Lars Behrens

Doing Incident Response @Foxit CERT. - All of my tweets are mine

[sud0woodo @sud0woodo]

in light of https://t.co/72MDhR4R7F

save yourself some time analyzing and crafting the packets for the right scanning method: https://t.co/bJ4BMTE9dt

[Lars Behrens @larsbehrens]

@Sariel_42 @cyber_razz Nintendo sue incoming

[Lars Behrens @larsbehrens]

@UID_

[Lars Behrens @larsbehrens]

@ChiefOzoekwe @MalwareJake Probably just as accurate as the list of breached orgs by the actor.

[Lars Behrens @larsbehrens]

@_JohnHammond Awesome, congrats man!

[Fox-IT @foxit]

Some of these servers show similarities with known attacker infra, like hosting *.js files. We observed compromised FortiManager devices use cURL to retrieve such files, e.g. dom.js. Another server had a file named https://t.co/DxfZJxlGrO, which is also a valid FortiManager version.

These are not hard links to FortiJump, but we wanted share this before going into the weekend.
#happyhunting #sharingiscaring

[Lars Behrens @larsbehrens]

@crispr56338851 @msftsecresponse

[Fox-IT @foxit]

Our SOC detected suspicious activity from 158.247.199[.]37 directed at FortiManager ports as early as May 2024. #threatintel #fortianalyzer #fortijump

https://t.co/kRBlM8SNID

[sud0woodo @sud0woodo]

wrote a small piece on my problem with encountering hardcoded RSA keys in device firmware https://t.co/WdoUxH2ZZP

[Lars Behrens @larsbehrens]

@JuhoJauhiainen @FitsecLtd Good to know, thanks :) Great job indeed then. Hope @FitsecLtd will create a blog about this in time :)

[Lars Behrens @larsbehrens]

@JuhoJauhiainen @FitsecLtd To clarify, im not saying that its not true. Just dont know Fitsec myself so I was just curious.

[Lars Behrens @larsbehrens]

@JuhoJauhiainen @FitsecLtd Are you familiar with Fitsec? Their X/Insta is looking dubious to say the least. Video related to Akira is also AI generated.

[Lars Behrens @larsbehrens]

@sud0woodo 🔥🔥🔥

[Fox-IT @foxit]

A new year, a new Dissect release! Dissect v3.12 📷
Highlights (1/2):

- FortiOS platform is now supported as a Linux sub-OS
- Improved parsing of complex ACLs in NTFS
- Sparse indirect blocks in ExtFS now work properly
- Windows and Linux PuTTY artefact parsing plugin added

[Fox-IT @foxit]

We created Skrapa, a zero dependency and customizable Python library for scanning Windows and Linux process memory. Harnessing memory attributes, Skrapa elevates your capability to explore patterns in memory. 🔍 https://t.co/giEDUsnA9o

[Fox-IT @foxit]

Dissect Release v.3.10 is available!

- New Unix unified configuration parser
- New volumes for LUKS V2 and DDF
- New OVA files loader
- New etc plugin based on the unified configuration parser
- Dry run and exclude command added to target-query

https://t.co/k2F9oUYwbV

[Lars Behrens @larsbehrens]

@_JohnHammond My 2 year old loves to play around with his fork as well!

[Fox-IT @foxit]

Today we celebrate the 1 year anniversary of open sourcing Dissect, and what a year it has been!

And like it was meant to be: today Dissect inventor @Schamperr will take the stage at @OneConferenceNL together with the Joint Sigint Cyver Unit and talk Dissect.

🦊💙

[Lars Behrens @larsbehrens]

@cyb3rops Checking content-length is a nice indicator. We recently saw this technique with global exploitation of Citrix Netscalers.

[Lars Behrens @larsbehrens]

@UID_ Betalingen verbieden is in mijn optiek ook niet de oplossing. Maar waarom beginnen we niet met een registratieplicht bij ransomwarebetalingen (confidentieel richting de overheid)? Alleen dit zou al veel informatie geven over de ernst van de situatie in Nederland.