Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: InfoSec Handlers Diary Blog - Internet Storm Center Diary 2017-01-05 InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Was the Brazilian version of Google hijacked two days ago?

Published: 2017-01-05
Last Updated: 2017-01-05 22:46:48 UTC
by John Bambenek (Version: 1)
2 comment(s)

ISC reader Renato Marihno wrote in with some interesting observations out of Brazil the last couple of days.  It seems for about 30 minutes on January 3rd, google.com.br did not point to Google's IP space and the nameservers were set to ns1-leader.vivawebhost.com and ns2-leader.vivawebhost.com.  The issue was relatively quickly discovered and corrected but still shows the risk that hijacked registrant account access can be for enterprises.  You can read Renato's write up on LinkedIn.

This is a reminder that if an attacker controls DNS, they control everything. And if they control your domain registrant account, they control DNS.  This attack was crude and easy to discover, but it would be very easy to set of a man-in-the-middle attack using such a technique without a mitigating control like TLS in place.  Make sure your domain registry accounts require two-factor authentication and have strong passwords.

--
John Bambenek
bambenek \at\ gmail /dot/ com
Fidelis Cybersecurity

Keywords:
2 comment(s)

New Year's Resolution: Build Your Own Malware Lab?

Published: 2017-01-05
Last Updated: 2017-01-05 22:41:08 UTC
by John Bambenek (Version: 1)
0 comment(s)

If you're looking to build your own malware lab using open-source tools to take your GREM skills to the next level, take a look at Robert Simmons' of ThreatConnect's talk at VirusBulletin from a few months ago. Has a brief paper, but the video is people what you want to look at if you are new to all this. In essence, it is set up of the following components: Cuckoo Sandbox (with some modications), volatility (for memory analysis), thug (for a low interaction honeyclient), and Bro (for network analysis).  It probably would only take a half-day of your time to set up and you can be off to the races on analyzing malware that's fresh off the wire.

Couple of notes, always be sure to do this from a non-attributed network (i.e. not your company).  Sandboxing involves running actual malware so it will set off the IDS.  Many of my sandbox systems run behind a pfsense firewall that connects to a commodity VPN so I can't easily be directly tied to things and has the advantages of letting me change what country I "am in" as malware may behave differently when it thinks it is running in different countries.

Take a look and let us know if you find more interesting things out there with your malware hunting efforts.

--
John Bambenek
bambenek \at\ gmail /dot/ com
Fidelis Cybersecurity

0 comment(s)
ISC Stormcast For Thursday, January 5th 2017 https://isc.sans.edu/podcastdetail.html?id=5317
Diary Archives