Azure Security Logging – part 3: security-logging capabilities of Azure virtual machines

In this third blog post in a series about Azure Security Logging, we will focus on collecting security logs from Windows and Linux virtual machines. In part 1 we discussed how to define a security logging strategy in Azure. Part 2 went into detail about logging in some of the key Azure services. In this [...]

Analyzing a Malicious Spreadsheet Dropping a DLL

Introduction This week, we received a suspicious spreadsheet which was used as a malware dropper in a phishing campaign. The spreadsheet writes a DLL file to disk and subsequently executes it. In this blog post, we perform the full analysis of the suspicious spreadsheet. Analyzing the document The analysis of this Excel file starts with [...]

Using Burp’s session Handling Rules to insert authorization cookies into Intruder, Repeater and even sqlmap

The problem.... Recently, NVISO was tasked to do a penetration test on a web application that had very short authenticated sessions and that implemented anti CSRF tokens. This presented a unique challenge, as most of our automated tools and techniques had no reliable way of working as the base requests that were being used as [...]

Extracting Certificates From the Windows Registry

I helped a colleague with a forensic analysis by extracting certificates from the Windows registry. In this blog post, we explain how to do this. The Windows registry contains binary blobs, containing certificates. Like this one: Examples of locations where certificates can be found: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates Certificates, encoded in DER format, always start with value [...]

Intercepting traffic from Android Flutter applications

Update: The explanation below explains the step for ARMv7. For ARMv8 (64bit), see this blogpost. Flutter is Google's new open source mobile development framework that allows developers to write a single code base and build for Android, iOS, web and desktop. Flutter applications are written in Dart, a language created by Google more than 7 [...]

Solving Flaggy Bird (Google CTF 2019)

A few weekends ago we participated in the Google CTF. While we didn't make it to the top 10, we did manage to solve quite a few challenges. This is my writeup of FlaggyBird, the only mobile challenge that was available. The challenge The challenge was an .apk that did not require network connectivity. Installing [...]

Will they melt? Testing the resistance of flash memory chips

Firmware: the holy grail of most Internet of Things (IoT) security assessments! Sometimes, getting access to a device's firmware can be as easy as visiting the vendor's website. Other times, the only option is to dump it directly from the hardware, and this is where things get interesting. Some procedures used for dumping can expose [...]

Malicious SYLK Files with MS Excel 4.0 Macros

Since about a week, we are seeing an increase of SYLK files submitted to VirusTotal. A SYLK file (SYmbolic LinK) is a pure text file format used to store Excel spreadsheets with extension .slk. Although SYLK files can't contain VBA macros, they can still contain executable code, for example DDE commands or MS Excel 4.0 [...]

Optimizing Elasticsearch – Part 2: Index Lifecycle Management

In the previous blog post "Optimize Elasticsearch for log collection - Part 1: reduce the number of shards", we have seen one solution to recover a cluster suffering from the "too many shards syndrome" by merging indices that were too small. In this article, we'll see how we can rely on latest Elasticsearch feature to [...]