Sascha Rommelfangen

IT Security guy, malware analysis, take-down master, part-time dev, martial arts student, music lover.

[Sascha Rommelfangen @rommelfs]

@AWSSupport @awscloud Since there is no progress dear @AWSSupport, here a little bit of support for your team from me. You are being fooled around by the attackers - sorry - your customers. See the difference? Want me to explain what's happening? Sure, here we are: google geofencing. Thank me later.

[Sascha Rommelfangen @rommelfs]

@AWSSupport @awscloud More here: ccss-lu[.]eu

We're sick of reporting the same stuff over and over again. By now, this is incomparable to any other hosting provider in the world.

[Sascha Rommelfangen @rommelfs]

@AWSSupport Dear @AWSSupport. Your wishful thinking is laudable, but you have frequently proven the opposite. Reports were sent to [email protected].
Now walk the walk. And fix this permanently. You have some responsibility!

[CIRCL - @[email protected] @circl_lu]

TR-567d30 - CIRCL Unveils Festive Nostalgic Initiatives - Gopher Protocol and Bulletin Board System Revival

Enjoy your holidays!

https://t.co/kwVLYRPb0B

#infosec #bbs #retrocomputing #retro

[CIRCL - @[email protected] @circl_lu]

Despite multiple unsuccessful attempts to shut down the phishing infrastructure on @awscloud, we urgently advise blocking the IP 54.211.144[.]11, a hub for numerous phishing attacks against Luxembourgian services. See attached passive DNS screenshot.

#luxembourg #phishing

[Sascha Rommelfangen @rommelfs]

@AWSSupport @circl_lu @awscloud I am doubting the seriousness of such replies. Why is this work externalized to unpaid individuals or organizations instead of working on such a systematic problem responsibly as soon as you are aware of it?

[MISP (@[email protected]) @MISPProject]

Do you want to integrate fail2ban intelligence into MISP?

Here is a simple way to do it with fail2ban, curl and a MISP instance as described by @rommelfs

https://t.co/QM0sRWMCcz

#ThreatIntelligence #fail2ban #infosec #misp #CTI

[CIRCL - @[email protected] @circl_lu]

Everything is ready - Cyber and Threat Intelligence Summit (CTIS-2022) October 19 - 20 2022 -
https://t.co/GyZ45jlEVS

Thanks to our sponsors @ThreatQuotient @DeloitteLU @MISPProject

Still some seats available if you want to join us. #ThreatIntelligence

@LuxSecurityWeek

[Alexandre Dulaunoy @[email protected] @adulau]

I see a regular comment when you release a new open source software.

"I did the same, it's not difficult to do."

Then you ask where the open source release is.

"Oh, it's not open sourced..."

I'm wondering about the psychological approach behind such feedback.

[CIRCL - @[email protected] @circl_lu]

We release a new public service to find potential typo-squatted domains.

https://t.co/WLopIGLEjT relying on our open source @ail_project typo-squatting library. You can select among algorithms, find the existing domains and download the results.

#infosec #threatintel

[Alexandre Dulaunoy @[email protected] @adulau]

A community is just a cartel without money.

[CIRCL - @[email protected] @circl_lu]

Cyber and Threat Intelligence Summit (CTIS-2022)
Kirchberg, Luxembourg - October 19 - 20 2022

Agenda Day 1 https://t.co/9HPIUsvFHW
Agenda Day 2 https://t.co/yowxkNnGDS
Speakers: https://t.co/WsGM0T1MOX

Don't forget to register.

Organized with @MISPProject
@LuxSecurityWeek

[CIRCL - @[email protected] @circl_lu]

CIRCL TR-70 - Vulnerabilities in Microsoft Exchange CVE-2022-41040 - CVE-2022-41082

https://t.co/iyMeuOz503

Page will be updated regularly. #infosec

https://t.co/8k01FyhreL

[CIRCL - @[email protected] @circl_lu]

Often organisation ask us about the most common entry point for a security incident, open and unpatched public services are the most common during the past month. The ATT&CK statistics below is one month from one of our @MISPProject community. #infosec

[MISP (@[email protected]) @MISPProject]

Reminder - MISP Training - Threat Intelligence Introduction for Analysts and Security Professionals and upcoming MISP trainings are from 14:00 until 17:00 CEST. #ThreatIntelligence

https://t.co/7LU3XJGGU1

[Alexandre Dulaunoy @[email protected] @adulau]

This year we don't do @hack_lu but we do a #CTI conference Cyber and Threat Intelligence Summit 2022 (CTIS) (October 19 - 20 2022)) - There is a call for paper or presentation open (9 days left). So you know what to do ;-)

https://t.co/rk99j4a77M

[MISP (@[email protected]) @MISPProject]

MISP projects next events participation and online public trainings updated. Feel free to join us!

https://t.co/7LU3XJGGU1

[Sascha Rommelfangen @rommelfs]

@eromang @adulau @BiologistDan [X] I would like to learn more.