OpenSSH User Enumeration Vulnerability: a Close Look

Intro An OpenSSH user enumeration vulnerability (CVE-2018-15473) became public via a GitHub commit. This vulnerability does not produce a list of valid usernames, but it does allow guessing of usernames. In this blog post, we take a closer look at this vulnerability and propose mitigation and monitoring actions. Technical details This vulnerability manifests itself in […]

Shortcomings of blacklisting in Adobe Reader and what you can do about it

A variation of a class of malicious PDFs appeared in the wild. In this blog post, we will show you how to protect your systems and how to analyze these PDFs. The PDFs embed a file type with extension .SettingContent-ms that can be used on Windows 10 to execute arbitrary code. We have observed on […]

Sextortion Scam With Leaked Passwords Succeeds

Following the forum post on¬†sextortion emails being spammed¬†to innocent victims, we were curious to see if this scam would indeed be successful. We have observed similar scam campaigns before, but now the scammers seem to include the victim’s password as well, creating a sense of legitimacy. During our analysis we observed 3 payments to the […]

Extracting a Windows Zero-Day from an Adobe Reader Zero-Day PDF

In May 2018, when ESET published a blog post covering PDFs with 2 zero days, our interest was immediately piqued. Promptly after our analysis of these PDFs, we send out an early warning to our customers. Now that Microsoft published a blog post with the detailed analysis of the zero days, we find it appropriate […]

Creating custom YARA rules

In a previous post, we created YARA rules to detect compromised CCleaner executables (YARA rules to detect compromised CCleaner executables). We will use this example as an opportunity to illustrate how the creation of these custom YARA rules was performed. In its blog post, Talos shared 3 hashes as Indicators Of Compromise (IOCs): 1a4a5123d7b2c534cb3e3168f7032cf9ebf38b9a2a97226d0fdb7933cf6030ff 6f7840c77f99049d788155c1351e1560b62b8ad18ad0e9adda8218b9f432f0a9 […]

Windows Credential Guard & Mimikatz

Here at NVISO, we are proud to have contributed to the new SANS course ‚ÄúSEC599: Defeating Advanced Adversaries – Implementing Kill Chain Defenses‚ÄĚ. This six-day training focuses on implementing effective security controls to prevent, detect and respond to cyber attacks. One of the defenses covered in SEC599 is Credential Guard. Obtaining and using credentials and […]

New year, new vulnerabilities: Spectre & Meltdown

Two new vulnerabilities ‚ÄúSpectre‚ÄĚ and ‚ÄúMeltdown‚ÄĚ were recently discovered, affecting millions of systems worldwide. Please find our security advisory below. ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬† ¬†¬† Summary Spectre and Meltdown are hardware vulnerabilities in […]

KRACKing WPA2

A new vulnerability in the WPA2 protocol was discovered by¬†Mathy¬†Vanhoef¬†(researcher at KU Leuven) and published yesterday. The vulnerability – dubbed¬† “KRACK” – enables an attacker to intercept WPA2 encrypted network traffic between a client device (e.g. mobile or laptop) and a router. Depending on the network configuration¬†it is even possible¬†for an attacker to alter or […]