Subscribe: SANS Internet Storm Center, InfoCON: green
http://isc.sans.org/rssfeed.xml
Added By: Feedage Forager Feedage Grade B rated
Language: English
Tags:
fri sep  https isc  isc stormcast  isc  mon sep  sans  sep introduction  sep  september https  state union  stormcast september 
Rate this Feed
Rate this feedRate this feedRate this feedRate this feedRate this feed
Rate this feed 1 starRate this feed 2 starRate this feed 3 starRate this feed 4 starRate this feed 5 star

Comments (0)

Feed Details and Statistics Feed Statistics
Preview: SANS Internet Storm Center, InfoCON: green

SANS Internet Storm Center, InfoCON: green



SANS Internet Storm Center - Cooperative Cyber Security Monitor



Published: Tue, 26 Sep 2017 04:04:03 GMT

Last Build Date: Tue, 26 Sep 2017 13:10:06 +0000

Copyright: (C) SANS Institute 2017
 















Forensic use of mount --bind, (Sun, Sep 24th)

Sun, 24 Sep 2017 00:28:01 GMT

In my previous diary, I mentioned a recent case that led me to write mac-robber.py. In that case, I mentioned that I needed to build a filesystem timeline and wanted to collect hashes because I suspected there were multiple copies of some possible malware scattered around the disk. The biggest issue I had was that hashing the files requires reading them which would update the access times, something I really did not want to do. So, I decided to use a trick on a live system that I had employed occasionally in the past when I got a tar file rather than a disk image of, say, a directory from a SAN or NAS. For those of you who aren't aware, on Linux, you can use the mount command to essentially link a directory to another location in the directory tree. In the screenshot below, you can see the results of df -h and mount on one of my test VMs.



What is the State of Your Union? , (Fri, Sep 22nd)

Fri, 22 Sep 2017 23:54:32 GMT

Regularly the President of the United States delivers the State of the Union address. This practice "fulfills rules in Article II, Section 3 of the U.S. Constitution, requiring the President to periodically give Congress information on the "state of the union” and recommend any measures that he believes are necessary and expedient.".