/a> | Xavier Mertens | Spotting the Red Team on VirusTotal! |
| 2021-03-04/a> | Xavier Mertens | From VBS, PowerShell, C Sharp, Process Hollowing to RAT |
| 2021-02-26/a> | Guy Bruneau | Pretending to be an Outlook Version Update |
| 2021-02-25/a> | Daniel Wesemann | Forensicating Azure VMs |
| 2021-02-17/a> | Xavier Mertens | The new "LinkedInSecureMessage" ? |
| 2021-02-13/a> | Guy Bruneau | vSphere Replication updates address a command injection vulnerability (CVE-2021-21976) - https://www.vmware.com/security/advisories/VMSA-2021-0001.html |
| 2021-02-13/a> | Guy Bruneau | Using Logstash to Parse IPtables Firewall Logs |
| 2021-02-10/a> | Brad Duncan | Phishing message to the ISC handlers email distro |
| 2021-01-30/a> | Guy Bruneau | PacketSifter as Network Parsing and Telemetry Tool |
| 2021-01-19/a> | Russ McRee | Gordon for fast cyber reputation checks |
| 2021-01-17/a> | Didier Stevens | New Release of Sysmon Adding Detection for Process Tampering |
| 2021-01-15/a> | Guy Bruneau | Obfuscated DNS Queries |
| 2021-01-10/a> | Didier Stevens | Maldoc Analysis With CyberChef |
| 2021-01-09/a> | Didier Stevens | Maldoc Strings Analysis |
| 2021-01-02/a> | Guy Bruneau | Protecting Home Office and Enterprise in 2021 |
| 2021-01-01/a> | Didier Stevens | Strings 2021 |
| 2020-12-29/a> | Jan Kopriva | Want to know what's in a folder you don't have a permission to access? Try asking your AV solution... |
| 2020-12-26/a> | Didier Stevens | base64dump.py Supported Encodings |
| 2020-12-14/a> | Johannes Ullrich | SolarWinds Breach Used to Infiltrate Customer Networks (Solarigate) |
| 2020-12-13/a> | Didier Stevens | KringleCon 2020 |
| 2020-12-08/a> | Johannes Ullrich | December 2020 Microsoft Patch Tuesday: Exchange, Sharepoint, Dynamics and DNS Spoofing |
| 2020-12-06/a> | Didier Stevens | oledump's Indicators (video) |
| 2020-12-05/a> | Guy Bruneau | Is IP 91.199.118.137 testing Access to aahwwx.52host.xyz? |
| 2020-12-04/a> | Guy Bruneau | Detecting Actors Activity with Threat Intel |
| 2020-11-19/a> | Xavier Mertens | PowerShell Dropper Delivering Formbook |
| 2020-11-07/a> | Guy Bruneau | Cryptojacking Targeting WebLogic TCP/7001 |
| 2020-11-05/a> | Xavier Mertens | Did You Spot "Invoke-Expression"? |
| 2020-10-25/a> | Didier Stevens | Video: Pascal Strings |
| 2020-10-24/a> | Guy Bruneau | An Alternative to Shodan, Censys with User-Agent CensysInspect/1.1 |
| 2020-10-22/a> | Jan Kopriva | BazarLoader phishing lures: plan a Halloween party, get a bonus and be fired in the same afternoon |
| 2020-10-11/a> | Didier Stevens | Analyzing MSG Files With plugin_msg_summary |
| 2020-10-09/a> | Jan Kopriva | Phishing kits as far as the eye can see |
| 2020-10-03/a> | Guy Bruneau | Scanning for SOHO Routers |
| 2020-10-02/a> | Xavier Mertens | Analysis of a Phishing Kit |
| 2020-09-30/a> | Johannes Ullrich | Scans for FPURL.xml: Reconnaissance or Not? |
| 2020-09-24/a> | Xavier Mertens | Party in Ibiza with PowerShell |
| 2020-09-21/a> | Jan Kopriva | Slightly broken overlay phishing |
| 2020-09-20/a> | Guy Bruneau | Analysis of a Salesforce Phishing Emails |
| 2020-09-17/a> | Xavier Mertens | Suspicious Endpoint Containment with OSSEC |
| 2020-09-02/a> | Xavier Mertens | Python and Risky Windows API Calls |
| 2020-09-01/a> | Johannes Ullrich | Exposed Windows Domain Controllers Used in CLDAP DDoS Attacks |
| 2020-08-30/a> | Johannes Ullrich | CenturyLink Outage Causing Internet Wide Problems |
| 2020-08-28/a> | Xavier Mertens | Example of Malicious DLL Injected in PowerShell |
| 2020-08-25/a> | Xavier Mertens | Keep An Eye on LOLBins |
| 2020-08-24/a> | Xavier Mertens | Tracking A Malware Campaign Through VT |
| 2020-08-22/a> | Guy Bruneau | Remote Desktop (TCP/3389) and Telnet (TCP/23), What might they have in Common? |
| 2020-08-20/a> | Rob VandenBrink | Office 365 Mail Forwarding Rules (and other Mail Rules too) |
| 2020-08-10/a> | Bojan Zdrnja | Scoping web application and web service penetration tests |
| 2020-08-08/a> | Guy Bruneau | Scanning Activity Include Netcat Listener |
| 2020-08-03/a> | Johannes Ullrich | A Word of Caution: Helping Out People Being Stalked Online |
| 2020-07-30/a> | Johannes Ullrich | Python Developers: Prepare!!! |
| 2020-07-28/a> | Johannes Ullrich | All I want this Tuesday: More Data |
| 2020-07-27/a> | Johannes Ullrich | In Memory of Donald Smith |
| 2020-07-26/a> | Didier Stevens | Cracking Maldoc VBA Project Passwords |
| 2020-07-20/a> | Rick Wanner | Sextortion Update: The Final Final Chapter |
| 2020-07-19/a> | Guy Bruneau | Scanning Activity for ZeroShell Unauthenticated Access |
| 2020-07-12/a> | Didier Stevens | Maldoc: VBA Purging Example |
| 2020-07-11/a> | Guy Bruneau | Scanning Home Internet Facing Devices to Exploit |
| 2020-07-08/a> | Xavier Mertens | If You Want Something Done Right, You Have To Do It Yourself... Malware Too! |
| 2020-07-04/a> | Russ McRee | Happy FouRth of July from the Internet Storm Center |
| 2020-06-29/a> | Didier Stevens | Sysmon and Alternate Data Streams |
| 2020-06-25/a> | Johannes Ullrich | Tech Tuesday Recap / Recordings: Part 2 (Installing the Honeypot) release. |
| 2020-06-24/a> | Jan Kopriva | Using Shell Links as zero-touch downloaders and to initiate network connections |
| 2020-06-18/a> | Jan Kopriva | Broken phishing accidentally exploiting Outlook zero-day |
| 2020-06-16/a> | Xavier Mertens | Sextortion to The Next Level |
| 2020-06-15/a> | Rick Wanner | HTML based Phishing Run |
| 2020-06-13/a> | Guy Bruneau | Mirai Botnet Activity |
| 2020-06-11/a> | Xavier Mertens | Anti-Debugging JavaScript Techniques |
| 2020-06-08/a> | Didier Stevens | Translating BASE64 Obfuscated Scripts |
| 2020-06-04/a> | Xavier Mertens | Anti-Debugging Technique based on Memory Protection |
| 2020-06-01/a> | Jim Clausing | Stackstrings, type 2 |
| 2020-05-27/a> | Jan Kopriva | Frankenstein's phishing using Google Cloud Storage |
| 2020-05-23/a> | Xavier Mertens | AgentTesla Delivered via a Malicious PowerPoint Add-In |
| 2020-05-22/a> | Didier Stevens | Some Strings to Remember |
| 2020-05-21/a> | Xavier Mertens | Malware Triage with FLOSS: API Calls Based Behavior |
| 2020-05-16/a> | Guy Bruneau | Scanning for Outlook Web Access (OWA) & Microsoft Exchange Control Panel (ECP) |
| 2020-05-14/a> | Rob VandenBrink | Patch Tuesday Revisited - CVE-2020-1048 isn't as "Medium" as MS Would Have You Believe |
| 2020-05-04/a> | Didier Stevens | Sysmon and File Deletion |
| 2020-05-02/a> | Guy Bruneau | Phishing PDF with Unusual Hostname |
| 2020-04-29/a> | Johannes Ullrich | Privacy Preserving Protocols to Trace Covid19 Exposure |
| 2020-04-28/a> | Jan Kopriva | Agent Tesla delivered by the same phishing campaign for over a year |
| 2020-04-27/a> | Xavier Mertens | Powershell Payload Stored in a PSCredential Object |
| 2020-04-18/a> | Guy Bruneau | Maldoc Falsely Represented as DOCX Invoice Redirecting to Fake Apple Store |
| 2020-04-16/a> | Johannes Ullrich | Using AppLocker to Prevent Living off the Land Attacks |
| 2020-04-13/a> | Jan Kopriva | Look at the same phishing campaign 3 months apart |
| 2020-04-07/a> | Johannes Ullrich | Increase in RDP Scanning |
| 2020-04-03/a> | Xavier Mertens | Obfuscated with a Simple 0x0A |
| 2020-03-30/a> | Jan Kopriva | Crashing explorer.exe with(out) a click |
| 2020-03-28/a> | Didier Stevens | Covid19 Domain Classifier |
| 2020-03-27/a> | Johannes Ullrich | Help us classify Covid19 related domains https://isc.sans.edu/covidclassifier.html (login required) |
| 2020-03-23/a> | Didier Stevens | Windows Zeroday Actively Exploited: Type 1 Font Parsing Remote Code Execution Vulnerability |
| 2020-03-21/a> | Guy Bruneau | Honeypot - Scanning and Targeting Devices & Services |
| 2020-03-16/a> | Jan Kopriva | Desktop.ini as a post-exploitation tool |
| 2020-03-15/a> | Guy Bruneau | VPN Access and Activity Monitoring |
| 2020-03-14/a> | Didier Stevens | Phishing PDF With Incremental Updates. |
| 2020-03-13/a> | Rob VandenBrink | Not all Ethernet NICs are Created Equal - Trying to Capture Invalid Ethernet Frames |
| 2020-03-05/a> | Xavier Mertens | Will You Put Your Password in a Survey? |
| 2020-02-29/a> | Guy Bruneau | Hazelcast IMDG Discover Scan |
| 2020-02-18/a> | Jan Kopriva | Discovering contents of folders in Windows without permissions |
| 2020-02-17/a> | Didier Stevens | curl and SSPI |
| 2020-02-16/a> | Guy Bruneau | SOAR or not to SOAR? |
| 2020-02-15/a> | Didier Stevens | bsdtar on Windows 10 |
| 2020-02-10/a> | Jan Kopriva | Current PayPal phishing campaign or "give me all your personal information" |
| 2020-02-03/a> | Jan Kopriva | Analysis of a triple-encrypted AZORult downloader |
| 2020-02-02/a> | Didier Stevens | Video: Stego & Cryptominers |
| 2020-01-27/a> | Johannes Ullrich | Network Security Perspective on Coronavirus Preparedness |
| 2020-01-25/a> | Guy Bruneau | Is Threat Hunting the new Fad? |
| 2020-01-24/a> | Xavier Mertens | Why Phishing Remains So Popular? |
| 2020-01-21/a> | Russ McRee | DeepBlueCLI: Powershell Threat Hunting |
| 2020-01-16/a> | Jan Kopriva | Picks of 2019 malware - the large, the small and the one full of null bytes |
| 2020-01-09/a> | Kevin Shortt | Windows 7 - End of Life |
| 2020-01-04/a> | Didier Stevens | KringleCon 2019 |
| 2019-12-26/a> | Xavier Mertens | Bypassing UAC to Install a Cryptominer |
| 2019-12-22/a> | Didier Stevens | Extracting VBA Macros From .DWG Files |
| 2019-12-16/a> | Didier Stevens | Malicious .DWG Files? |
| 2019-12-13/a> | Jan Kopriva | Internet banking sites and their use of TLS... and SSLv3... and SSLv2?! |
| 2019-12-06/a> | Jan Kopriva | Phishing with a self-contained credentials-stealing webpage |
| 2019-12-05/a> | Jan Kopriva | E-mail from Agent Tesla |
| 2019-12-04/a> | Jan Kopriva | Analysis of a strangely poetic malware |
| 2019-11-27/a> | Brad Duncan | Finding an Agent Tesla malware sample |
| 2019-11-26/a> | Jan Kopriva | Lessons learned from playing a willing phish |
| 2019-11-25/a> | Xavier Mertens | My Little DoH Setup |
| 2019-11-23/a> | Guy Bruneau | Local Malware Analysis with Malice |
| 2019-11-11/a> | Johannes Ullrich | Are We Going Back to TheMoon (and How is Liquor Involved)? |
| 2019-11-03/a> | Didier Stevens | You Too? "Unusual Activity with Double Base64 Encoding" |
| 2019-10-31/a> | Jan Kopriva | EML attachments in O365 - a recipe for phishing |
| 2019-10-30/a> | Xavier Mertens | Keep an Eye on Remote Access to Mailboxes |
| 2019-10-27/a> | Guy Bruneau | Unusual Activity with Double Base64 Encoding |
| 2019-10-24/a> | Johannes Ullrich | Your Supply Chain Doesn't End At Receiving: How Do You Decommission Network Equipment? |
| 2019-10-20/a> | Guy Bruneau | Scanning Activity for NVMS-9000 Digital Video Recorder |
| 2019-10-17/a> | Jan Kopriva | Phishing e-mail spoofing SPF-enabled domain |
| 2019-10-16/a> | Xavier Mertens | Security Monitoring: At Network or Host Level? |
| 2019-10-10/a> | Rob VandenBrink | Mining Live Networks for OUI Data Oddness |
| 2019-10-09/a> | Brad Duncan | What data does Vidar malware steal from an infected host? |
| 2019-09-27/a> | Xavier Mertens | New Scans for Polycom Autoconfiguration Files |
| 2019-09-19/a> | Xavier Mertens | Blocklisting or Whitelisting in the Right Way |
| 2019-09-07/a> | Guy Bruneau | Unidentified Scanning Activity |
| 2019-08-25/a> | Guy Bruneau | Are there any Advantages of Buying Cyber Security Insurance? |
| 2019-08-15/a> | Didier Stevens | Analysis of a Spearphishing Maldoc |
| 2019-08-09/a> | Xavier Mertens | 100% JavaScript Phishing Page |
| 2019-08-08/a> | Johannes Ullrich | [Guest Diary] The good, the bad and the non-functional, or "how not to do an attack campaign" |
| 2019-07-25/a> | Rob VandenBrink | When Users Attack! Users (and Admins) Thwarting Security Controls |
| 2019-07-17/a> | Xavier Mertens | Analyzis of DNS TXT Records |
| 2019-07-13/a> | Guy Bruneau | Guidance to Protect DNS Against Hijacking & Scanning for Version.BIND Still a Thing |
| 2019-07-08/a> | Didier Stevens | Machine Code? No! |
| 2019-07-07/a> | Rick Wanner | OpSec and OSInt |
| 2019-07-04/a> | Didier Stevens | Machine Code? |
| 2019-07-02/a> | Xavier Mertens | Malicious Script With Multiple Payloads |
| 2019-06-27/a> | Rob VandenBrink | Finding the Gold in a Pile of Pennies - Long Tail Analysis in PowerShell |
| 2019-06-20/a> | Xavier Mertens | Using a Travel Packing App for Infosec Purpose |
| 2019-06-18/a> | Johannes Ullrich | What You Need To Know About TCP "SACK Panic" |
| 2019-06-14/a> | Jim Clausing | A few Ghidra tips for IDA users, part 4 - function call graphs |
| 2019-06-06/a> | Xavier Mertens | Keep an Eye on Your WMI Logs |
| 2019-05-22/a> | Johannes Ullrich | An Update on the Microsoft Windows RDP "Bluekeep" Vulnerability (CVE-2019-0708) [now with pcaps] |
| 2019-05-20/a> | Tom Webb | CVE-2019-0604 Attack |
| 2019-05-13/a> | Xavier Mertens | From Phishing To Ransomware? |
| 2019-05-06/a> | Didier Stevens | Text and Text |
| 2019-05-03/a> | Jim Clausing | A few Ghidra tips for IDA users, part 3 - conversion, labels, and comments |
| 2019-04-24/a> | Rob VandenBrink | Where have all the Domain Admins gone? Rooting out Unwanted Domain Administrators |
| 2019-04-17/a> | Xavier Mertens | Malware Sample Delivered Through UDF Image |
| 2019-04-17/a> | Jim Clausing | A few Ghidra tips for IDA users, part 2 - strings and parameters |
| 2019-04-08/a> | Jim Clausing | A few Ghidra tips for IDA users, part 1 - the decompiler/unreachable code |
| 2019-04-03/a> | Jim Clausing | A few Ghidra tips for IDA users, part 0 - automatic comments for API call parameters |
| 2019-04-02/a> | Johannes Ullrich | Fake AV is Back: LaCie Network Drives Used to Spread Malware |
| 2019-03-27/a> | Xavier Mertens | Running your Own Passive DNS Service |
| 2019-03-21/a> | Xavier Mertens | New Wave of Extortion Emails: Central Intelligence Agency Case |
| 2019-03-05/a> | Rob VandenBrink | Powershell, Active Directory and the Windows Host Firewall |
| 2019-02-28/a> | Tom Webb | Phishing impersonations |
| 2019-02-07/a> | Xavier Mertens | Phishing Kit with JavaScript Keylogger |
| 2019-02-03/a> | Didier Stevens | Video: Analyzing a Simple HTML Phishing Attachment |
| 2019-02-01/a> | Rick Wanner | Sextortion: Follow the Money Part 3 - The cashout begins! |
| 2019-01-31/a> | Xavier Mertens | Tracking Unexpected DNS Changes |
| 2019-01-30/a> | Russ McRee | CR19-010: The United States vs. Huawei |
| 2019-01-29/a> | Johannes Ullrich | A Not So Well Done Phish (Why Attackers need to Implement IPv6 Now! ;-) ) |
| 2019-01-24/a> | Brad Duncan | Malspam with Word docs uses macro to run Powershell script and steal system data |
| 2019-01-18/a> | John Bambenek | Sextortion Bitcoin on the Move |
| 2019-01-14/a> | Rob VandenBrink | Still Running Windows 7? Time to think about that upgrade project! |
| 2019-01-10/a> | Brad Duncan | Heartbreaking Emails: "Love You" Malspam |
| 2019-01-02/a> | Lorna Hutcheson | Gift Card Scams on the rise |
| 2019-01-02/a> | Xavier Mertens | Malicious Script Leaking Data via FTP |
| 2018-12-27/a> | Didier Stevens | Matryoshka Phish |
| 2018-12-26/a> | Didier Stevens | Bitcoin "Blocklists" |
| 2018-12-23/a> | Guy Bruneau | Scanning Activity, end Goal is to add Hosts to Mirai Botnet |
| 2018-12-22/a> | Didier Stevens | KringleCon 2018 |
| 2018-12-21/a> | Lorna Hutcheson | Phishing Attempts That Bypass 2FA |
| 2018-12-19/a> | Xavier Mertens | Restricting PowerShell Capabilities with NetSh |
| 2018-12-19/a> | Xavier Mertens | Microsoft OOB Patch for Internet Explorer: Scripting Engine Memory Corruption Vulnerability |
| 2018-12-16/a> | Guy Bruneau | Random Port Scan for Open RDP Backdoor |
| 2018-12-13/a> | Xavier Mertens | Phishing Attack Through Non-Delivery Notification |
| 2018-12-09/a> | Didier Stevens | Quickie: String Analysis is Still Useful |
| 2018-11-30/a> | Remco Verhoef | CoinMiners searching for hosts |
| 2018-11-22/a> | Xavier Mertens | Divided Payload in Multiple Pasties |
| 2018-11-20/a> | Xavier Mertens | Querying DShield from Cortex |
| 2018-11-18/a> | Guy Bruneau | Multipurpose PCAP Analysis Tool |
| 2018-11-17/a> | Xavier Mertens | Quickly Investigating Websites with Lookyloo |
| 2018-11-15/a> | Brad Duncan | Emotet infection with IcedID banking Trojan |
| 2018-11-14/a> | Brad Duncan | Day in the life of a researcher: Finding a wave of Trickbot malspam |
| 2018-11-12/a> | Rick Wanner | Using the Neutrino ip-blocklist API to test general badness of an IP |
| 2018-11-11/a> | Pasquale Stirparo | Community contribution: joining forces or multiply solutions? |
| 2018-10-26/a> | Xavier Mertens | Dissecting Malicious Office Documents with Linux |
| 2018-10-17/a> | Russ McRee | RedHunt Linux - Adversary Emulation, Threat Hunting & Intelligence |
| 2018-09-28/a> | Xavier Mertens | More Excel DDE Code Injection |
| 2018-09-20/a> | Xavier Mertens | Hunting for Suspicious Processes with OSSEC |
| 2018-09-13/a> | Xavier Mertens | Malware Delivered Through MHT Files |
| 2018-09-07/a> | Xavier Mertens | Crypto Mining in a Windows Headless Browser |
| 2018-09-05/a> | Rob VandenBrink | Where have all my Certificates gone? (And when do they expire?) |
| 2018-09-05/a> | Xavier Mertens | Malicious PowerShell Compiling C# Code on the Fly |
| 2018-08-30/a> | Xavier Mertens | Crypto Mining Is More Popular Than Ever! |
| 2018-08-29/a> | Xavier Mertens | 3D Printers in The Wild, What Can Go Wrong? |
| 2018-08-26/a> | Didier Stevens | Identifying numeric obfuscation |
| 2018-08-23/a> | Xavier Mertens | Simple Phishing Through formcrafts.com |
| 2018-08-12/a> | Didier Stevens | A URL shortener handy for phishers |
| 2018-08-10/a> | Remco Verhoef | Hunting SSL/TLS clients using JA3 |
| 2018-08-06/a> | Didier Stevens | Numeric obfuscation: another example |
| 2018-08-05/a> | Didier Stevens | Video: Maldoc analysis with standard Linux tools |
| 2018-08-04/a> | Didier Stevens | Dealing with numeric obfuscation in malicious scripts |
| 2018-07-30/a> | Xavier Mertens | Exploiting the Power of Curl |
| 2018-07-29/a> | Guy Bruneau | Using RITA for Threat Analysis |
| 2018-07-21/a> | Didier Stevens | BTC pickpockets are back |
| 2018-07-17/a> | Xavier Mertens | Searching for Geographically Improbable Login Attempts |
| 2018-07-15/a> | Didier Stevens | Video: Retrieving and processing JSON data (BTC example) |
| 2018-07-15/a> | Didier Stevens | Extracting BTC addresses from emails |
| 2018-07-14/a> | Didier Stevens | Retrieving and processing JSON data (BTC example) |
| 2018-07-13/a> | Xavier Mertens | Cryptominer Delivered Though Compromized JavaScript File |
| 2018-07-03/a> | Didier Stevens | Progress indication for scripts on Windows |
| 2018-07-02/a> | Guy Bruneau | Hello Peppa! - PHP Scans |
| 2018-07-01/a> | Didier Stevens | Video: Analyzing XPS Files |
| 2018-06-30/a> | Didier Stevens | XPS samples |
| 2018-06-26/a> | Didier Stevens | Analyzing XPS files |
| 2018-06-22/a> | Lorna Hutcheson | XPS Attachment Used for Phishing |
| 2018-06-21/a> | Xavier Mertens | Are Your Hunting Rules Still Working? |
| 2018-06-19/a> | Xavier Mertens | PowerShell: ScriptBlock Logging... Or Not? |
| 2018-06-13/a> | Xavier Mertens | A Bunch of Compromized Wordpress Sites |
| 2018-06-07/a> | Remco Verhoef | Automated twitter loot collection |
| 2018-06-05/a> | Xavier Mertens | Malicious Post-Exploitation Batch File |
| 2018-05-24/a> | Xavier Mertens | "Blocked" Does Not Mean "Forget It" |
| 2018-05-22/a> | Xavier Mertens | Malware Distributed via .slk Files |
| 2018-05-09/a> | Xavier Mertens | Nice Phishing Sample Delivering Trickbot |
| 2018-05-07/a> | Xavier Mertens | Adding Persistence Via Scheduled Tasks |
| 2018-05-03/a> | Renato Marinho | WebLogic Exploited in the Wild (Again) |
| 2018-05-02/a> | Russ McRee | Windows Commands Reference - An InfoSec Must Have |
| 2018-03-12/a> | Xavier Mertens | Payload delivery via SMB |
| 2018-03-05/a> | Xavier Mertens | Malicious Bash Script with Multiple Features |
| 2018-03-04/a> | Xavier Mertens | The Crypto Miners Fight For CPU Cycles |
| 2018-03-02/a> | Xavier Mertens | Common Patterns Used in Phishing Campaigns Files |
| 2018-02-25/a> | Guy Bruneau | Blackhole Advertising Sites with Pi-hole |
| 2018-02-01/a> | Xavier Mertens | Adaptive Phishing Kit |
| 2018-01-31/a> | Tom Webb | Tax Phishing Time |
| 2018-01-25/a> | Xavier Mertens | Ransomware as a Service |
| 2018-01-20/a> | Didier Stevens | An RTF phish |
| 2018-01-13/a> | Rick Wanner | Flaw in Intel's Active Management Technology (AMT) |
| 2018-01-11/a> | Xavier Mertens | Mining or Nothing! |
| 2018-01-07/a> | Guy Bruneau | SSH Scans by Clients Types |
| 2018-01-03/a> | John Bambenek | Phishing to Rural America Leads to Six-figure Wire Fraud Losses |
| 2018-01-02/a> | Didier Stevens | PDF documents & URLs: video |
| 2018-01-01/a> | Didier Stevens | What is new? |
| 2017-12-27/a> | Guy Bruneau | What are your Security Challenges for 2018? |
| 2017-12-19/a> | Xavier Mertens | Example of 'MouseOver' Link in a Powerpoint File |
| 2017-12-14/a> | Russ McRee | Security Planner: Improve your online safety |
| 2017-12-13/a> | Xavier Mertens | Tracking Newly Registered Domains |
| 2017-12-05/a> | Tom Webb | IR using the Hive Project. |
| 2017-12-02/a> | Xavier Mertens | Using Bad Material for the Good |
| 2017-12-01/a> | Xavier Mertens | Phishing Kit (Ab)Using Cloud Services |
| 2017-11-29/a> | Xavier Mertens | Fileless Malicious PowerShell Sample |
| 2017-11-25/a> | Guy Bruneau | Benefits associated with the use of Open Source Software |
| 2017-11-23/a> | Xavier Mertens | Proactive Malicious Domain Search |
| 2017-11-17/a> | Xavier Mertens | Top-100 Malicious IP STIX Feed |
| 2017-11-16/a> | Xavier Mertens | Suspicious Domains Tracking Dashboard |
| 2017-11-15/a> | Xavier Mertens | If you want something done right, do it yourself! |
| 2017-11-13/a> | Guy Bruneau | jsonrpc Scanning for root account |
| 2017-11-13/a> | Guy Bruneau | VBE Embeded Script (info.zip) |
| 2017-11-11/a> | Xavier Mertens | Keep An Eye on your Root Certificates |
| 2017-11-10/a> | Bojan Zdrnja | Battling e-mail phishing |
| 2017-11-05/a> | Didier Stevens | Extracting the text from PDF documents |
| 2017-11-04/a> | Didier Stevens | PDF documents & URLs |
| 2017-11-01/a> | Rob VandenBrink | Securing SSH Services - Go Blue Team!! |
| 2017-10-18/a> | Renato Marinho | Baselining Servers to Detect Outliers |
| 2017-10-06/a> | Johannes Ullrich | What's in a cable? The dangers of unauthorized cables |
| 2017-10-02/a> | Xavier Mertens | Investigating Security Incidents with Passive DNS |
| 2017-09-30/a> | Lorna Hutcheson | Who's Borrowing your Resources? |
| 2017-09-25/a> | Renato Marinho | XPCTRA Malware Steals Banking and Digital Wallet User's Credentials |
| 2017-09-22/a> | Russell Eubanks | What is the State of Your Union? |
| 2017-09-18/a> | Xavier Mertens | Getting some intelligence from malspam |
| 2017-09-18/a> | Johannes Ullrich | SANS Securingthehuman posted a follow up to their Equifax breach webcast: https://securingthehuman.sans.org/blog/2017/09/15/equifax-webcast-follow-up |
| 2017-09-17/a> | Guy Bruneau | rockNSM as a Incident Response Package |
| 2017-09-13/a> | Rob VandenBrink | Sysinternals Update: Sysmon v6.10, Process Monitor v3.40, Autoruns v13.80, AccessChk v6.11 - https://blogs.technet.microsoft.com/sysinternals/2017/09/12/sysinternals-update-sysmon-v6-1-process-monitor-v3-4-autoruns-v13-8-accesschk-v6-11/ |
| 2017-09-11/a> | Russ McRee | Windows Auditing with WINspect |
| 2017-09-06/a> | Adrien de Beaupre | Modern Web Application Penetration Testing , Hash Length Extension Attacks |
| 2017-09-02/a> | Xavier Mertens | AutoIT based malware back in the wild |
| 2017-08-24/a> | Bojan Zdrnja | Free Bitcoins? Why not? |
| 2017-08-18/a> | Renato Marinho | EngineBox Malware Supports 10+ Brazilian Banks |
| 2017-08-16/a> | Xavier Mertens | Analysis of a Paypal phishing kit |
| 2017-08-15/a> | Brad Duncan | Malspam pushing Trickbot banking Trojan |
| 2017-08-13/a> | Didier Stevens | The Good Phishing Email |
| 2017-08-07/a> | Xavier Mertens | Increase of phpMyAdmin scans |
| 2017-07-30/a> | Guy Bruneau | Text Banking Scams |
| 2017-07-24/a> | Russell Eubanks | Trends Over Time |
| 2017-07-16/a> | Renato Marinho | SMS Phishing induces victims to photograph its own token card |
| 2017-07-12/a> | Xavier Mertens | Backup Scripts, the FIM of the Poor |
| 2017-07-09/a> | Russ McRee | Adversary hunting with SOF-ELK |
| 2017-07-05/a> | Didier Stevens | Selecting domains with random names |
| 2017-06-27/a> | Brad Duncan | A Tale of Two Phishies |
| 2017-06-17/a> | Guy Bruneau | Mapping Use Cases to Logs. Which Logs are the Most Important to Collect? |
| 2017-06-15/a> | Bojan Zdrnja | Uberscammers |
| 2017-06-14/a> | Xavier Mertens | Systemd Could Fallback to Google DNS? |
| 2017-06-08/a> | Tom Webb | Summer STEM for Kids |
| 2017-06-02/a> | Xavier Mertens | Phishing Campaigns Follow Trends |
| 2017-06-01/a> | Xavier Mertens | Sharing Private Data with Webcast Invitations |
| 2017-05-31/a> | Pasquale Stirparo | Analysis of Competing Hypotheses, WCry and Lazarus (ACH part 2) |
| 2017-05-28/a> | Pasquale Stirparo | Analysis of Competing Hypotheses (ACH part 1) |
| 2017-05-28/a> | Guy Bruneau | CyberChef a Must Have Tool in your Tool bag! |
| 2017-05-20/a> | Xavier Mertens | Typosquatting: Awareness and Hunting |
| 2017-05-13/a> | Guy Bruneau | Has anyone Tested WannaCry Killswitch? - https://blog.didierstevens.com/2017/05/13/quickpost-wcry-killswitch-check-is-not-proxy-aware/ |
| 2017-05-06/a> | Xavier Mertens | The story of the CFO and CEO... |
| 2017-05-05/a> | Xavier Mertens | HTTP Headers... the Achilles' heel of many applications |
| 2017-05-03/a> | Bojan Zdrnja | OAUTH phishing against Google Docs ? beware! |
| 2017-04-22/a> | Jim Clausing | WTF tcp port 81 |
| 2017-04-20/a> | Xavier Mertens | DNS Query Length... Because Size Does Matter |
| 2017-04-18/a> | Johannes Ullrich | Yet Another Apple Phish and Some DNS Lessons Learned From It |
| 2017-04-16/a> | Johannes Ullrich | Tool to Detect Active Phishing Attacks Using Unicode Look-Alike Domains |
| 2017-03-28/a> | Xavier Mertens | Logical & Physical Security Correlation |
| 2017-03-24/a> | Xavier Mertens | Nicely Obfuscated JavaScript Sample |
| 2017-03-15/a> | Xavier Mertens | Retro Hunting! |
| 2017-03-06/a> | Renato Marinho | A very convincing Typosquatting + Social Engineering campaign is targeting Santander corporate customers in Brazil |
| 2017-02-12/a> | Xavier Mertens | Analysis of a Suspicious Piece of JavaScript |
| 2017-02-05/a> | Xavier Mertens | Many Malware Samples Found on Pastebin |
| 2017-02-02/a> | Rick Wanner | Multiple vulnerabilities discovered in popular printer models |
| 2017-02-01/a> | Xavier Mertens | Quick Analysis of Data Left Available by Attackers |
| 2017-01-18/a> | Rob VandenBrink | Making Windows 10 a bit less "Creepy" - Common Privacy Settings |
| 2017-01-12/a> | Mark Baggett | Some tools updates |
| 2017-01-12/a> | Mark Baggett | System Resource Utilization Monitor |
| 2017-01-11/a> | Johannes Ullrich | January 2017 Edition of Ouch! Security Awareness Newsletter Released: https://securingthehuman.sans.org/ouch |
| 2017-01-10/a> | Johannes Ullrich | Realtors Be Aware: You Are a Target |
| 2017-01-10/a> | Johannes Ullrich | Port 37777 "MapTable" Requests |
| 2017-01-06/a> | John Bambenek | Great Misadventures of Security Vendors: Absurd Sandboxing Edition |
| 2017-01-04/a> | John Bambenek | Mixed Messages : Novel Phishing Attempts Trying to Steal Your E-mail Password Goes Wrong |
| 2016-11-23/a> | Tom Webb | Mapping Attack Methodology to Controls |
| 2016-11-22/a> | Didier Stevens | Update:ZIP With Comment |
| 2016-11-18/a> | Didier Stevens | VBA Shellcode and Windows 10 |
| 2016-11-16/a> | Xavier Mertens | Example of Getting Analysts & Researchers Away |
| 2016-11-13/a> | Guy Bruneau | Bitcoin Miner File Upload via FTP |
| 2016-11-11/a> | Rick Wanner | Benevolent malware? reincarna/Linux.Wifatch |
| 2016-11-02/a> | Rob VandenBrink | What Does a Pentest Look Like? |
| 2016-10-25/a> | Xavier Mertens | Another Day, Another Spam... |
| 2016-10-10/a> | Didier Stevens | Radare2: rahash2 |
| 2016-10-08/a> | Russell Eubanks | Unauthorized Change Detected! |
| 2016-10-02/a> | Guy Bruneau | Is there an Infosec Cybersecurity Talent Shortage? |
| 2016-09-25/a> | Pasquale Stirparo | Defining Threat Intelligence Requirements |
| 2016-09-04/a> | Russ McRee | Kali Linux 2016.2 Release: https://www.kali.org/news/kali-linux-20162-release/ |
| 2016-09-01/a> | Xavier Mertens | Maxmind.com (Ab)used As Anti-Analysis Technique |
| 2016-08-29/a> | Russ McRee | Recommended Reading: Intrusion Detection Using Indicators of Compromise Based on Best Practices and Windows Event Logs |
| 2016-08-24/a> | Tom Webb | Stay on Track During IR |
| 2016-08-23/a> | Xavier Mertens | Voice Message Notifications Deliver Ransomware |
| 2016-08-02/a> | Tom Webb | Windows 10 Anniversary Update Available |
| 2016-07-31/a> | Pasquale Stirparo | Sharing (intel) is caring... or not? |
| 2016-07-27/a> | Xavier Mertens | Analyze of a Linux botnet client source code |
| 2016-07-21/a> | Didier Stevens | Practice ntds.dit File |
| 2016-07-15/a> | Xavier Mertens | Name All the Things! |
| 2016-07-12/a> | Xavier Mertens | Hunting for Malicious Files with MISP + OSSEC |
| 2016-07-03/a> | Guy Bruneau | Is Data Privacy part of your Company's Culture? |
| 2016-06-29/a> | Xavier Mertens | Phishing Campaign with Blurred Images |
| 2016-06-12/a> | Guy Bruneau | DNS Sinkhole ISO Version 2.0 |
| 2016-06-03/a> | Tom Liston | MySQL is YourSQL |
| 2016-06-01/a> | Xavier Mertens | Docker Containers Logging |
| 2016-05-29/a> | Guy Bruneau | Analysis of a Distributed Denial of Service (DDoS) |
| 2016-05-22/a> | Pasquale Stirparo | The strange case of WinZip MRU Registry key |
| 2016-05-21/a> | Didier Stevens | Python Malware - Part 2 |
| 2016-05-18/a> | Russ McRee | Resources: Windows Auditing & Monitoring, Linux 2FA |
| 2016-05-14/a> | Guy Bruneau | INetSim as a Basic Honeypot |
| 2016-05-12/a> | Xavier Mertens | Another Day, Another Wave of Phishing Emails |
| 2016-05-08/a> | Jim Clausing | Guest Diary: Linux Capabilities - A friend and foe |
| 2016-05-05/a> | Xavier Mertens | Microsoft BITS Used to Download Payloads |
| 2016-05-02/a> | Rick Wanner | Lean Threat Intelligence |
| 2016-04-29/a> | Rob VandenBrink | Sysinternals Updated today - Updates to Sysmon, Procdump and Sigcheck. https://blogs.technet.microsoft.com/sysinternals/2016/04/28/update-sysmon-v4-procdump-v8-sigcheck-v2-51/ |
| 2016-04-15/a> | Xavier Mertens | Windows Command Line Persistence? |
| 2016-04-02/a> | Russell Eubanks | Why Can't We Be Friends? |
| 2016-03-30/a> | Xavier Mertens | What to watch with your FIM? |
| 2016-03-28/a> | Xavier Mertens | Improving Bash Forensics Capabilities |
| 2016-03-21/a> | Xavier Mertens | IP Addresses Triage |
| 2016-02-24/a> | Xavier Mertens | Analyzis of a Malicious .lnk File with an Embedded Payload |
| 2016-02-18/a> | Xavier Mertens | Hunting for Executable Code in Windows Environments |
| 2016-02-15/a> | Bojan Zdrnja | Exploiting (pretty) blind SQL injections |
| 2016-02-07/a> | Xavier Mertens | More Malicious JavaScript Obfuscation |
| 2016-02-02/a> | Johannes Ullrich | Targeted IPv6 Scans Using pool.ntp.org . |
| 2016-01-31/a> | Guy Bruneau | Windows 10 and System Protection for DATA Default is OFF |
| 2016-01-23/a> | Didier Stevens | Sigcheck and VirusTotal for Offline Machine |
| 2016-01-20/a> | Xavier Mertens | /tmp, %TEMP%, ~/Desktop, T:\, ... A goldmine for pentesters! |
| 2016-01-13/a> | Alex Stanford | You Have Got a New Audio Message - Guest Diary by Pasquale Stirparo |
| 2016-01-09/a> | Xavier Mertens | Virtual Bitlocker Containers |
| 2015-12-24/a> | Xavier Mertens | Unity Makes Strength |
| 2015-12-12/a> | Russell Eubanks | What Signs Are You Missing? |
| 2015-12-10/a> | Rob VandenBrink | Uninstalling Problem Applications using Powershell |
| 2015-12-10/a> | Rob VandenBrink | New Burp Feature - ClickBandit |
| 2015-12-09/a> | Xavier Mertens | Enforcing USB Storage Policy with PowerShell |
| 2015-12-04/a> | Tom Webb | Automating Phishing Analysis using BRO |
| 2015-11-21/a> | Didier Stevens | Maldoc Social Engineering Trick |
| 2015-11-09/a> | John Bambenek | ICYMI: Widespread Unserialize Vulnerability in Java |
| 2015-10-20/a> | Bojan Zdrnja | When encoding saves the day |
| 2015-10-12/a> | Guy Bruneau | Data Visualization,What is your Tool of Choice? |
| 2015-09-29/a> | Pedro Bueno | Tricks for DLL analysis |
| 2015-09-23/a> | Daniel Wesemann | Making our users unlearn what we taught them |
| 2015-09-21/a> | Xavier Mertens | Detecting XCodeGhost Activity |
| 2015-09-03/a> | Xavier Mertens | Querying the DShield API from RTIR |
| 2015-08-19/a> | Bojan Zdrnja | Outsourcing critical infrastructure (such as DNS) |
| 2015-08-18/a> | Russ McRee | Microsoft Security Bulletin MS15-093 - Critical OOB - Internet Explorer RCE |
| 2015-08-16/a> | Guy Bruneau | Are you a "Hunter"? |
| 2015-08-12/a> | Rob VandenBrink | Windows Service Accounts - Why They're Evil and Why Pentesters Love them! |
| 2015-08-06/a> | Didier Stevens | Sigcheck and virustotal-search |
| 2015-07-23/a> | Mark Hofman | Some more 0-days from ZDI |
| 2015-07-21/a> | Didier Stevens | Searching Through the VirusTotal Database |
| 2015-07-17/a> | Didier Stevens | Process Explorer and VirusTotal |
| 2015-07-17/a> | Didier Stevens | Autoruns and VirusTotal |
| 2015-07-17/a> | Didier Stevens | Sigcheck and VirusTotal |
| 2015-07-03/a> | Didier Stevens | Analyzing Quarantine Files |
| 2015-06-29/a> | Rob VandenBrink | The Powershell Diaries 2 - Software Inventory |
| 2015-06-27/a> | Guy Bruneau | Is Windows XP still around in your Network a year after Support Ended? |
| 2015-06-22/a> | Johannes Ullrich | SMTP Brute Forcing |
| 2015-06-01/a> | Tom Webb | Submit Dshield ASA Logs |
| 2015-05-30/a> | Russell Eubanks | Weekend Learning - Spoofer Project |
| 2015-05-27/a> | Tom Webb | SYSINTERNALS Update(AccessChk v6.0, Autoruns v13.4, Process Monitor v3.2, VMMap v3.2) |
| 2015-05-14/a> | Daniel Wesemann | Oh Bloat! |
| 2015-04-27/a> | Richard Porter | When Prevention Fails, Incident Response Begins |
| 2015-04-17/a> | Didier Stevens | Memory Forensics Of Network Devices |
| 2015-04-10/a> | Didier Stevens | The Kill Chain: Now With Pastebin |
| 2015-04-03/a> | Didier Stevens | SSH Fingerprints Are Important |
| 2015-03-26/a> | Daniel Wesemann | Pin-up on your Smartphone! |
| 2015-03-07/a> | Guy Bruneau | Should it be Mandatory to have an Independent Security Audit after a Breach? |
| 2015-02-19/a> | Daniel Wesemann | DNS-based DDoS |
| 2015-02-06/a> | Johannes Ullrich | Anthem, TurboTax and How Things "Fit Together" Sometimes |
| 2015-02-04/a> | Alex Stanford | Exploit Kit Evolution - Neutrino |
| 2015-01-31/a> | Guy Bruneau | Beware of Phishing and Spam Super Bowl Fans! |
| 2015-01-29/a> | Bojan Zdrnja | Blindly confirming XXE |
| 2015-01-23/a> | Adrien de Beaupre | Infocon change to yellow for Adobe Flash issues |
| 2014-12-24/a> | Rick Wanner | Incident Response at Sony |
| 2014-12-23/a> | John Bambenek | How I learned to stop worrying and love malware DGAs.... |
| 2014-11-27/a> | Russ McRee | Syrian Electronic Army attack leads to malvertising |
| 2014-11-25/a> | Adrien de Beaupre | Less is, umm, less? |
| 2014-09-27/a> | Guy Bruneau | What has Bash and Heartbleed Taught Us? |
| 2014-09-26/a> | Richard Porter | Why We Have Moved to InfoCon:Yellow |
| 2014-09-22/a> | Johannes Ullrich | Fake LogMeIn Certificate Update with Bad AV Detection Rate |
| 2014-09-19/a> | Guy Bruneau | Web Scan looking for /info/whitelist.pac |
| 2014-09-16/a> | Daniel Wesemann | https://yourfakebank.support -- TLD confusion starts! |
| 2014-09-12/a> | Chris Mohan | Are credential dumps worth reviewing? |
| 2014-09-07/a> | Johannes Ullrich | Odd Persistent Password Bruteforcing |
| 2014-08-27/a> | Rob VandenBrink | One More Day of Trolling in POS Memory |
| 2014-08-20/a> | Kevin Shortt | Social Engineering Alive and Well |
| 2014-08-16/a> | Lenny Zeltser | Web Server Attack Investigation - Installing a Bot and Reverse Shell via a PHP Vulnerability |
| 2014-08-15/a> | Tom Webb | AppLocker Event Logs with OSSEC 2.8 |
| 2014-08-12/a> | Adrien de Beaupre | Sysinternals updates Sysmon v1.0; Updates: Autoruns v12.01, Coreinfo v3.3, Procexp v16.03 http://blogs.technet.com/b/sysinternals/ |
| 2014-08-10/a> | Basil Alawi S.Taher | Incident Response with Triage-ir |
| 2014-08-09/a> | Adrien de Beaupre | Complete application ownage via Multi-POST XSRF |
| 2014-08-04/a> | Russ McRee | Threats & Indicators: A Security Intelligence Lifecycle |
| 2014-07-30/a> | Rick Wanner | Symantec Endpoint Protection Privilege Escalation Zero Day |
| 2014-07-26/a> | Chris Mohan | "Internet scanning project" scans |
| 2014-07-23/a> | Johannes Ullrich | New Feature: "Live" SSH Brute Force Logs and New Kippo Client |
| 2014-07-15/a> | Daniel Wesemann | Oracle July 2014 CPU (patch bundle) |
| 2014-07-14/a> | Johannes Ullrich | The Internet of Things: How do you "on-board" devices? |
| 2014-07-14/a> | Daniel Wesemann | E-ZPass phishing scam |
| 2014-07-09/a> | Daniel Wesemann | Who owns your typo? |
| 2014-07-07/a> | Johannes Ullrich | Multi Platform *Coin Miner Attacking Routers on Port 32764 |
| 2014-07-06/a> | Richard Porter | Physical Access, Point of Sale, Vegas |
| 2014-07-05/a> | Guy Bruneau | Java Support ends for Windows XP |
| 2014-07-02/a> | Johannes Ullrich | July Ouch! Security Awareness Newsletter Released. E-mail Do's and Don'ts http://www.securingthehuman.org/resources/newsletters/ouch/2014#july2014 |
| 2014-06-23/a> | Russ McRee | Microsoft Interflow announced today at 26th FIRST conference |
| 2014-06-12/a> | Guy Bruneau | BIND Security Update for CVE-2014-3859 |
| 2014-06-12/a> | Daniel Wesemann | Made any new friends lately? |
| 2014-05-23/a> | Richard Porter | Highlights from Cisco Live 2014 - The Internet of Everything |
| 2014-05-22/a> | Johannes Ullrich | Discontinuing Support for ISC Alert Task Bar Icon |
| 2014-05-01/a> | Johannes Ullrich | Busybox Honeypot Fingerprinting and a new DVR scanner |
| 2014-04-26/a> | Guy Bruneau | Android Users - Beware of Bitcoin Mining Malware |
| 2014-04-26/a> | Guy Bruneau | New Project by Linux Foundation - Core Infrastructure Initiative |
| 2014-04-14/a> | Kevin Shortt | INFOCon Green: Heartbleed - on the mend |
| 2014-04-11/a> | Guy Bruneau | Heartbleed Fix Available for Download for Cisco Products |
| 2014-04-06/a> | Basil Alawi S.Taher | "Power Worm" PowerShell based Malware |
| 2014-04-05/a> | Jim Clausing | Those strange e-mails with URLs in them can lead to Android malware |
| 2014-04-04/a> | Rob VandenBrink | Dealing with Disaster - A Short Malware Incident Response |
| 2014-04-04/a> | Rob VandenBrink | Windows 8.1 Released |
| 2014-04-01/a> | Johannes Ullrich | cmd.so Synology Scanner Also Found on Routers |
| 2014-03-27/a> | Alex Stanford | Apple Credential Phishing via appleidconfirm.net |
| 2014-03-25/a> | Johannes Ullrich | A few updates on "The Moon" worm |
| 2014-03-24/a> | Johannes Ullrich | New Microsoft Advisory: Unpatched Word Flaw used in Targeted Attacks |
| 2014-03-22/a> | Guy Bruneau | How the Compromise of a User Account Lead to a Spam Incident |
| 2014-03-12/a> | Johannes Ullrich | Wordpress "Pingback" DDoS Attacks |
| 2014-03-10/a> | Basil Alawi S.Taher | Sysinternals Process Explorer v16.02, Process Monitor v3.1, PSExec v2.1 and Sigcheck v2.03 update |
| 2014-03-07/a> | Tom Webb | Linux Memory Dump with Rekall |
| 2014-03-04/a> | Daniel Wesemann | XPired! |
| 2014-03-02/a> | Stephen Hall | Sunday Reading |
| 2014-02-28/a> | Daniel Wesemann | Oversharing |
| 2014-02-19/a> | Russ McRee | Threat modeling in the name of security |
| 2014-02-18/a> | Johannes Ullrich | More Details About "TheMoon" Linksys Worm |
| 2014-02-15/a> | Rob VandenBrink | More on HNAP - What is it, How to Use it, How to Find it |
| 2014-02-13/a> | Johannes Ullrich | Linksys Worm ("TheMoon") Captured |
| 2014-02-12/a> | Johannes Ullrich | Suspected Mass Exploit Against Linksys E1000 / E1200 Routers |
| 2014-02-10/a> | Rob VandenBrink | Isn't it About Time to Get Moving on Chip and PIN? |
| 2014-02-07/a> | Rob VandenBrink | Hello Virustotal? It's Microsoft Calling. |
| 2014-02-04/a> | Johannes Ullrich | Odd ICMP Echo Request Payload |
| 2014-01-30/a> | Johannes Ullrich | New gTLDs appearing in the root zone |
| 2014-01-24/a> | Johannes Ullrich | How to send mass e-mail the right way |
| 2014-01-24/a> | Chris Mohan | Phishing via Social Media |
| 2014-01-23/a> | Chris Mohan | Learning from the breaches that happens to others Part 2 |
| 2014-01-22/a> | Chris Mohan | Learning from the breaches that happens to others |
| 2014-01-11/a> | Guy Bruneau | tcpflow 1.4.4 and some of its most Interesting Features |
| 2014-01-10/a> | Basil Alawi S.Taher | Windows Autorun-3 |
| 2014-01-10/a> | Basil Alawi S.Taher | Cisco Small Business Devices backdoor fix |
| 2014-01-04/a> | Tom Webb | Monitoring Windows Networks Using Syslog (Part One) |
| 2014-01-02/a> | John Bambenek | OpenSSL.org Defaced by Attackers Gaining Access to Hypervisor |
| 2014-01-02/a> | Johannes Ullrich | Scans Increase for New Linksys Backdoor (32764/TCP) |
| 2013-12-24/a> | Daniel Wesemann | Unfriendly crontab additions |
| 2013-12-21/a> | Daniel Wesemann | Adobe phishing underway |
| 2013-12-21/a> | Guy Bruneau | Strange DNS Queries - Request for Packets |
| 2013-12-19/a> | Rob VandenBrink | Passive Scanning Two Ways - How-Tos for the Holidays |
| 2013-12-19/a> | Rob VandenBrink | Target US - Credit Card Data Breach |
| 2013-12-16/a> | Tom Webb | The case of Minerd |
| 2013-12-11/a> | Johannes Ullrich | Facebook Phishing and Malware via Tumblr Redirects |
| 2013-12-09/a> | Rob VandenBrink | Scanning without Scanning |
| 2013-12-07/a> | Guy Bruneau | Suspected Active Rovnix Botnet Controller |
| 2013-12-02/a> | Richard Porter | Reports of higher than normal SSH Attacks |
| 2013-12-01/a> | Richard Porter | BPF, PCAP, Binary, hex, why they matter? |
| 2013-11-30/a> | Russ McRee | A review of Tubes, A Journey to the Center of the Internet |
| 2013-11-27/a> | Rob VandenBrink | ATM Traffic + TCPDump + Video = Good or Evil? |
| 2013-11-19/a> | Johannes Ullrich | vBulletin.com Compromise - Possible 0-day |
| 2013-11-18/a> | Johannes Ullrich | Am I Sending Traffic to a "Sinkhole"? |
| 2013-11-15/a> | Johannes Ullrich | The Security Impact of HTTP Caching Headers |
| 2013-11-11/a> | Johannes Ullrich | What Happened to the SANS Ads? |
| 2013-11-04/a> | Manuel Humberto Santander Pelaez | When attackers use your DNS to check for the sites you are visiting |
| 2013-11-01/a> | Russ McRee | Secunia's PSI Country Report - Q3 2013 |
| 2013-10-30/a> | Russ McRee | SIR v15: Five good reasons to leave Windows XP behind |
| 2013-10-25/a> | Rob VandenBrink | Kaspersky flags TCPIP.SYS as Malware |
| 2013-10-25/a> | Johannes Ullrich | PHP.net compromise aftermath: Why Code Signing Beats Hashes |
| 2013-10-22/a> | Richard Porter | Greenbone and OpenVAS Scanner |
| 2013-10-21/a> | Johannes Ullrich | New tricks that may bring DNS spoofing back or: "Why you should enable DNSSEC even if it is a pain to do" |
| 2013-10-19/a> | Johannes Ullrich | Yet Another WHMCS SQL Injection Exploit |
| 2013-10-17/a> | Adrien de Beaupre | Internet wide DNS scanning |
| 2013-10-04/a> | Pedro Bueno | CSAM: WebHosting BruteForce logs |
| 2013-10-01/a> | John Bambenek | *Metaspoit Releases Module to Exploit Unpatched IE Vuln CVE-2013-3893 |
| 2013-09-20/a> | Russ McRee | Threat Level Yellow: Protection recommendations regarding Internet Explorer exploits in the wild |
| 2013-09-17/a> | John Bambenek | Microsoft Releases Out-of-Band Advisory for all Versions of Internet Explorer |
| 2013-09-09/a> | Johannes Ullrich | SSL is broken. So what? |
| 2013-09-05/a> | Rob VandenBrink | Building Your Own GPU Enabled Private Cloud |
| 2013-09-02/a> | Guy Bruneau | Snort IDS Sensor with Sguil New ISO Released |
| 2013-08-26/a> | Alex Stanford | Stop, Drop and File Carve |
| 2013-08-22/a> | Russ McRee | Read of the Week: A Fuzzy Future in Malware Research |
| 2013-08-19/a> | Johannes Ullrich | Running Snort on ESXi using the Distributed Switch |
| 2013-08-19/a> | Rob VandenBrink | ZMAP 1.02 released |
| 2013-08-14/a> | Johannes Ullrich | Imaging LUKS Encrypted Drives |
| 2013-08-13/a> | Swa Frantzen | Microsoft security advisories: RDP and MD5 deprecation in Microsoft root certificates |
| 2013-08-09/a> | Kevin Shortt | Copy Machines - Changing Scanned Content |
| 2013-08-05/a> | Chris Mohan | DMARC: another step forward in the fight against phishing? |
| 2013-07-31/a> | Johannes Ullrich | POP3 Server Brute Forcing Attempts Using Polycom Credentials |
| 2013-07-26/a> | Scott Fendley | ISC BIND DoS |
| 2013-07-20/a> | Manuel Humberto Santander Pelaez | Do you have rogue Internet gateways in your network? Check it with nmap |
| 2013-07-19/a> | Stephen Hall | Cyber Intelligence Tsunami |
| 2013-07-18/a> | Chris Mohan | Blog Spam - annoying junk or a source of intelligence? |
| 2013-07-16/a> | Johannes Ullrich | Why don't we see more examples of web app attacks via POST? |
| 2013-07-13/a> | Lenny Zeltser | Decoy Personas for Safeguarding Online Identity Using Deception |
| 2013-07-08/a> | Richard Porter | Why do we Click? |
| 2013-07-06/a> | Guy Bruneau | Is Metadata the Magic in Modern Network Security? |
| 2013-07-01/a> | Manuel Humberto Santander Pelaez | Using nmap scripts to enhance vulnerability asessment results |
| 2013-06-29/a> | Johannes Ullrich | Instagram "Fruit" Spam |
| 2013-06-21/a> | Guy Bruneau | Sysinternals Updates for Autoruns, Strings & ZoomIt http://blogs.technet.com/b/sysinternals/archive/2013/06/20/updates-autoruns-v11-61-strings-v2-52-zoomit-v4-5.aspx |
| 2013-06-20/a> | Johannes Ullrich | Linkedin DNS Hijack |
| 2013-06-19/a> | Kevin Liston | WinLink Check-In |
| 2013-06-05/a> | Richard Porter | BIND 9 Update fixing CVE-2013-3919 |
| 2013-06-05/a> | Richard Porter | Windows Sysinternals Updated http://technet.microsoft.com/en-us/sysinternals/default.aspx |
| 2013-05-23/a> | Adrien de Beaupre | MoVP II |
| 2013-05-21/a> | Adrien de Beaupre | Moore, Oklahoma tornado charitable organization scams, malware, and phishing |
| 2013-05-20/a> | Guy Bruneau | Sysinternals Updates for Accesschk, Procdump, RAMMap and Strings http://blogs.technet.com/b/sysinternals/archive/2013/05/17/updates-accesschk-v5-11-procdump-v6-0-rammap-v1-22-strings-v2-51.aspx |
| 2013-05-14/a> | Swa Frantzen | CVE-2013-2094: Linux privilege escalation |
| 2013-05-09/a> | Johannes Ullrich | Microsoft released a Fix-it for the Internet Explorer 8 Vulnerability http://support.microsoft.com/kb/2847140 |
| 2013-05-08/a> | Chris Mohan | Syria drops from Internet 7th May 2013 |
| 2013-05-07/a> | Jim Clausing | Is there an epidemic of typo squatting? |
| 2013-05-07/a> | Jim Clausing | NGINX updates address buffer overflow (CVE-2013-2028) see http://nginx.org/en/CHANGES-1.4 |
| 2013-05-04/a> | Kevin Shortt | The Zero-Day Pendulum Swings |
| 2013-05-01/a> | Daniel Wesemann | The cost of cleaning up |
| 2013-04-23/a> | Russ McRee | Microsoft's Security Intelligence Report (SIRv14) released |
| 2013-04-16/a> | John Bambenek | Fake Boston Marathon Scams Update |
| 2013-04-15/a> | Rob VandenBrink | Oops - You Mean That Deleted Server was a Certificate Authority? |
| 2013-04-15/a> | John Bambenek | Please send any spam (full headers), URLs or other suspicious content scamming off Boston Marathon explosions to handlers@sans.org |
| 2013-03-29/a> | Chris Mohan | Fake Link removal requests |
| 2013-03-27/a> | Adam Swanger | IPv6 Focus Month: Guest Diary: Stephen Groat - IPv6 moving target defense |
| 2013-03-19/a> | Johannes Ullrich | Windows 7 SP1 and Windows Server 2008 R2 SP1 Being "pushed" today |
| 2013-03-19/a> | Johannes Ullrich | IPv6 Focus Month: The warm and fuzzy side of IPv6 |
| 2013-03-07/a> | Guy Bruneau | Apple Blocking Java Web plug-in |
| 2013-03-06/a> | Adam Swanger | IPv6 Focus Month: Guest Diary: Stephen Groat - Geolocation Using IPv6 Addresses |
| 2013-03-05/a> | Mark Hofman | IPv6 Focus Month: Device Defaults |
| 2013-03-02/a> | Scott Fendley | Evernote Security Issue |
| 2013-03-02/a> | Scott Fendley | Apple Blocks Older Insecure Versions of Flash Player |
| 2013-02-28/a> | Daniel Wesemann | Parsing Windows Eventlogs in Powershell |
| 2013-02-22/a> | Johannes Ullrich | Zendesk breach affects Tumblr/Pinterest/Twitter |
| 2013-02-19/a> | Johannes Ullrich | APT1, Unit 61398 and are state sponsored attacks real |
| 2013-02-17/a> | Guy Bruneau | HP ArcSight Connector Appliance and Logger Vulnerabilities |
| 2013-02-11/a> | John Bambenek | Is This Chinese Registrar Really Trying to XSS Me? |
| 2013-02-06/a> | Adam Swanger | Sysinternals in particular Process Explorer update https://blogs.technet.com/b/sysinternals/?Redirected=true |
| 2013-02-06/a> | Johannes Ullrich | Are you losing system logging information (and don't know it)? |
| 2013-02-06/a> | Johannes Ullrich | Intel Network Card (82574L) Packet of Death |
| 2013-02-04/a> | Russ McRee | An expose of a recent SANS GIAC XSS vulnerability |
| 2013-02-04/a> | Adam Swanger | SAN Securing The Human Monthly Awareness Video - Advanced Persistent Threat (APT) http://www.securingthehuman.org/resources/ncsam |
| 2013-01-30/a> | Richard Porter | Getting Involved with the Local Community |
| 2013-01-25/a> | Johannes Ullrich | Vulnerability Scans via Search Engines (Request for Logs) |
| 2013-01-15/a> | Rob VandenBrink | When Disabling IE6 (or Java, or whatever) is not an Option... |
| 2013-01-13/a> | Stephen Hall | Sysinternals Updates |
| 2013-01-10/a> | Rob VandenBrink | What Else runs Telnets? Or, Pentesters Love Video Conferencing Units Too! |
| 2013-01-09/a> | Rob VandenBrink | SQL Injection Flaw in Ruby on Rails |
| 2013-01-05/a> | Guy Bruneau | D-link Wireless-G Router Year Issue (Y2K-plus-13) |
| 2013-01-02/a> | Russ McRee | EMET 3.5: The Value of Looking Through an Attacker's Eyes |
| 2013-01-01/a> | Johannes Ullrich | FixIt Available for Internet Explorer Vulnerability |
| 2012-12-20/a> | Daniel Wesemann | White House strategy on security information sharing and safeguarding |
| 2012-12-13/a> | Johannes Ullrich | What if Tomorrow Was the Day? |
| 2012-12-06/a> | Daniel Wesemann | Fake tech support calls - revisited |
| 2012-12-06/a> | Daniel Wesemann | Rich Quick Make Money! |
| 2012-12-03/a> | John Bambenek | John McAfee Exposes His Location in Photo About His Being on Run |
| 2012-12-02/a> | Guy Bruneau | Collecting Logs from Security Devices at Home |
| 2012-11-30/a> | Daniel Wesemann | Nmap 6.25 released - lots of new goodies, see http://nmap.org/changelog.html |
| 2012-11-29/a> | Kevin Shortt | New Apple Security Update: APPLE-SA-2012-11-29-1 Apple TV 5.1.1 |
| 2012-11-28/a> | Mark Hofman | McAfee releases extraDAT for W32/Autorun.worm.aaeb-h |
| 2012-11-28/a> | Mark Hofman | New version of wireshark is available (1.8.4), some security fixes included. |
| 2012-11-27/a> | Chris Mohan | Can users' phish emails be a security admin's catch of the day? |
| 2012-11-26/a> | John Bambenek | Online Shopping for the Holidays? Tips, News and a Fair Warning |
| 2012-11-20/a> | John Bambenek | Behind the Random NTP Bizarreness of Incorrect Year Being Set |
| 2012-11-20/a> | John Bambenek | Firefox v 17.0 just released, more here: http://www.mozilla.org/en-US/firefox/17.0/releasenotes/ |
| 2012-11-19/a> | John Bambenek | MoneyGram fined $100 million for aiding wire fraud - http://krebsonsecurity.com/2012/11/moneygram-fined-100-million-for-wire-fraud/ |
| 2012-11-19/a> | John Bambenek | New Poll: Top 5 Unresolved Security Problems of 2012 |
| 2012-11-17/a> | Manuel Humberto Santander Pelaez | New Sysinternal Updates: AdExplorer v1.44, Contig v1.7, Coreinfo v3.2, Procdump v5.1. See http://blogs.technet.com/b/sysinternals/archive/2012/11/16/updates-adexplorer-v1-44-contig-v1-7-coreinfo-v3-2-procdump-v5-1.aspx?Redirected=true |
| 2012-11-16/a> | Manuel Humberto Santander Pelaez | Information Security Incidents are now a concern for colombian government |
| 2012-11-13/a> | Jim Clausing | Microsoft November 2012 Black Tuesday Update - Overview |
| 2012-11-12/a> | John Bambenek | Request for info: Robocall Phishing Against Local/Regional Banks |
| 2012-11-09/a> | Mark Baggett | Fresh batch of Microsoft patches next week |
| 2012-11-09/a> | Mark Baggett | Remote Diagnostics with PSR |
| 2012-11-08/a> | Daniel Wesemann | Get a 40% discount on your hotel room! |
| 2012-11-07/a> | Mark Baggett | Help eliminate unquoted path vulnerabilities |
| 2012-11-07/a> | Mark Baggett | Multiple 0-Days Reported! |
| 2012-11-07/a> | Mark Baggett | Cisco TACACS+ Authentication Bypass |
| 2012-11-05/a> | Johannes Ullrich | Reminder: Ongoing SMTP Brute Forcing Attacks |
| 2012-11-05/a> | Johannes Ullrich | Possible Fake-AV Ads from Doubleclick Servers |
| 2012-11-04/a> | Lorna Hutcheson | What's important on your network? |
| 2012-10-31/a> | Johannes Ullrich | Cyber Security Awareness Month - Day 31 - Business Continuity and Disaster Recovery |
| 2012-10-30/a> | Johannes Ullrich | Hurricane Sandy Update |
| 2012-10-30/a> | Richard Porter | Splunk 5.0 SP-CAAAHB4 http://www.splunk.com/view/SP-CAAAHB4 |
| 2012-10-30/a> | Mark Hofman | Cyber Security Awareness Month - Day 30 - DSD 35 mitigating controls |
| 2012-10-28/a> | Tony Carothers | Firefox 16.02 Released |
| 2012-10-26/a> | Adam Swanger | Securing the Human Special Webcast - October 30, 2012 |
| 2012-10-26/a> | Russ McRee | Cyber Security Awareness Month - Day 26 - Attackers use trusted domain to propagate Citadel Zeus variant |
| 2012-10-25/a> | Richard Porter | Cyber Security Awareness Month - Day 25 - Pro Audio & Video Packets on the Wire |
| 2012-10-24/a> | Rob VandenBrink | Time to run Windows Update - - Microsoft Updates KB2755801 for Windows RT / IE10 / Flash Player - http://technet.microsoft.com/en-us/security/advisory/2755801 |
| 2012-10-24/a> | Russ McRee | Ongoing Windstream outage in the midwest - https://twitter.com/search?q=windstream |
| 2012-10-23/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 23: Character Encoding Standards - ASCII and Successors |
| 2012-10-21/a> | Johannes Ullrich | Cyber Security Awareness Month - Day 22: Connectors |
| 2012-10-21/a> | Lorna Hutcheson | Potential Phish for Regular Webmail Accounts |
| 2012-10-19/a> | Johannes Ullrich | Cyber Security Awareness Month - Day 19: Standard log formats and CEE. |
| 2012-10-18/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 18 - Vendor Standards: The vSphere Hardening Guide |
| 2012-10-17/a> | Mark Hofman | Oracle Critical Patch Update October |
| 2012-10-17/a> | Mark Hofman | New Acrobat release (including reader) available. Version 11. Some security improvements more here -->http://blogs.adobe.com/adobereader/ |
| 2012-10-16/a> | Richard Porter | CyberAwareness Month - Day 15, Standards Body Soup (pt2), Same Soup Different Cook. |
| 2012-10-16/a> | Johannes Ullrich | Cyber Security Awareness Month - Day 16: W3C and HTML |
| 2012-10-14/a> | Pedro Bueno | Cyber Security Awareness Month - Day 14 - Poor Man's File Analysis System - Part 1 |
| 2012-10-11/a> | Rob VandenBrink | Cyber Security Awareness Month - Day 11 - Vendor Agnostic Standards (Center for Internet Security) |
| 2012-10-09/a> | Johannes Ullrich | Microsoft October 2012 Black Tuesday Update - Overview |
| 2012-10-07/a> | Tony Carothers | Cyber Security Awareness Month - Day 7 - Rollup Review of CSAM Week 1 |
| 2012-10-05/a> | Johannes Ullrich | Cyber Security Awareness Month - Day 5: Standards Body Soup, So many Flavors in the bowl. |
| 2012-10-05/a> | Richard Porter | Reports of a Distributed Injection Scan |
| 2012-10-05/a> | Richard Porter | VMWare Security Advisory: VMSA-2012-0014 - http://www.vmware.com/security/advisories/VMSA-2012-0014.html |
| 2012-10-04/a> | Mark Hofman | And the SHA-3 title goes to .....Keccak |
| 2012-10-04/a> | Johannes Ullrich | Cyber Security Awareness Month - Day 4: Crypto Standards |
| 2012-10-03/a> | Kevin Shortt | Fake Support Calls Reported |
| 2012-10-02/a> | Russ McRee | Cyber Security Awareness Month - Day 2 - PCI Security Standard: Mobile Payment Acceptance Security Guidelines |
| 2012-10-01/a> | Johannes Ullrich | Cyber Security Awareness Month |
| 2012-09-28/a> | Joel Esler | Adobe certification revocation for October 4th |
| 2012-09-26/a> | Johannes Ullrich | Some Android phones can be reset to factory default by clicking on links |
| 2012-09-26/a> | Johannes Ullrich | More Java Woes |
| 2012-09-21/a> | Johannes Ullrich | iOS 6 Security Roundup |
| 2012-09-20/a> | Russ McRee | Flash Player update but no announcement, check your version http://www.adobe.com/software/flash/about/ |
| 2012-09-20/a> | Russ McRee | Apple and Cisco Security Advisories 19 SEP 2012 |
| 2012-09-20/a> | Russ McRee | Financial sector advisory: attacks and threats against financial institutions |
| 2012-09-19/a> | Russ McRee | Script kiddie scavenging with Shellbot.S |
| 2012-09-17/a> | Rob VandenBrink | What's on your iPad? |
| 2012-09-14/a> | Lenny Zeltser | Analyzing Malicious RTF Files Using OfficeMalScanner's RTFScan |
| 2012-09-14/a> | Lenny Zeltser | Scam Report - Fake Voice Mail Email Notification Redirects to Malicious Site |
| 2012-09-13/a> | Mark Baggett | TCP Fuzzing with Scapy |
| 2012-09-13/a> | Mark Baggett | Microsoft disrupts traffic associated with the Nitol botnet |
| 2012-09-13/a> | Mark Baggett | More SSL trouble |
| 2012-09-11/a> | Adam Swanger | Microsoft September 2012 Black Tuesday Update - Overview |
| 2012-09-10/a> | Johannes Ullrich | Microsoft Patch Tuesday Pre-Release |
| 2012-09-10/a> | Johannes Ullrich | Godaddy DDoS Attack |
| 2012-09-10/a> | donald smith | Blue Toad publishing co compromise lead to UDID release. http://redtape.nbcnews.com/_news/2012/09/10/13781440-exclusive-the-real-source-of-apple-device-ids-leaked-by-anonymous-last-week?lite |
| 2012-09-09/a> | Guy Bruneau | Phishing/Spam Pretending to be from BBB |
| 2012-09-08/a> | Guy Bruneau | Webmin Input Validation Vulnerabilities |
| 2012-09-06/a> | Johannes Ullrich | SSL Requests sent to port 80 (request for help/input) |
| 2012-09-04/a> | Johannes Ullrich | Another round of "Spot the Exploit E-Mail" |
| 2012-09-02/a> | Lorna Hutcheson | Demonstrating the value of your Intrusion Detection Program and Analysts |
| 2012-09-01/a> | Russ McRee | Blackhole targeting Java vulnerability via fake Microsoft Services Agreement email phish |
| 2012-08-31/a> | Russ McRee | Not so fast: Java 7 Update 7 critical vulnerability discovered in less than 24 hours |
| 2012-08-30/a> | Bojan Zdrnja | Analyzing outgoing network traffic (part 2) |
| 2012-08-30/a> | Johannes Ullrich | Editorial: The Slumlord Approach to Network Security http://isc.sans.edu/j/editorial |
| 2012-08-29/a> | Johannes Ullrich | "Data" URLs used for in-URL phishing |
| 2012-08-27/a> | Johannes Ullrich | The Good, Bad and Ugly about Assigning IPv6 Addresses |
| 2012-08-27/a> | Johannes Ullrich | Malware Spam harvesting Facebook Information |
| 2012-08-26/a> | Lorna Hutcheson | Who ya gonna contact? |
| 2012-08-23/a> | Bojan Zdrnja | Analyzing outgoing network traffic |
| 2012-08-22/a> | Adrien de Beaupre | Apple Remote Desktop update fixes no encryption issue |
| 2012-08-22/a> | Adrien de Beaupre | Phishing/spam via SMS |
| 2012-08-21/a> | Adrien de Beaupre | YYABCAFU - Yes Yet Another Bleeping Critical Adobe Flash Update |
| 2012-08-21/a> | Adrien de Beaupre | RuggedCom fails key management 101 on Rugged Operating System (ROS) |
| 2012-08-20/a> | Manuel Humberto Santander Pelaez | Do we need test procedures in our companies before implementing Antivirus signatures? |
| 2012-08-19/a> | Manuel Humberto Santander Pelaez | Authentication Issues between entities during protocol message exchange in SCADA Systems |
| 2012-08-17/a> | Guy Bruneau | Suspicious eFax Spear Phishing Messages |
| 2012-08-14/a> | Rick Wanner | Microsoft August 2012 Black Tuesday Update - Overview |
| 2012-08-12/a> | Tony Carothers | Oracle Security Alert for CVE-2012-3132 |
| 2012-08-12/a> | Tony Carothers | Layers of the Defense-in-Depth Onion |
| 2012-08-09/a> | Mark Hofman | Zeus/Citadel variant causing issues in the Netherlands |
| 2012-08-09/a> | Mark Hofman | SQL Injection Lilupophilupop style, Part 2 |
| 2012-08-07/a> | Adrien de Beaupre | Who protects small business? |
| 2012-08-05/a> | Daniel Wesemann | Phishing for Payroll with unpatched Java |
| 2012-08-04/a> | Kevin Liston | Vendors: More Patch-Release Options Please |
| 2012-07-31/a> | Daniel Wesemann | SQL injection, lilupophilupop-style |
| 2012-07-30/a> | Guy Bruneau | BIND 9 Security Updates |
| 2012-07-27/a> | Daniel Wesemann | Cuckoo 0.4 is out - cool new features for malware analysis http://www.cuckoosandbox.org/ |
| 2012-07-25/a> | Johannes Ullrich | Apple OS X 10.8 (Mountain Lion) released |
| 2012-07-25/a> | Johannes Ullrich | Microsoft Exchange/Sharepoint and others: Oracle Outside In Vulnerability |
| 2012-07-24/a> | Richard Porter | Wireshark 1.8.1 Released http://www.wireshark.org/ |
| 2012-07-24/a> | Richard Porter | Report of spike in DNS Queries gd21.net |
| 2012-07-21/a> | Rick Wanner | TippingPoint DNS Version Request increase |
| 2012-07-20/a> | Mark Baggett | Syria Internet connection cut? |
| 2012-07-19/a> | Mark Baggett | A Heap of Overflows? |
| 2012-07-19/a> | Mark Baggett | Diagnosing Malware with Resource Monitor |
| 2012-07-16/a> | Richard Porter | Sysinternals Update @ http://blogs.technet.com/b/sysinternals/archive/2012/07/16/updates-handle-v3-5-process-explorer-v15-22-process-monitor-v3-03-rammap-v1-21-zoomit-v4-3.aspx |
| 2012-07-16/a> | Jim Clausing | An analysis of the Yahoo! passwords |
| 2012-07-13/a> | Richard Porter | Yesterday (not as on the ball as Rob) at SANSFire |
| 2012-07-13/a> | Russ McRee | 2 for 1: SANSFIRE & MSRA presentations |
| 2012-07-13/a> | Russ McRee | Yahoo service SQL injection vuln leads to account exposure |
| 2012-07-12/a> | Rick Wanner | Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Multipoint Switch - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-ctms |
| 2012-07-12/a> | Rick Wanner | Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Recording Server - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-ctrs |
| 2012-07-12/a> | Rick Wanner | Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Immersive Endpoint Devices - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-cts |
| 2012-07-12/a> | Rick Wanner | Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Manager - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-ctsman |
| 2012-07-10/a> | Rob VandenBrink | Today at SANSFIRE (09 July 2012) - ISC Panel Discussion on the State of the Internet |
| 2012-07-09/a> | Johannes Ullrich | The FBI will turn off the Internet on Monday (or not) |
| 2012-07-09/a> | Manuel Humberto Santander Pelaez | Internet Storm Center panel tonight at SANSFIRE 2012! |
| 2012-07-05/a> | Adrien de Beaupre | New OS X trojan backdoor MaControl variant reported |
| 2012-07-05/a> | Adrien de Beaupre | Microsoft advanced notification for July 2012 patch Tuesday |
| 2012-07-02/a> | Joel Esler | Linux & Java leap second bug |
| 2012-07-02/a> | Joel Esler | A rough guide to keeping your website up |
| 2012-07-02/a> | Dan Goldberg | Storms of June 29th 2012 in Mid Atlantic region of the USA |
| 2012-06-29/a> | Jim Clausing | Updated SysInternals tools - Autoruns, Process Explorer, Process Monitor, PSKill -- http://blogs.technet.com/b/sysinternals/archive/2012/06/28/updates-autoruns-v11-32-process-explorer-v15-21-process-monitor-v3-02-pskill-v1-15-rammap-v1-2.aspx |
| 2012-06-28/a> | Chris Mohan | Massive spike in BGP traffic - Possible BGP poisoning? |
| 2012-06-27/a> | Daniel Wesemann | What's up with port 79 ? |
| 2012-06-25/a> | Rick Wanner | Targeted Malware for Industrial Espionage? |
| 2012-06-25/a> | Guy Bruneau | Issues with Windows Update Agent |
| 2012-06-22/a> | Kevin Liston | Investigator's Tool-kit: Timeline |
| 2012-06-21/a> | Raul Siles | Print Bomb? (Take 2) |
| 2012-06-21/a> | Russ McRee | Analysis of drive-by attack sample set |
| 2012-06-21/a> | Russ McRee | Wireshark 1.8.0 released 21 JUN 2012 http://www.wireshark.org/download.html |
| 2012-06-19/a> | Daniel Wesemann | Vulnerabilityqueerprocessbrittleness |
| 2012-06-14/a> | Johannes Ullrich | Spot the Phish: Verizon Wireless |
| 2012-06-10/a> | Scott Fendley | Preying on Users After Major Security Incidents |
| 2012-06-06/a> | Jim Clausing | BIND 9 Update - DoS or information disclosure vulnerability |
| 2012-06-06/a> | Jim Clausing | Potential leak of 6.5+ million LinkedIn password hashes |
| 2012-06-04/a> | Lenny Zeltser | Decoding Common XOR Obfuscation in Malicious Code |
| 2012-06-04/a> | Rob VandenBrink | vSphere 5.0 Hardening Guide Officially Released |
| 2012-05-30/a> | Rob VandenBrink | It's Phishing Season! In fact, it's ALWAYS Phishing Season! |
| 2012-05-23/a> | Mark Baggett | Problems with MS12-035 affecting XP, SBS and Windows 2003? |
| 2012-05-14/a> | Chris Mohan | Laptops at Security Conferences |
| 2012-05-08/a> | Bojan Zdrnja | Windows Firewall Bypass Vulnerability and NetBIOS NS |
| 2012-05-06/a> | Jim Clausing | Tool updates and Win 8 |
| 2012-04-30/a> | Rob VandenBrink | FCC posts Enquiry Documents on Google Wardriving |
| 2012-04-23/a> | Russ McRee | Emergency Operations Centers & Security Incident Management: A Correlation |
| 2012-04-18/a> | Kevin Shortt | Sysinternals Updates - 2012 Apr 17 |
| 2012-04-10/a> | Swa Frantzen | Windows Vista RIP |
| 2012-04-06/a> | Johannes Ullrich | Social Share Privacy |
| 2012-03-16/a> | Swa Frantzen | INFOCON Yellow - Microsoft RDP - MS12-020 |
| 2012-03-13/a> | Lenny Zeltser | Please transfer this email to your CEO or appropriate person, thanks |
| 2012-02-20/a> | Johannes Ullrich | The Ultimate OS X Hardening Guide Collection |
| 2012-02-20/a> | Pedro Bueno | Simple Malware Research Tools |
| 2012-01-31/a> | Russ McRee | OSINT tactics: parsing from FOCA for Maltego |
| 2012-01-24/a> | Bojan Zdrnja | Is it time to get rid of NetBIOS? |
| 2012-01-21/a> | Guy Bruneau | DNS Sinkhole Scripts Fixes/Update |
| 2012-01-19/a> | Chris Mohan | WHOIS contacts are your friends |
| 2012-01-13/a> | Guy Bruneau | Sysinternals Updates - http://blogs.technet.com/b/sysinternals/archive/2012/01/13/updates-autoruns-v11-21-coreinfo-v3-03-portmon-v-3-03-process-explorer-v15-12-mark-s-blog-and-mark-at-rsa-2012.aspx |
| 2012-01-12/a> | Rob VandenBrink | Stuff I Learned Scripting - Fun with STDERR |
| 2011-12-25/a> | Deborah Hale | Merry Christmas, Happy Holidays |
| 2011-12-23/a> | Daniel Wesemann | Printer Pranks |
| 2011-12-21/a> | Johannes Ullrich | New Vulnerability in Windows 7 64 bit |
| 2011-12-12/a> | Daniel Wesemann | You won 100$ or a free iPad! |
| 2011-12-08/a> | Adrien de Beaupre | Microsoft Security Bulletin Advance Notification for December 2011 |
| 2011-12-06/a> | Kevin Shortt | Cain & Abel v4.9.43 Released - http://www.oxid.it/ |
| 2011-12-05/a> | Stephen Hall | ISC describe DNS crash bug analysis |
| 2011-12-01/a> | Mark Hofman | SQL Injection Attack happening ATM |
| 2011-11-29/a> | John Bambenek | Hacking HP Printers for Fun and Profit |
| 2011-11-28/a> | Tom Liston | A Puzzlement... |
| 2011-11-24/a> | Russ McRee | Quick Tip: Pastebin Monitoring & Recon |
| 2011-11-23/a> | Johannes Ullrich | SCADA hacks published on Pastebin |
| 2011-11-16/a> | Jason Lam | Potential 0-day on Bind 9 |
| 2011-11-11/a> | Rick Wanner | Yay! More Sysinternals updates! http://technet.microsoft.com/en-us/sysinternals |
| 2011-11-10/a> | Rob VandenBrink | Stuff I Learned Scripting - - Parsing XML in a One-Liner |
| 2011-10-29/a> | Richard Porter | The Sub Critical Control? Evidence Collection |
| 2011-10-28/a> | Russ McRee | Critical Control 19: Data Recovery Capability |
| 2011-10-27/a> | Mark Baggett | Critical Control 18: Incident Response Capabilities |
| 2011-10-26/a> | Rick Wanner | Critical Control 17:Penetration Tests and Red Team Exercises |
| 2011-10-25/a> | Chris Mohan | Recurring reporting made easy? |
| 2011-10-21/a> | Johannes Ullrich | New Flash Click Jacking Exploit |
| 2011-10-17/a> | Rob VandenBrink | Critical Control 11: Account Monitoring and Control |
| 2011-10-15/a> | Guy Bruneau | DNS Sinkhole Parser Script Update |
| 2011-10-10/a> | Tom Liston | What's In A Name? |
| 2011-10-02/a> | Mark Hofman | Cyber Security Awareness Month Day 1/2 - Schedule |
| 2011-10-02/a> | Mark Hofman | Cyber Security Awareness Month Day 1/2 - Introduction to the controls |
| 2011-09-29/a> | Daniel Wesemann | The SSD dilemma |
| 2011-09-20/a> | Swa Frantzen | Diginotar declared bankrupt |
| 2011-09-19/a> | Guy Bruneau | MS Security Advisory Update - Fraudulent DigiNotar Certificates |
| 2011-09-15/a> | Swa Frantzen | DigiNotar looses their accreditation for qualified certificates |
| 2011-09-13/a> | Swa Frantzen | GlobalSign back in operation |
| 2011-09-13/a> | Swa Frantzen | More DigiNotar intermediate certificates blocklisted at Microsoft |
| 2011-09-09/a> | Guy Bruneau | IPv6 and DNS Sinkhole |
| 2011-09-07/a> | Lenny Zeltser | GlobalSign Temporarily Stops Issuing Certificates to Investigate a Potential Breach |
| 2011-09-06/a> | Swa Frantzen | DigiNotar audit - intermediate report available |
| 2011-09-06/a> | Johannes Ullrich | Microsoft Releases Diginotar Related Patch and Advisory |
| 2011-09-05/a> | Bojan Zdrnja | Bitcoin – crypto currency of future or heaven for criminals? |
| 2011-09-01/a> | Swa Frantzen | DigiNotar breach - the story so far |
| 2011-08-31/a> | Johannes Ullrich | Firefox/Thunderbird 6.0.1 released to blocklist bad DigiNotar SSL certificates |
| 2011-08-31/a> | Johannes Ullrich | Phishing e-mail to custom e-mail addresses |
| 2011-08-31/a> | Johannes Ullrich | Kernel.org Compromise |
| 2011-08-26/a> | Daniel Wesemann | User Agent 007 |
| 2011-08-25/a> | Kevin Shortt | Increased Traffic on Port 3389 |
| 2011-08-24/a> | Rob VandenBrink | Citrix Access Gateway Cross Site Scripting vulnerability and fix ==> http://support.citrix.com/article/CTX129971 |
| 2011-08-17/a> | Rob VandenBrink | Putting all of Your Eggs in One Basket - or How NOT to do Layoffs |
| 2011-08-17/a> | Rob VandenBrink | Sysinternal updates for ProcDump v4.0, Process Monitor v2.96, Process Explorer v15.02 ==> http://blogs.technet.com/b/sysinternals/ |
| 2011-08-16/a> | Scott Fendley | Phishing Scam Victim Response |
| 2011-08-15/a> | Rob VandenBrink | 8 Years since the Eastern Seaboard Blackout - Has it Been that Long? |
| 2011-08-08/a> | Rob VandenBrink | Ping is Bad (Sometimes) |
| 2011-08-05/a> | Johannes Ullrich | Microsoft Patch Tuesday Advance Notification: 13 Bulletins coming http://www.microsoft.com/technet/security/Bulletin/MS11-aug.mspx |
| 2011-07-31/a> | Daniel Wesemann | Anatomy of a Unix breach |
| 2011-07-25/a> | Chris Mohan | Monday morning incident handler practice |
| 2011-07-17/a> | Mark Hofman | SSH Brute Force |
| 2011-07-09/a> | Chris Mohan | Safer Windows Incident Response |
| 2011-07-07/a> | Rob VandenBrink | "There's a Patch for that" (or maybe not) |
| 2011-07-06/a> | Rob VandenBrink | "Too Important to Patch" - Wait? What? |
| 2011-07-05/a> | Raul Siles | Two DoS remotely exploitable vulnerabilities affect BIND 9: http://www.isc.org/advisories/bind Updgrade to 9.8.0-P4. |
| 2011-07-03/a> | Deborah Hale | Business Continuation in the Face of Disaster |
| 2011-06-30/a> | Rob VandenBrink | Update for RSA Authentication Manager |
| 2011-06-28/a> | Johannes Ullrich | DNSSEC Tips |
| 2011-06-22/a> | Guy Bruneau | How Good is your Employee Termination Policy? |
| 2011-06-17/a> | Richard Porter | When do you stop owning Technology? |
| 2011-06-12/a> | Mark Hofman | Cloud thoughts |
| 2011-06-09/a> | Richard Porter | One Browser to Rule them All? |
| 2011-06-08/a> | Johannes Ullrich | Spam from compromised Hotmail accounts |
| 2011-06-06/a> | Manuel Humberto Santander Pelaez | Phishing: Same goal, same techniques and people still falling for such scams |
| 2011-06-06/a> | Johannes Ullrich | The Havij SQL Injection Tool |
| 2011-06-03/a> | Guy Bruneau | SonyPictures Site Compromised |
| 2011-06-01/a> | Johannes Ullrich | Enabling Privacy Enhanced Addresses for IPv6 |
| 2011-05-30/a> | Johannes Ullrich | Lockheed Martin and RSA Tokens |
| 2011-05-25/a> | Lenny Zeltser | Monitoring Social Media for Security References to Your Organization |
| 2011-05-20/a> | Guy Bruneau | Sysinternals Updates, Analyzing Stuxnet Infection with Sysinternals Tools Part 3 |
| 2011-05-10/a> | Swa Frantzen | Changing MO in scamming our users ? |
| 2011-05-09/a> | Johannes Ullrich | Patch for BIND 9.8.0 DoS Vulnerability |
| 2011-05-06/a> | Richard Porter | Updated Exploit Index for Microsoft |
| 2011-05-04/a> | Richard Porter | Microsoft Sysinterals Update |
| 2011-05-03/a> | Johannes Ullrich | Update on Osama Bin Laden themed Malware |
| 2011-05-02/a> | Johannes Ullrich | Bin Laden Death Related Malware |
| 2011-05-01/a> | Deborah Hale | Droid MarketPlace Has a New App |
| 2011-04-26/a> | John Bambenek | Is the Insider Threat Really Over? |
| 2011-04-25/a> | Rob VandenBrink | Sony PlayStation Network Outage - Day 5 |
| 2011-04-19/a> | Bojan Zdrnja | SQL injection: why can’t we learn? |
| 2011-04-14/a> | Adrien de Beaupre | Sysinternals updates, a new blog post, and webcast |
| 2011-04-11/a> | Johannes Ullrich | GMail User Using 2FA Warned of Access From China |
| 2011-04-07/a> | Chris Mohan | Being a good internet neighbour |
| 2011-04-01/a> | John Bambenek | LizaMoon Mass SQL-Injection Attack Infected at least 500k Websites |
| 2011-03-27/a> | Guy Bruneau | Strange Shockwave File with Surprising Attachments |
| 2011-03-25/a> | Kevin Liston | APT Tabletop Exercise |
| 2011-03-22/a> | Chris Mohan | Read only USB stick trick |
| 2011-03-15/a> | Lenny Zeltser | Limiting Exploit Capabilities by Using Windows Integrity Levels |
| 2011-03-07/a> | Bojan Zdrnja | Oracle padding attacks (Codegate crypto 400 writeup) |
| 2011-02-28/a> | Deborah Hale | Possible Botnet Scanning |
| 2011-02-25/a> | Johannes Ullrich | Thunderbolt Security Speculations |
| 2011-02-24/a> | Johannes Ullrich | Windows 7 / 2008 R2 Service Pack 1 Problems |
| 2011-02-23/a> | Johannes Ullrich | Windows 7 Service Pack 1 out |
| 2011-02-23/a> | Manuel Humberto Santander Pelaez | Bind DOS vulnerability (CVE-2011-0414) |
| 2011-02-21/a> | Adrien de Beaupre | Winamp forums compromised |
| 2011-02-16/a> | Jason Lam | Windows 0-day SMB mrxsmb.dll vulnerability |
| 2011-02-10/a> | Chris Mohan | Befriending Windows Security Log Events |
| 2011-02-09/a> | Mark Hofman | Adobe Patches (shockwave, Flash, Reader & Coldfusion) |
| 2011-02-08/a> | Johannes Ullrich | Tippingpoint Releases Details on Unpatched Bugs |
| 2011-02-07/a> | Richard Porter | Crime is still Crime! Pt 2 |
| 2011-02-05/a> | Guy Bruneau | OpenSSH Legacy Certificate Information Disclosure Vulnerability |
| 2011-02-02/a> | Johannes Ullrich | Having Phish on Friday |
| 2011-01-30/a> | Richard Porter | The Modern Dark Ages? |
| 2011-01-27/a> | Robert Danford | Microsoft Security Advisory for MHTML via Internet Explorer (MS2501696/CVE-2011-0096) |
| 2011-01-25/a> | Chris Mohan | Reviewing our preconceptions |
| 2011-01-24/a> | Rob VandenBrink | Where have all the COM Ports Gone? - How enumerating COM ports led to me finding a “misplaced” Microsoft tool |
| 2011-01-23/a> | Richard Porter | Crime is still Crime! |
| 2011-01-12/a> | Richard Porter | How Many Loyalty Cards do you Carry? |
| 2011-01-12/a> | Richard Porter | Yet Another Data Broker? AOL Lifestream. |
| 2011-01-10/a> | Manuel Humberto Santander Pelaez | VirusTotal VTzilla firefox/chrome plugin |
| 2011-01-05/a> | Johannes Ullrich | Currently Unpatched Windows / Internet Explorer Vulnerabilities |
| 2011-01-04/a> | Johannes Ullrich | Microsoft Advisory: Vulnerability in Graphics Rendering Engine |
| 2010-12-29/a> | Daniel Wesemann | Beware of strange web sites bearing gifts ... |
| 2010-12-26/a> | Manuel Humberto Santander Pelaez | ISC infocon monitor app for OS X |
| 2010-12-23/a> | Mark Hofman | Skoudis' Annual Xmas Hacking Challenge - The Nightmare Before Charlie Brown's Christmas |
| 2010-12-21/a> | Rob VandenBrink | Network Reliability, Part 2 - HSRP Attacks and Defenses |
| 2010-12-19/a> | Raul Siles | Intel's new processors have a remote kill switch (Anti-Theft 3.0) |
| 2010-12-10/a> | Mark Hofman | Microsoft patches |
| 2010-12-05/a> | Jim Clausing | Updates to a couple of Sysinternals tools |
| 2010-12-02/a> | Kevin Johnson | SQL Injection: Wordpress 3.0.2 released |
| 2010-12-02/a> | Kevin Johnson | Robert Hansen and our happiness |
| 2010-11-29/a> | Stephen Hall | iPhone phishing - What you see, isn't what you get |
| 2010-11-26/a> | Mark Hofman | Using password cracking as metric/indicator for the organisation's security posture |
| 2010-11-24/a> | Bojan Zdrnja | Privilege escalation 0-day in almost all Windows versions |
| 2010-11-22/a> | Lenny Zeltser | Brand Impersonations On-Line: Brandjacking and Social Networks |
| 2010-11-19/a> | Jason Lam | Exchanging and sharing of assessment results |
| 2010-11-18/a> | Chris Carboni | Stopping the ZeroAccess Rootkit |
| 2010-11-17/a> | Guy Bruneau | Cisco Unified Videoconferencing Affected by Multiple Vulnerabilities |
| 2010-11-15/a> | Stephen Hall | Minibis hits beta with Version 2.1 |
| 2010-11-01/a> | Manuel Humberto Santander Pelaez | Checkpoint UTM-1 edge VPN boxes worldwide did an unscheduled reboot |
| 2010-10-26/a> | Pedro Bueno | Be (even more) careful with public hotspots. Firesheep released yesterday. Brilliant and scary. |
| 2010-10-22/a> | Manuel Humberto Santander Pelaez | Intypedia project |
| 2010-10-18/a> | Manuel Humberto Santander Pelaez | Cyber Security Awareness Month - Day 18 - What you should tell your boss when there's a crisis |
| 2010-10-11/a> | Adrien de Beaupre | OT: Happy Thanksgiving Day Canada |
| 2010-10-04/a> | Mark Hofman | Online Voting |
| 2010-09-25/a> | Rick Wanner | Guest Diary: Andrew Hunt - Visualizing the Hosting Patterns of Modern Cybercriminals |
| 2010-09-17/a> | Robert Danford | Circa 2007 Linux Kernel Vulnerability Resurfaces (Was CVE-2007-4573, Now CVE-2010-3301) |
| 2010-09-16/a> | Johannes Ullrich | Facebook "Like Pages" |
| 2010-09-04/a> | Kevin Liston | Investigating Malicious Website Reports |
| 2010-08-27/a> | Mark Hofman | FTP Brute Password guessing attacks |
| 2010-08-23/a> | Manuel Humberto Santander Pelaez | Firefox plugins to perform penetration testing activities |
| 2010-08-23/a> | Bojan Zdrnja | DLL hijacking vulnerabilities |
| 2010-08-16/a> | Raul Siles | Blind Elephant: A New Web Application Fingerprinting Tool |
| 2010-08-15/a> | Manuel Humberto Santander Pelaez | Obfuscated SQL Injection attacks |
| 2010-08-13/a> | Guy Bruneau | Shadowserver Binary Whitelisting Service |
| 2010-08-10/a> | Daniel Wesemann | SSH - new brute force tool? |
| 2010-08-07/a> | Stephen Hall | Countdown to Tuesday... |
| 2010-08-05/a> | Rob VandenBrink | Access Controls for Network Infrastructure |
| 2010-08-04/a> | Tom Liston | Incident Reporting - Liston's "How-To" Guide |
| 2010-08-03/a> | Johannes Ullrich | When Lightning Strikes |
| 2010-08-02/a> | Manuel Humberto Santander Pelaez | Securing Windows Internet Kiosk |
| 2010-07-29/a> | Rob VandenBrink | NoScript 2.0 released |
| 2010-07-26/a> | Guy Bruneau | SophosLabs Released Free Tool to Validate Microsoft Shortcut |
| 2010-07-24/a> | Manuel Humberto Santander Pelaez | Transmiting logon information unsecured in the network |
| 2010-07-23/a> | Mark Hofman | vBulletin vB 3.8.6 vulnerability |
| 2010-07-23/a> | Mark Hofman | Some of our favourite sysinternals tools have been updated. TCPview, Autoruns, ProcDump and Disk2vhd have changed. More here http://blogs.technet.com/b/sysinternals/archive/2010/07/22/updates-tcpview-v3-0-autoruns-v10-02-procdump-v1-81-disk2vhd-v1-61.aspx |
| 2010-07-20/a> | Manuel Humberto Santander Pelaez | Lowering infocon back to green |
| 2010-07-07/a> | Kevin Shortt | Facebook, Facebook, What Do YOU See? |
| 2010-07-04/a> | Manuel Humberto Santander Pelaez | New Winpcap Version |
| 2010-06-27/a> | Manuel Humberto Santander Pelaez | Study of clickjacking vulerabilities on popular sites |
| 2010-06-19/a> | Guy Bruneau | DNS Sinkhole ISO Available for Download |
| 2010-06-18/a> | Tom Liston | IMPORTANT INFORMATION: Distributed SSH Brute Force Attacks |
| 2010-06-17/a> | Deborah Hale | Digital Copy Machines - Security Risk? |
| 2010-06-17/a> | Deborah Hale | Internet Fraud Alert Kicks Off Today |
| 2010-06-15/a> | Manuel Humberto Santander Pelaez | Microsoft Windows Help and Support Center vulnerability (CVE 2010-1885) exploit in the wild |
| 2010-06-15/a> | Manuel Humberto Santander Pelaez | iPhone 4 Order Security Breach Exposes Private Information |
| 2010-06-14/a> | Manuel Humberto Santander Pelaez | New way of social engineering on IRC |
| 2010-06-10/a> | Deborah Hale | Top 5 Social Networking Media Risks |
| 2010-06-09/a> | Deborah Hale | Mass Infection of IIS/ASP Sites |
| 2010-06-07/a> | Manuel Humberto Santander Pelaez | Software Restriction Policy to keep malware away |
| 2010-06-06/a> | Manuel Humberto Santander Pelaez | Nice OS X exploit tutorial |
| 2010-06-04/a> | Johannes Ullrich | Changes to Internet Storm Center Host Name |
| 2010-06-02/a> | Bojan Zdrnja | Clickjacking attacks on Facebook's Like plugin |
| 2010-05-25/a> | donald smith | Face book “joke” leads to firing. |
| 2010-05-19/a> | Jason Lam | EFF paper about browser tracking |
| 2010-05-07/a> | Johannes Ullrich | Stock market "wipe out" may be due to computer error |
| 2010-05-04/a> | Rick Wanner | SIFT review in the ISSA Toolsmith |
| 2010-05-02/a> | Mari Nichols | Zbot Social Engineering |
| 2010-04-30/a> | Johannes Ullrich | Sharepoint XSS Vulnerability |
| 2010-04-30/a> | Kevin Liston | CVE-2010-0817 SharePoint XSS Scorecard |
| 2010-04-29/a> | Bojan Zdrnja | Who needs exploits when you have social engineering? |
| 2010-04-21/a> | Guy Bruneau | Google Chrome Security Update v4.1.249.1059 Released: http://googlechromereleases.blogspot.com/2010/04/stable-update-security-fixes.html |
| 2010-04-20/a> | Raul Siles | Are You Ready for a Transportation Collapse...? |
| 2010-04-19/a> | Daniel Wesemann | Linked into scams? |
| 2010-04-14/a> | Mark Hofman | And let the patching games continue |
| 2010-04-13/a> | Adrien de Beaupre | Web App Testing Tools |
| 2010-04-13/a> | Johannes Ullrich | More Legal Threat Malware E-Mail |
| 2010-04-02/a> | Guy Bruneau | Oracle Java SE and Java for Business Critical Patch Update Advisory |
| 2010-03-27/a> | Guy Bruneau | HP-UX Running NFS/ONCplus, Inadvertently Enabled NFS |
| 2010-03-27/a> | Guy Bruneau | Create a Summary of IP Addresses from PCAP Files using Unix Tools |
| 2010-03-21/a> | Chris Carboni | Responding To The Unexpected |
| 2010-03-18/a> | Bojan Zdrnja | Dangers of copy&paste |
| 2010-03-15/a> | Adrien de Beaupre | Spamassassin Milter Plugin Remote Root Attack |
| 2010-03-06/a> | Tony Carothers | Integration and the Security of New Technologies |
| 2010-02-22/a> | Rob VandenBrink | New Risks in Penetration Testing |
| 2010-02-17/a> | Rob VandenBrink | Multiple Security Updates for ESX 3.x and ESXi 3.x |
| 2010-02-15/a> | Johannes Ullrich | Various Olympics Related Dangerous Google Searches |
| 2010-02-12/a> | G. N. White | Time to update those IP Bogon Filters (again) |
| 2010-02-11/a> | Deborah Hale | The Mysterious Blue Screen |
| 2010-02-06/a> | Guy Bruneau | LANDesk Management Gateway Vulnerability |
| 2010-02-03/a> | Johannes Ullrich | Information Disclosure Vulnerability in Internet Explorer |
| 2010-02-02/a> | Johannes Ullrich | Twitter Mass Password Reset due to Phishing |
| 2010-02-01/a> | Rob VandenBrink | NMAP 5.21 - Is UDP Protocol Specific Scanning Important? Why Should I Care? |
| 2010-01-27/a> | Raul Siles | Command Line Kung Fu |
| 2010-01-26/a> | Rob VandenBrink | VMware vSphere Hardening Guide Draft posted for public review |
| 2010-01-22/a> | Mari Nichols | Pass-down for a Successful Incident Response |
| 2010-01-17/a> | Mark Hofman | Why not Yellow? |
| 2010-01-14/a> | Bojan Zdrnja | 0-day vulnerability in Internet Explorer 6, 7 and 8 |
| 2010-01-10/a> | Guy Bruneau | Easy DNS BIND Sinkhole Setup |
| 2010-01-09/a> | G. N. White | What's Up With All The Port Scanning Using TCP/6000 As A Source Port? |
| 2010-01-08/a> | Rob VandenBrink | Microsoft OfficeOnline, Searching for Trust and Malware |
| 2009-12-17/a> | Daniel Wesemann | overlay.xul is back |
| 2009-12-16/a> | Rob VandenBrink | Beware the Attack of the Christmas Greeting Cards ! |
| 2009-12-15/a> | Johannes Ullrich | Important BIND name server updates - DNSSEC |
| 2009-12-04/a> | Daniel Wesemann | The economics of security advice (MSFT research paper) |
| 2009-12-02/a> | Rob VandenBrink | SPAM and Malware taking advantage of H1N1 concerns |
| 2009-11-29/a> | Patrick Nolan | A Cloudy Weekend |
| 2009-11-25/a> | Jim Clausing | Tool updates |
| 2009-11-24/a> | Rick Wanner | Microsoft Security Advisory 977981 - IE 6 and IE 7 |
| 2009-11-24/a> | John Bambenek | BIND Security Advisory (DNSSEC only) |
| 2009-11-14/a> | Adrien de Beaupre | Microsoft advisory for Windows 7 / Windows Server 2008 R2 Remote SMB DoS Exploit released |
| 2009-11-13/a> | Adrien de Beaupre | Flash Origin Policy Attack |
| 2009-11-12/a> | Rob VandenBrink | Windows 7 / Windows Server 2008 Remote SMB Exploit |
| 2009-11-11/a> | Rob VandenBrink | Layer 2 Network Protections against Man in the Middle Attacks |
| 2009-11-09/a> | Chris Carboni | 80's Flashback on Jailbroken iPhones |
| 2009-11-05/a> | Swa Frantzen | Insider threat: The snapnames case |
| 2009-10-26/a> | Johannes Ullrich | Today: ISC Login bugfix day. If you have issues logging in using OpenID, please email a copy of your OpenID URL to jullrich\at\sans.edu |
| 2009-10-24/a> | Marcus Sachs | Windows 7 - How is it doing? |
| 2009-10-22/a> | Adrien de Beaupre | Sysinternals updates: Disk2vhd v1.1, ZoomIt v4.1, Coreinfo v2.0, VMMap v2.4 |
| 2009-10-19/a> | Daniel Wesemann | Scam Email |
| 2009-10-17/a> | Rick Wanner | Mozilla disables Microsoft plug-ins? |
| 2009-10-16/a> | Adrien de Beaupre | Disable MS09-054 patch, or Firefox Plugin? |
| 2009-10-13/a> | Daniel Wesemann | Adobe Reader and Acrobat - Black Tuesday continues |
| 2009-10-08/a> | Johannes Ullrich | Firefox Plugin Collections |
| 2009-10-04/a> | Guy Bruneau | Samba Security Information Disclosure and DoS |
| 2009-10-02/a> | Stephen Hall | New SysInternal fun for the weekend |
| 2009-09-27/a> | Stephen Hall | Use Emerging Threats signatures? READ THIS! |
| 2009-09-20/a> | Mari Nichols | Insider Threat and Security Awareness |
| 2009-09-19/a> | Rick Wanner | Sysinternals Tools Updates |
| 2009-09-08/a> | Guy Bruneau | Vista/2008/Windows 7 SMB2 BSOD 0Day |
| 2009-09-05/a> | Mark Hofman | Critical Infrastructure and dependencies |
| 2009-08-26/a> | Johannes Ullrich | WSUS 3.0 SP2 released |
| 2009-08-26/a> | Johannes Ullrich | Cisco over-the-air-provisioning skyjacking exploit |
| 2009-08-19/a> | Daniel Wesemann | Checking your protection |
| 2009-08-18/a> | Deborah Hale | Website compromises - what's happening? |
| 2009-08-18/a> | Deborah Hale | Sysinternals Procdump Updated |
| 2009-08-13/a> | Jim Clausing | New and updated cheat sheets |
| 2009-08-03/a> | Mark Hofman | Switch hardening on your network |
| 2009-08-01/a> | Deborah Hale | Website Warnings |
| 2009-07-31/a> | Deborah Hale | Don't forget to tell your SysAdmin Thanks |
| 2009-07-31/a> | Deborah Hale | Google Safe Browsing |
| 2009-07-29/a> | Bojan Zdrnja | BIND 9 DoS attacks in the wild |
| 2009-07-27/a> | Raul Siles | Filemon and Regmon are dead, long life to Procmon! |
| 2009-07-27/a> | Raul Siles | New Hacker Challenge: Prison Break - Breaking, Entering & Decoding |
| 2009-07-18/a> | Patrick Nolan | Chrome update contains Security fixes |
| 2009-07-17/a> | Bojan Zdrnja | A new fascinating Linux kernel vulnerability |
| 2009-07-16/a> | Guy Bruneau | Changes in Windows Security Center |
| 2009-07-16/a> | Bojan Zdrnja | OWC exploits used in SQL injection attacks |
| 2009-07-13/a> | Adrien de Beaupre | * Infocon raised to yellow for Excel Web Components ActiveX vulnerability |
| 2009-07-12/a> | Mari Nichols | CA Apologizes for False Positive |
| 2009-07-10/a> | Guy Bruneau | WordPress Fixes Multiple vulnerabilities |
| 2009-07-07/a> | Marcus Sachs | * INFOCON Status - staying green |
| 2009-07-03/a> | Adrien de Beaupre | Happy 4th of July! |
| 2009-07-02/a> | Daniel Wesemann | Unpatched Bloatware on new PCs |
| 2009-07-02/a> | Daniel Wesemann | Time to update updating on PCs for 3rd party apps |
| 2009-06-26/a> | Mark Hofman | PHPMYADMIN scans |
| 2009-06-24/a> | Kyle Haugsness | Exploit tools are publicly available for phpMyAdmin |
| 2009-06-24/a> | Kyle Haugsness | TCP scanning increase for 4899 |
| 2009-06-21/a> | Scott Fendley | phpMyAdmin Scans |
| 2009-06-20/a> | Scott Fendley | Situational Awareness: Spam Crisis and China |
| 2009-06-16/a> | John Bambenek | Iran Internet Blackout: Using Twitter for Operational Intelligence |
| 2009-06-16/a> | John Bambenek | URL Shortening Service Cligs Hacked |
| 2009-06-11/a> | Rick Wanner | MIR-ROR Motile Incident Response - Respond Objectively Remediate |
| 2009-06-10/a> | Rick Wanner | SysInternals Survey |
| 2009-06-01/a> | G. N. White | Yet another "Digital Certificate" malware campaign |
| 2009-05-24/a> | Raul Siles | Facebook phising using Belgium (.be) domains |
| 2009-05-22/a> | Mark Hofman | Patching and Adobe |
| 2009-05-22/a> | Mark Hofman | Patching and Apple - Java issue |
| 2009-05-20/a> | Pedro Bueno | Cyber Warfare and Kylin thoughts |
| 2009-05-19/a> | Bojan Zdrnja | Advanced blind SQL injection (with Oracle examples) |
| 2009-05-11/a> | Mari Nichols | Sysinternals Updates 3 Applications |
| 2009-05-09/a> | Patrick Nolan | Shared SQL Injection Lessons Learned blog item |
| 2009-05-06/a> | Tom Liston | Follow The Bouncing Malware: Gone With the WINS |
| 2009-05-04/a> | Tom Liston | Facebook phishing malware |
| 2009-05-02/a> | Rick Wanner | More Swine/Mexican/H1N1 related domains |
| 2009-05-01/a> | Adrien de Beaupre | Incident Management |
| 2009-04-30/a> | Marcus Sachs | ARIN Notification Concerning IPv6 |
| 2009-04-28/a> | Deborah Hale | Updated List of Domains - Swineflu related |
| 2009-04-27/a> | Johannes Ullrich | Swine Flu (Mexican Flu) related domains |
| 2009-04-26/a> | Johannes Ullrich | Pandemic Preparation - Swine Flu |
| 2009-04-24/a> | Pedro Bueno | Did you check your conference goodies? |
| 2009-04-21/a> | Bojan Zdrnja | Web application vulnerabilities |
| 2009-04-16/a> | Adrien de Beaupre | Incident Response vs. Incident Handling |
| 2009-04-16/a> | Adrien de Beaupre | Strange Windows Event Log entry |
| 2009-04-02/a> | Bojan Zdrnja | JavaScript insertion and log deletion attack tools |
| 2009-03-27/a> | Mark Hofman | There is some SMiShing going on in the EU |
| 2009-03-11/a> | Bojan Zdrnja | Massive ARP spoofing attacks on web sites |
| 2009-03-10/a> | Swa Frantzen | TinyURL and security |
| 2009-03-10/a> | Swa Frantzen | Browser plug-ins, transparent proxies and same origin policies |
| 2009-03-02/a> | Swa Frantzen | Obama's leaked chopper blueprints: anything we can learn? |
| 2009-02-25/a> | Swa Frantzen | Targeted link diversion attempts |
| 2009-02-22/a> | Mari Nichols | The Internet Safety Act of 2009 |
| 2009-02-20/a> | Mark Hofman | Phishing with a small twist |
| 2009-02-11/a> | Robert Danford | ProFTPd SQL Authentication Vulnerability exploit activity |
| 2009-02-06/a> | Adrien de Beaupre | Time to patch your HP printers |
| 2009-02-01/a> | Chris Carboni | Scanning for Trixbox vulnerabilities |
| 2009-01-31/a> | Swa Frantzen | DNS DDoS - let's use a long term solution |
| 2009-01-31/a> | Swa Frantzen | Windows 7 - not so secure ? |
| 2009-01-31/a> | John Bambenek | Google Search Engine's Malware Detection Broken |
| 2009-01-20/a> | Adrien de Beaupre | Obamamania |
| 2009-01-18/a> | Maarten Van Horenbeeck | Targeted social engineering |
| 2009-01-11/a> | Deborah Hale | The Frustration of Phishing Attacks |
| 2009-01-08/a> | Kyle Haugsness | BIND OpenSSL follow-up |
| 2009-01-07/a> | William Salusky | BIND 9.x security patch - resolves potentially new DNS poisoning vector |
| 2009-01-04/a> | Rick Wanner | Twitter/Facebook Phishing Attempt |
| 2009-01-02/a> | Rick Wanner | Tools on my Christmas list. |
| 2008-12-28/a> | Raul Siles | Level3 Outage? |
| 2008-12-17/a> | donald smith | Internet Explorer 960714 is released |
| 2008-12-12/a> | Johannes Ullrich | MSIE 0-day Spreading Via SQL Injection |
| 2008-12-12/a> | Swa Frantzen | Browser Security Handbook |
| 2008-12-10/a> | Bojan Zdrnja | 0-day exploit for Internet Explorer in the wild |
| 2008-12-02/a> | Deborah Hale | Sonicwall License Manager Failure |
| 2008-12-01/a> | Jason Lam | Input filtering and escaping in SQL injection mitigation |
| 2008-11-25/a> | Andre Ludwig | The beginnings of a collaborative approach to IDS |
| 2008-11-20/a> | Jason Lam | Large quantity SQL Injection mitigation |
| 2008-11-14/a> | Stephen Hall | More updated tools |
| 2008-11-12/a> | John Bambenek | Thoughts on Security Intelligence (McColo Corp alleged spam/malware host knocked offline) |
| 2008-11-11/a> | Swa Frantzen | Phishing for Google adwords |
| 2008-11-02/a> | Adrien de Beaupre | Daylight saving time |
| 2008-10-31/a> | Rick Wanner | Sprint-Cogent Peering Issue |
| 2008-10-30/a> | Kevin Liston | Making Intelligence Actionable: Part 2 |
| 2008-10-29/a> | Deborah Hale | Day 29 - Should I Switch Software Vendors? |
| 2008-10-29/a> | Deborah Hale | Enom Phishing - Caution Enom Registrars |
| 2008-10-20/a> | Johannes Ullrich | Fraudulent ATM Reactivation Phone Calls. |
| 2008-10-18/a> | Rick Wanner | Updates to SysInternals tools! |
| 2008-10-17/a> | Patrick Nolan | Day 17 - Containing a DNS Hijacking |
| 2008-10-17/a> | Rick Wanner | Day 18 - Containing Other Incidents |
| 2008-10-15/a> | Rick Wanner | Day 15 - Containing the Damage From a Lost or Stolen Laptop |
| 2008-10-12/a> | Mari Nichols | Day 12 Containment: Gathering Evidence That Can be Used in Court |
| 2008-10-10/a> | Marcus Sachs | Fake Microsoft Update Email |
| 2008-10-08/a> | Johannes Ullrich | Domaincontrol (GoDaddy) Nameservers DNS Poisoning |
| 2008-10-07/a> | Kyle Haugsness | Cogent peering problems |
| 2008-10-01/a> | Rick Wanner | Handler Mailbag |
| 2008-09-29/a> | Daniel Wesemann | ASPROX mutant |
| 2008-09-22/a> | Jim Clausing | Lessons learned from the Palin (and other) account hijacks |
| 2008-09-20/a> | Rick Wanner | New (to me) nmap Features |
| 2008-09-16/a> | donald smith | Don't open that invoice.zip file its not from UPS |
| 2008-09-11/a> | David Goldsmith | CookieMonster is coming to Pown (err, Town) |
| 2008-09-09/a> | Swa Frantzen | wordpress upgrade |
| 2008-09-01/a> | John Bambenek | The Number of Machines Controlled by Botnets Has Jumped 4x in Last 3 Months |
| 2008-08-23/a> | Mark Hofman | SQL injections - an update |
| 2008-08-15/a> | Jim Clausing | OMFW 2008 reflections |
| 2008-08-14/a> | Johannes Ullrich | DNSSEC for DShield.org |
| 2008-08-12/a> | Johannes Ullrich | Upcoming Infocon Test and new Color |
| 2008-08-08/a> | Mark Hofman | More SQL Injections - very active right now |
| 2008-08-02/a> | Maarten Van Horenbeeck | A little of that human touch |
| 2008-08-02/a> | Swa Frantzen | BIND: -P2 patches are released |
| 2008-07-31/a> | Swa Frantzen | Linus - Linux and Security - follow-up |
| 2008-07-29/a> | Swa Frantzen | Linus - Linux and Security |
| 2008-07-24/a> | Kyle Haugsness | DNS cache poisoning vulnerability details confirmed |
| 2008-07-24/a> | Bojan Zdrnja | What's brewing in Danmec's pot? |
| 2008-07-11/a> | Jim Clausing | And you thought the DNS issue was an old one... |
| 2008-07-08/a> | Johannes Ullrich | Mulitple Vendors DNS Spoofing Vulnerability |
| 2008-07-07/a> | Pedro Bueno | Bad url classification |
| 2008-07-02/a> | Jim Clausing | Another little script I threw together |
| 2008-06-30/a> | Marcus Sachs | More SQL Injection with Fast Flux hosting |
| 2008-06-25/a> | Deborah Hale | Report of Coreflood.dr Infection |
| 2008-06-24/a> | Jason Lam | SQL Injection mitigation in ASP |
| 2008-06-24/a> | Jason Lam | Microsoft SQL Injection Prevention Strategy |
| 2008-06-23/a> | donald smith | Preventing SQL injection |
| 2008-06-18/a> | Marcus Sachs | Olympics Part II |
| 2008-06-17/a> | Kyle Haugsness | Why go high-tech? |
| 2008-06-13/a> | Johannes Ullrich | SQL Injection: More of the same |
| 2008-06-12/a> | Bojan Zdrnja | Safari on Windows - not looking good |
| 2008-06-10/a> | Swa Frantzen | Linux ASN.1 BER kernel buffer overflow |
| 2008-06-02/a> | Jim Clausing | Emergingthreats.net and ThePlanet |
| 2008-06-01/a> | Mark Hofman | Free Yahoo email account! Sign me up, Ok well maybe not. |
| 2008-05-26/a> | Marcus Sachs | Predictable Response |
| 2008-05-20/a> | Raul Siles | List of malicious domains inserted through SQL injection |
| 2008-05-19/a> | Maarten Van Horenbeeck | Text message and telephone aid scams |
| 2008-05-17/a> | Lorna Hutcheson | XP SP3 Issues |
| 2008-05-13/a> | Swa Frantzen | OpenSSH: Predictable PRNG in debian and ubuntu Linux |
| 2008-05-06/a> | John Bambenek | Windows XP Service Pack 3 Released |
| 2008-05-01/a> | Adrien de Beaupre | Windows XP SteadyState |
| 2008-04-29/a> | Bojan Zdrnja | Windows Service Pack blocker tool |
| 2008-04-24/a> | donald smith | Hundreds of thousands of SQL injections |
| 2008-04-18/a> | John Bambenek | The Patch Window is Gone: Automated Patch-Based Exploit Generation |
| 2008-04-16/a> | Bojan Zdrnja | The 10.000 web sites infection mystery solved |
| 2008-04-16/a> | William Stearns | Windows XP Service Pack 3 - unofficial schedule: Apr 21-28 |
| 2008-04-16/a> | William Stearns | Passer, a aassive machine and service sniffer |
| 2008-04-14/a> | John Bambenek | A Federal Subpoena or Just Some More Spam & Malware? |
| 2008-04-11/a> | John Bambenek | ADSL Router / Cable Modem / Home Wireless AP Hardening in 5 Steps |
| 2008-04-07/a> | John Bambenek | HP USB Keys Shipped with Malware for your Proliant Server |
| 2008-03-27/a> | Pedro Bueno | Freedom of Speech...or not? |
| 2008-03-27/a> | Maarten Van Horenbeeck | Guarding the guardians: a story of PGP key ring theft |
| 2008-03-21/a> | donald smith | D-Link router based worm? |
| 2008-03-14/a> | Kevin Liston | 2117966.net-- mass iframe injection |
| 2008-03-13/a> | Jason Lam | Remote File Include spoof!? |
| 2008-03-12/a> | Joel Esler | Don't use G-Archiver |
| 2008-03-12/a> | Joel Esler | Adobe security updates |
| 2008-01-09/a> | Bojan Zdrnja | Mass exploits with SQL Injection |
| 2007-02-24/a> | Jason Lam | Prepared Statements and SQL injections |
| 2007-01-03/a> | Toby Kohlenberg | VLC Media Player udp URL handler Format String Vulnerability |
| 2006-12-12/a> | Swa Frantzen | Offline Microsoft Patching |
| 2006-10-05/a> | John Bambenek | There are no more Passive Exploits |
| 2006-10-02/a> | Jim Clausing | Back to green, but the exploits are still running wild |
| 2006-09-28/a> | Swa Frantzen | Powerpoint, yet another new vulnerability |
| 2006-09-06/a> | Johannes Ullrich | Updated Packet Attack flash animation |
THE |
| 2024-12-27/a> | Guy Bruneau | Phishing for Banking Information |
| 2024-06-20/a> | Guy Bruneau | No Excuses, Free Tools to Help Secure Authentication in Ubuntu Linux [Guest Diary] |
| 2024-03-17/a> | Guy Bruneau | Gamified Learning: Using Capture the Flag Challenges to Supplement Cybersecurity Training [Guest Diary] |
| 2023-02-16/a> | Jan Kopriva | HTML phishing attachment with browser-in-the-browser technique |
| 2022-02-05/a> | Didier Stevens | Power over Ethernet and Thermal Imaging |
| 2022-02-01/a> | Xavier Mertens | Automation is Nice But Don't Replace Your Knowledge |
| 2021-11-08/a> | Xavier Mertens | (Ab)Using Security Tools & Controls for the Bad |
| 2021-10-18/a> | Xavier Mertens | Malicious PowerShell Using Client Certificate Authentication |
| 2021-06-24/a> | Xavier Mertens | Do you Like Cookies? Some are for sale! |
| 2021-05-29/a> | Guy Bruneau | Spear-phishing Email Targeting Outlook Mail Clients |
| 2020-04-16/a> | Johannes Ullrich | Using AppLocker to Prevent Living off the Land Attacks |
| 2019-11-11/a> | Johannes Ullrich | Are We Going Back to TheMoon (and How is Liquor Involved)? |
| 2019-07-10/a> | Rob VandenBrink | Dumping File Contents in Hex (in PowerShell) |
| 2019-01-30/a> | Russ McRee | CR19-010: The United States vs. Huawei |
| 2018-11-20/a> | Xavier Mertens | Querying DShield from Cortex |
| 2018-11-11/a> | Pasquale Stirparo | Community contribution: joining forces or multiply solutions? |
| 2018-06-04/a> | Rob VandenBrink | Digging into Authenticode Certificates |
| 2017-12-05/a> | Tom Webb | IR using the Hive Project. |
| 2017-09-18/a> | Johannes Ullrich | SANS Securingthehuman posted a follow up to their Equifax breach webcast: https://securingthehuman.sans.org/blog/2017/09/15/equifax-webcast-follow-up |
| 2017-01-11/a> | Johannes Ullrich | January 2017 Edition of Ouch! Security Awareness Newsletter Released: https://securingthehuman.sans.org/ouch |
| 2016-11-02/a> | Rob VandenBrink | What Does a Pentest Look Like? |
| 2016-10-07/a> | Rick Wanner | First Hurricane Matthew related Phish |
| 2016-09-15/a> | Xavier Mertens | In Need of a OTP Manager Soon? |
| 2016-05-02/a> | Rick Wanner | Lean Threat Intelligence |
| 2015-12-15/a> | Russ McRee | Security Management vs Chaos: Understanding the Butterfly Effect to Manage Outcomes & Reduce Chaos |
| 2015-09-23/a> | Daniel Wesemann | Making our users unlearn what we taught them |
| 2015-08-16/a> | Guy Bruneau | Are you a "Hunter"? |
| 2015-02-06/a> | Johannes Ullrich | Anthem, TurboTax and How Things "Fit Together" Sometimes |
| 2014-07-02/a> | Johannes Ullrich | July Ouch! Security Awareness Newsletter Released. E-mail Do's and Don'ts http://www.securingthehuman.org/resources/newsletters/ouch/2014#july2014 |
| 2014-03-13/a> | Daniel Wesemann | Identification and authentication are hard ... finding out intention is even harder |
| 2014-02-18/a> | Johannes Ullrich | More Details About "TheMoon" Linksys Worm |
| 2014-02-05/a> | Johannes Ullrich | SANS Ouch Security Awareness Newsletter What is Malware http://www.securingthehuman.org/ouch |
| 2013-12-20/a> | Daniel Wesemann | authorized key lime pie |
| 2013-11-13/a> | Johannes Ullrich | Packet Challenge for the Hivemind: What's happening with this Ethernet header? |
| 2013-09-18/a> | Rob VandenBrink | Cisco DCNM Update Released |
| 2013-09-09/a> | Johannes Ullrich | SSL is broken. So what? |
| 2013-09-05/a> | Rob VandenBrink | Building Your Own GPU Enabled Private Cloud |
| 2013-08-09/a> | Kevin Shortt | Copy Machines - Changing Scanned Content |
| 2013-03-23/a> | Guy Bruneau | Apple ID Two-step Verification Now Available in some Countries |
| 2013-02-06/a> | Johannes Ullrich | Intel Network Card (82574L) Packet of Death |
| 2013-02-04/a> | Adam Swanger | SAN Securing The Human Monthly Awareness Video - Advanced Persistent Threat (APT) http://www.securingthehuman.org/resources/ncsam |
| 2012-10-26/a> | Adam Swanger | Securing the Human Special Webcast - October 30, 2012 |
| 2012-07-10/a> | Rob VandenBrink | Today at SANSFIRE (09 July 2012) - ISC Panel Discussion on the State of the Internet |
| 2012-07-02/a> | Dan Goldberg | Storms of June 29th 2012 in Mid Atlantic region of the USA |
| 2011-05-18/a> | Bojan Zdrnja | Android, HTTP and authentication tokens |
| 2011-04-28/a> | Chris Mohan | Gathering and use of location information fears - or is it all a bit too late |
| 2011-04-11/a> | Johannes Ullrich | Layer 2 DoS and other IPv6 Tricks |
| 2011-01-12/a> | Richard Porter | Has Big Brother gone Global? |
| 2010-12-21/a> | Rob VandenBrink | Network Reliability, Part 2 - HSRP Attacks and Defenses |
| 2010-09-21/a> | Johannes Ullrich | Implementing two Factor Authentication on the Cheap |
| 2010-07-24/a> | Manuel Humberto Santander Pelaez | Transmiting logon information unsecured in the network |
| 2010-07-21/a> | Adrien de Beaupre | Dell PowerEdge R410 replacement motherboard firmware contains malware |
| 2010-03-10/a> | Rob VandenBrink | Microsoft re-release of KB973811 - attacks on Extended Protection for Authentication |
| 2010-02-09/a> | Adrien de Beaupre | When is a 0day not a 0day? Samba symlink bad default config |
| 2009-11-11/a> | Rob VandenBrink | Layer 2 Network Protections against Man in the Middle Attacks |
| 2008-10-15/a> | Rick Wanner | Day 15 - Containing the Damage From a Lost or Stolen Laptop |
| 2006-10-05/a> | John Bambenek | There are no more Passive Exploits |
| 2006-09-29/a> | Kevin Liston | A Report from the Field |
BROWSER |
| 2023-04-13/a> | Johannes Ullrich | HTTP: What's Left of it and the OCSP Problem |
| 2023-02-16/a> | Jan Kopriva | HTML phishing attachment with browser-in-the-browser technique |
| 2022-08-23/a> | Xavier Mertens | Who's Looking at Your security.txt File? |
| 2022-06-22/a> | Xavier Mertens | Malicious PowerShell Targeting Cryptocurrency Browser Extensions |
| 2022-05-17/a> | Xavier Mertens | Use Your Browser Internal Password Vault... or Not? |
| 2020-06-11/a> | Xavier Mertens | Anti-Debugging JavaScript Techniques |
| 2018-09-07/a> | Xavier Mertens | Crypto Mining in a Windows Headless Browser |
| 2018-05-30/a> | Bojan Zdrnja | The end of the lock icon |
| 2017-12-03/a> | Xavier Mertens | StartSSL: Termination of Services is Now Scheduled |
| 2015-05-20/a> | Brad Duncan | Logjam - vulnerabilities in Diffie-Hellman key exchange affect browsers and servers using TLS |
| 2013-12-11/a> | Johannes Ullrich | Browser Fingerprinting via SSL Client Hello Messages |
| 2013-09-13/a> | Rob VandenBrink | Update for Safari to version 5.1.10 is out - http://support.apple.com/kb/HT5921 |
| 2012-07-23/a> | Johannes Ullrich | Most Anti-Privacy Web Browsing Tool Ever? |
| 2012-06-04/a> | Rob VandenBrink | Browsers and SSL Security - a Race to the Bottom ! |
| 2012-05-22/a> | Johannes Ullrich | The "Do Not Track" header |
| 2011-08-26/a> | Daniel Wesemann | User Agent 007 |
| 2011-06-09/a> | Richard Porter | One Browser to Rule them All? |
| 2011-04-10/a> | Raul Siles | Recent security enhancements in web browsers (e.g. Google Chrome) |
| 2011-03-23/a> | Johannes Ullrich | Firefox 4 Security Features |
| 2011-01-27/a> | Chris Carboni | Opera Updates |
| 2010-12-18/a> | Raul Siles | Google Chrome (Stable and Beta) have been updated to 8.0.552.224 for all platforms (Chrome OS too). http://bit.ly/fW04cr |
| 2010-10-12/a> | Adrien de Beaupre | New version of Opera- Opera 10.63 is a recommended upgrade offering security and stability enhancements: http://www.opera.com/browser/download/ |
| 2010-06-23/a> | Scott Fendley | Opera Browser Update |
| 2010-05-19/a> | Jason Lam | EFF paper about browser tracking |
| 2010-02-03/a> | Rob VandenBrink | Support for Legacy Browsers |
| 2010-01-27/a> | Raul Siles | Google Chrome v4.0.249.78 Released: http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html |
| 2009-07-17/a> | John Bambenek | Cross-Platform, Cross-Browser DoS Vulnerability |
| 2009-03-19/a> | Mark Hofman | Browsers Tumble at CanSecWest |
| 2009-03-04/a> | Deborah Hale | Firefox Releases version 3.0.7 |
| 2008-12-17/a> | donald smith | Opera 9.6.3 released with security fixes |
| 2008-12-12/a> | Swa Frantzen | Browser Security Handbook |
| 2008-08-20/a> | Adrien de Beaupre | From the mailbag, Opera 9.52... |
| 2008-06-19/a> | William Stearns | Firefox vunerability |
| 2008-04-18/a> | John Bambenek | EV SSL Certificates - Just once, why can't one of our poorly considered quick fixes work? |
| 2008-03-24/a> | Raul Siles | Next-generation Web browsers? |
