SANS - Internet Storm Center - Cooperative Cyber Threat Monitor And Alert System
Published: 2011-02-01. Last Updated: 2011-02-01 02:31:11 UTC by Lenny Zeltser (Version: 1) Incident responders sometimes need to investigate the nature of a website reported as being malicious. They do this by connecting to the remote site, while taking care not to infect themselves, perhaps by using a laboratory machine that isn't connected to the production network. They also take care to concea
Remote Thread Execution in System Process using NtCreateThreadEx for Vista & Windows7 - www.SecurityXploded.com
Windows provides API function called, CreateRemoteThread [Reference 2] which allows any process to execute thread in the context of remote process. This method has been mainly used to inject DLL into remote process, the technique popularly known as 'DLL Injection'. Especially malware programs exploited this mechanism to evade their detection by injecting their DLL into legitimate process's such as
è„…ã‹ã•ã‚Œã‚‹DNSã®å®‰å…¨æ€§
インターãƒãƒƒãƒˆã®é‡è¦ãªåŸºç›¤æŠ€è¡“ã®1ã¤ã§ã‚ã‚‹DNSã«å¯¾ã—ã¦æ–°ãŸãªæ”»æ’ƒæ‰‹æ³•ãŒå…¬é–‹ã•ã‚Œã€ãã®å®‰å…¨æ€§ãŒè„…ã‹ã•ã‚Œã¦ã„る。DNSã«ã‚»ã‚ュリティ機能をæä¾›ã™ã‚‹ãŸã‚ã®æŠ€è¡“ã§ã‚ã‚Šã€æ™®åŠãŒé€²ã‚“ã§ã„ã‚‹DNSSECã«ã¤ã„ã¦ã€ä»•çµ„ã¿ã¨é‹ç”¨æ–¹æ³•ã‚’紹介ã™ã‚‹ã€‚（編集部） インターãƒãƒƒãƒˆã‚’支ãˆã‚‹DNSã¨ã¯ インターãƒãƒƒãƒˆä¸Šã§ã¯ã€é€šä¿¡ã™ã‚‹ã‚³ãƒ³ãƒ”ュータを特定ã™ã‚‹ãŸã‚ã«IPアドレスを使用ã™ã‚‹ã€‚ã—ã‹ã—ã€æ•°å—ã®ã¿ã§æ§‹æˆã•ã‚Œã‚‹IPアドレスã¯äººé–“ã«ã¨ã£ã¦æ‰±ã„ã¥ã‚‰ã„ãŸã‚ã€è¦šãˆã‚„ã™ã„よã†ã«åå‰ã‚’付ã‘る方法ãŒè€ƒæ¡ˆã•ã‚ŒãŸã€‚ ã“ã®ã¨ãã€äººé–“ãŒä½¿ç”¨ã™ã‚‹åå‰ï¼ˆãƒ‰ãƒ¡ã‚¤ãƒ³å）ã¨ã‚³ãƒ³ãƒ”ュータãŒä½¿ç”¨ã™ã‚‹IPアドレスを対応付ã‘る仕組ã¿ãŒå¿…è¦ã«ãªã‚‹ã€‚ã“ã®å½¹å‰²ã‚’æ‹…ã†ã®ãŒã€ã”å˜ã˜DNS（Domain Name System）ã§ã‚る。 DNSSECå°Žå…¥ã®èƒŒæ™¯â€”—カミンスã‚ー型攻撃 DNSã¯ã€ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã®çˆ†ç™ºçš„ãªæ™®åŠã«ä¼´ã†ãƒ‰ãƒ¡ã‚¤ãƒ³å利用ã®æ€¥é€Ÿãªæ‹¡å¤§ã«ã‚‚対応ã—ã€ã‚¤ãƒ³ã‚¿
Malware Patrol | Cyber Threat Intelligence
Focused Experts Since 2005, Malware Patrol has focused solely on threat intelligence. We monitor the latest malicious campaigns to collect a variety of indicators. These range from malware, ransomware, and phishing to command-and-control systems and DoH servers. Each indicator is verified daily and crucial context, like ATT&CK TTPs, is incorporated. We offer feeds in a variety of formats that inte
From 0x90 to 0x4c454554, a journey into exploitation.
I put some time in and compiled a list in a course type layout to help people in process of learning exploit development. I hope my research will help others spend more time learning and less time searching. First off I want to thank the corelan guys for the help they have provided me so far in the process. layout: I will be posting in a hierarchical structure, each hierarchy structure should be f
Cloud Computingã«ãŠã‘ã‚‹VMã®ã‚»ã‚ュリティ(14/Jan/2010)
1. Cloud Computingã«ãŠã‘ã‚‹ VMã®ã‚»ã‚ュリティ 産æ¥æŠ€è¡“ç·åˆç ”究所 æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç ”ç©¶ã‚»ãƒ³ã‚¿ãƒ¼ é ˆå´Žæœ‰åº· Research Center for Information Security 2. アウトライン • 仮想化ã¯ã‚»ã‚ュリティを強化ã™ã‚‹ã‹ï¼Ÿ • å„種ã®æ”»æ’ƒ – VM内(Inter VM)ã®æ”»æ’ƒ • I/O Fuzzing [Google Report], [Symantec Report] – VMé–“(Cross VM)ã®æ”»æ’ƒ (Side Channel 攻撃) • 物ç†ã‚ャッシュã®è¦—ã見 Cross VM attack [CSS09] • 仮想メモリã®è¦—ã見 OverShadow[ASPLOS08], SP3[Vee08] • LiveMigration時ã®RootKitæ··å…¥ [BlackHat DC 08] • 防御技術 – VM排他制御 (Isolation
Microsoft Security Response Center
Mitigating NTLM Relay Attacks by Default Monday, December 09, 2024 Introduction In February 2024, we released an update to Exchange Server which contained a security improvement referenced by CVE-2024-21410 that enabled Extended Protection for Authentication (EPA) by default for new and existing installs of Exchange 2019. While we’re currently unaware of any active threat campaigns involving NTLM
Dynamic-Link Library Security - Win32 apps
When an application dynamically loads a dynamic-link library without specifying a fully qualified path name, Windows attempts to locate the DLL by searching a well-defined set of directories in a particular order, as described in Dynamic-Link Library Search Order. If an attacker gains control of one of the directories on the DLL search path, it can place a malicious copy of the DLL in that directo
Analyzing CPU traces from Linux with PerfView - Vance Morrison's Weblog - Site Home - MSDN Blogs
In Visual Studio 2022 17.10 Preview 2, we’ve introduced some UX updates and usability improvements to the Connection Manager. With these updates we provide a more seamless experience when connecting to remote systems and/or debugging failed connections. Please install the latest Preview to try it out. Read on to learn what the Connection ...
An Analysis of the iKeeB (duh) iPhone botnet
An Analysis of the iKee.B (Duh) iphone Botnet Phillip Porras, Hassen Saidi, and Vinod Yegneswaran http://mtc.sri.com/iphone/ Release Date: 21 December 2009 Last Update:  14 December 2009 Computer Science Laboratory SRI International 333 Ravenswood Avenue Menlo Park CA 94025 USA We present an analysis of the iKee.B (duh) Apple iPhone bot client, captured on 25 November 2009. The bot clien
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
Endpoint Protection - Symantec Enterprise
felinemenace.org
Multi-State Information Sharing and Analysis Center
Cyber Security
On the effectiveness of DEP and ASLR | MSRC Blog | Microsoft Security Response Center
http://crazylazy.info/blog/content/0x41-back-bugs
Meeting: 2006.11.29 0x0003 - AHA!
start [My Darklevel]
Metasploit: Metasploit Framework 3.7.1 Released!
State of the art in Phoenix Exploit's Kit
{{#tags}}- {{label}}
{{/tags}}