Summary
— A collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not vetted nor intended to be an exhaustive source. Keeping up with the enormous volume of security-related information is a daunting task, but this is my way of filtering the most useful items and improving the signal to noise ratio.
Even here, there is a lot of material, so I included my top picks from each category below, and added brief quotes for additional context. I hope this highlights certain bits and helps readers identify content to consume. Happy Reading!
Highlights:
News/Reports/Papers: ATT&CKing Threat Management: A Structured Methodology for Cyber Threat Analysis
“This analysis aids decision makers in their commission to balance risk management with resource management. By leveraging the MITRE Adversarial Tactics Techniques & Common Knowledge (ATT&CK) framework as a quantitative data model, analysts can bridge the gap between strategic, operational, and tactical intelligence”
by Andy Piazza
Threat Research: LookBack Malware Targets the United States Utilities Sector
“distinct delivery methodology coupled with unique LookBack malware highlights the continuing threats posed by sophisticated adversaries to utilities systems and critical infrastructure providers”
by Michael Raggi and Dennis Schwarz with the Proofpoint Threat Insight Team
Tools and Tips: Ten Tips for Thriving at Infosec Cons
“With Hacker Summer Camp starting in just days, I thought this would be a good time to share my tips for making the most of infosec conferences. Whether it’s Black Hat, DEF CON, or your local BSides, infosec cons are an awesome way to meet people and learn, and that can be crucial to your career advancement.”
by Katie Nickels
Breaches: Capital One Data Theft Impacts 106M People
“On July 29, FBI agents arrested Paige A. Thompson on suspicion of downloading nearly 30 GB of Capital One credit application data from a rented cloud data server. Capital One said the incident affected approximately 100 million people in the United States and six million in Canada.”
Krebs on Security
Vulns/Exploits: Project Zero’s Vulnerability Disclosure FAQ
“over the total lifetime of Project Zero, 95.8% of issues have been fixed under deadline.”
Google Project Zero
Industry Reports, News, and Miscellany
- Q3 2019 Email Fraud and Identity Deception Trends report (requires email registration)
- Development stops on PowerShell Empire framework after project reaches its goal
- Inside Malware Markets: Current Trends and Competitive Forces
- Financial threats in H1 2019
- APT trends report Q2 2019
- Exploit kits: summer 2019 review
- The Evolution of Cyber Attacks on Electric Operations
- The Revival and Rise of Email Extortion Scams
- CrowdStrike Mobile Threat Report Offers Trends and Recommendations for Securing Your Organization
- Here’s what you need to know about business email compromise (BEC)
- Cyber and Information Operations
- ATT&CKing Threat Management: A Structured Methodology for Cyber Threat Analysis
- Momentum and Inspiration – SANS DFIR Summit 2019
- Getting Started with ATT&CK: Assessments and Engineering
Threat Research – Malware, Phishing, and other Campaigns in the Wild
- SystemBC is like Christmas in July for SOCKS5 Malware and Exploit Kits
- LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards
- Yemen-Based Disinformation Campaign Distributing Fake News in Israel and the Arab World
- A Deeper Look at the Phishing Campaigns Targeting Bellingcat Researchers Investigating Russia
- DEALPLY REVISITED: LEVERAGING REPUTATION SERVICES TO REMAIN UNDER THE RADAR
- Android ransomware is back
- Zegost from Within – New Campaign Targeting Internal Interests
- Keeping a Hidden Identity: Mirai C&Cs in Tor Network
- Cobalt Group Returns To Kazakhstan
- Malvertising: Online advertising’s darker side
- URSNIF INFECTION WITH PUSHDO
- Dridex’s Bag of Tricks: An Analysis of its Masquerading and Code Injection Techniques
- Clop Ransomware
- Frankenstein was a hack: the copy/paste cryptominer
- The Malicious Use of Pastebin
- Say hello to Lord Exploit Kit
Tools and Tips
- Ten Tips for Thriving at Infosec Cons
- Introducing Ghostwriter:
- AWS S3 Logjam: Server Access Logging vs. Object-Level Logging
- New Re2PCAP tool speeds up PCAP process for Snort rules
- The ultimate guide to VPN encryption, protocols, and ciphers
- Covenant: The Usability Update
- Getting an Attacker IP Address from a Malicious Linux At Job
- Lure – User Recon Automation for GoPhish
- MISP to Microsoft Graph Security Script
- Extract Malware Configuration with MalConfScan
- PhanTap (Phantom Tap )is an ‘invisible’ network tap aimed at red teams
- An Introduction To Code Analysis With Ghidra
Breaches, Government, and Law Enforcement
- Cisco to pay $8.6 million for selling vulnerable software to US government
- Capital One Data Theft Impacts 106M People
- FTC warns Equifax claimants will get ‘nowhere near’ $125 cash payout
Vulnerabilities and Exploits
- Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution
- DHCP Client Remote Code Execution Vulnerability Demystified
- New Dragonblood vulnerabilities found in WiFi WPA3 standard
- News and updates from the Project Zero team at Google: Vulnerability Disclosure FAQ