32 posts categorized "Malware & Crimeware" Feed

LMTV HomeLAN Alerts | How Does Cyber Attacks Affect Our Real-Life Liberty? (with Tim O'Neill)

Live Event Time - Monday, February 9, 2015 - 9:30 AM PST

LMTV HomeLAN Banner How many of you remember attending NetWorld+Interop 2001 which was held at the Georgia World Congress Center between September 10 and 14?

How many of you remember watching the big screen TV when the second plane crashed into the South Tower?

How many of you were witness of both events?

Those of us who did have seen our lives changed profoundly.

OldcommguyWe might not have joined the army. But many of us, including our very own +Tim O'Neill, have become first responders, protecting our homeland with what we know and what we do best.

This week, as part of the LMTV Pro series, we are starting a new theme reporting on domestic and international cyber attacks and cyber crimes and how they affect our lives and our liberty.

All sacrifice some but some sacrifice all.

For more episodes of LMTV, Please visit LoveMyTool.TV.

Using Passive and Active Approaches to Manage the Heartbleed Issue (by Darragh Delaney)

 Using passive and active approaches to manage the Heartbleed issue/tragedy!

Have you changed your passwords?

We are now into week two/three of the Heartbleed issue and while many high profile sites were patched initially, a lot of servers still remain vulnerable. Some people have adopted a head in the sand type approach and that they think that only high profile servers will be targeted. My own research shows that SSL servers on networks of all sizes are being targeted

Heartbleed ssl
If you have not done so already you need to get an inventory of systems together so that you know what to monitor and patch. This is easier said than done. Many devices which have a web based management console will be running OpenSSL. Windows server running 3rd party applications may also be vulnerable as these applications may use OpenSSL for web services.

Continue reading "Using Passive and Active Approaches to Manage the Heartbleed Issue (by Darragh Delaney)" »

The Strange History of Port 0 (by Jim MacLeod)

The Strange History of Port 0

While reading the latest report from Arbor Network on DDoS activity across the Internet in Q2 2013, a particular phrase jumped out at me:

“ TCP fragmentation attacks (port 0) are up from about 10% last year to nearly 25% this year. ”

There are three reasons I don’t understand that statement. First, TCP is a streaming protocol, not a datagram protocol, so there’s no concept of “fragmentation” within TCP. Second, googling “TCP fragmentation” results in an IDS evasion technique using overlapping SEQ numbers in retransmissions to replace the contents of the receive buffer on the recipient, but not the IDS (see here for an awesome example including Wireshark screenshots), but that has nothing to do with port 0. Third, and the one I will explore here, port 0 isn’t defined as a valid port.

DDOS attackKnow thy enemy!

Despite the fact that port 0 isn’t a valid port for traffic, network management tools will regularly report that you’ve got traffic headed there.  However, that’s not what the packets contain. 

Continue reading "The Strange History of Port 0 (by Jim MacLeod)" »

Never Give Up While Freedom Is On The Line (by Casey Mullis)

I recently had the pleasure of assisting another Investigator from Carroll County with forensics on one of the new Macbook Pro 13 inch with a 128 GB SSD. The first thing you notice is there is no CD/DVD drive. There is also no Firewire port only a thunderbolt port and USB 3.0.

So now what? I first tried booting with Blackbag's  MacQuasition but it would not boot. I called Blackbag tech support and found out that the version I had did not support the new model of Macbook that we were working on. The hard drive in the Macbook was a SSD nonstandard drive. See image(s) below.


So what do you do? Do you give up on getting the forensic image of the hard drive or do you push forward and keep digging to find a solution?

Continue reading "Never Give Up While Freedom Is On The Line (by Casey Mullis)" »