INTERNET STORM CENTER SPOTLIGHT
ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html
USPS Phishing Scam Targeting iOS Users
Published: 2023-07-30
Last Updated: 2023-07-30 15:33:55 UTC
by Johannes Ullrich (Version: 1)
Phishing scams have frequently arrived as an SMS message (sometimes called "Smishing"). SMS messages are easy and cheap to send, and we have documented how attackers like to scan for exposed credentials for services like Twilio to make it even cheaper.
But today, I received a message on my Apple devices that didn't arrive as an green SMS, but instead as a blue iMessage.
As I always do, I clicked on the link on my Mac. But I was immediately redirected to the legitimate USPS page (usps.com). It didn't matter if I used Safari or Chrome on macOS. So I tried Safari on my iPhone and was directed to the phishing page.
Read the full entry:
https://isc.sans.edu/diary/USPS+Phishing+Scam+Targeting+iOS+Users/30078/
Summary of DNS over HTTPS requests against our honeypots
Published: 2023-08-01
Last Updated: 2023-08-01 14:04:17 UTC
by Johannes Ullrich (Version: 1)
Our honeypots see a lot of DNS over HTTP(s) requests against the "/dns-query" endpoint. This endpoint is used by DNS over HTTPs requests to receive queries. Queries can use different encodings. You may either see the more readable URL encoding, like "?name=google.com&type=A" or the raw DNS data encoding, like "?dns=mNwBAAABAAAAAAAABmdvb2dsZQNjb20AAAEAAQ".
Decoding the raw queries isn't hard, but note that the padding "=" characters are cut off at the end. Some base64 implementations will refuse to decode data with missing padding.
Our database lists a total of 5,727 different URLs starting with "dns-query". Only 12 of them use the "URL encoded" format...
A few used queries to echodns.xyz to find open resolvers. For DNS over HTTP(s), an attacker would not use an open resolver for denial of service attacks (at least there is no amplification). But they may use it to obtain an anonymous DNS relay. Shadowserver uses these queries to populate their open resolver feed.
The remaining 5,714 queries use DNS encoding. DNS encoding does include a random query ID (not required for DNS over HTTP(s), but still often set). We need to decode the names to find out which unique names are being resolved.
Read the full entry:
https://isc.sans.edu/diary/Summary+of+DNS+over+HTTPS+requests+against+our+honeypots/30084/
ShellCode Hidden with Steganography
Published: 2023-07-28
Last Updated: 2023-07-28 07:13:40 UTC
by Xavier Mertens (Version: 1)
When hunting, I'm often surprised by the interesting pieces of code that you may discover... Attackers (or pentesters/redteamers) like to share scripts on VT to evaluate the detection rates against many antivirus products. Sometimes, you find something cool stuffs.
Yesterday, I found a small Python script that inject a shellcode into memory but, this time, the payload is hidden in a PNG picture using a well-known technique: steganography. The technique used in the sample, is to use the LSB (least significant bit) of each pixel with a bit of the payload. On the Internet, you can find a lot of free services to hide a text message into a picture (and vice-versa) but you can absolutely store any type of data, like in this case, executable code (the shellcode).
The script (SHA256:465b63b8661f2175d1063bfefdde2f949d366448e34d6e1a4f9853709352d02e) has a VT score of 16/60.
Read the full entry:
https://isc.sans.edu/diary/ShellCode+Hidden+with+Steganography/30074/