Jan Kopriva

You may find links to new content I've published on untrustednetwork.net at @UntrustedNet.

@bugfireIO Thank you, @bugfireIO, and I will send you a link to a file with body of the e-mail in a DM...

@jk0pr - loved your recent diary on shy-zwasp phishing (isc.sans.edu/diary/An+unusu…). Is the email sample you referenced here available somewhere?

The strange case of disappearing Russian servers isc.sans.edu/diary/31476

Dnes jsem byl pozván do vysílání odpoledního Studia ČT 24, kde jsem odpovídal na otázky spojené s aktuálními výpadky spojenými s chybnou aktualizací pro senzory CrowdStrike Falcon pro Windows... untrustednetwork.net/cs/2024/07/19/…

Few weeks ago, I came across a somewhat unusual phishing message that used a slight twist on the "reply-chain" theme to make it through e-mail filters. It is not new, but since I didn't find any write-ups of it anywhere, I wrote a short article, which you may find bellow...

Support of SSL 2.0 on web servers in 2024 i5c.us/d31044

It appears that the number of ICS accessible from the internet has risen by 30 thousand over 3 years i5c.us/d30860

It occurred to me that the current situation surrounding the xz-utils backdoor might present a good opportunity for a quick analysis to see if national or governmental CSIRTs/their host organizations/similar entities publish security advisories during holidays...

An open redirect vulnerability exists in what remains of the Google Web Light service, and it is being actively exploited by threat actors in multiple phishing campaigns... #phishing #Google #vulnerable untrustednetwork.net/en/2024/02/26/…

@sans_isc @internetarchive

Phishing pages hosted on archive.org i5c.us/d30676

Threat actors generally like to use legitimate third-party online services to host malicious content, since it makes their job significantly easier. And - unfortunately - even the Internet Archive is no exception in this regard...

Computer viruses are celebrating their 40th birthday (well, 54th, really) i5c.us/d30624

The smallest and largest #malware samples that were "caught" by my e-mail trap in 2023 were a small (<2 kB) VBScript file and a very large (350 MB) EXE... And what might come as a surprise is, that these two samples were pretty much functionally identical. isc.sans.edu/diary/30524

Phishing page with trivial anti-analysis features i5c.us/d30412

I was recently asked whether typos were still a useful indicator for identifying phishing messages. To answer this question, I wrote a short post, which was just published on the Internet Storm Center website...

Co se stalo v září?🤔 Novinkami a událostmi z kyberprostoru vás tradičně provedou @StanleyNovo a @jk0pr. Tentokrát se věnovali novinkám, jako: 👉Ransomware Útok na MGM a Caesars 👉Severokorejští Hackeři a Kyberloupež 👉Čína vs USA 👉Microsoftu Unikly Desítky TB Dat 👉Kybernetické Útoky Jako Mezinárodní Zločiny 👉Británie Odkládá Plány na Scanování Zpráv s E2E Šifrováním 👉OpenSSL 1.1.1 End of Life 👉Doporučení pro Manažery a Architekty KB #ITbezpecnost #CyberSecurity #Novinky #SecurityCast

Last week, I came across an interesting phishing, in which a text with zero font size was used in quite a novel way in order to make the message appear more trustworthy. You may find details in the article linked below...

A new Diary of mine was published today on the SANS Internet Storm Center website. In this one, we’ll take a look at a simple phishing which demonstrates quite well that the cost of committing cybercrime can unfortunately be extremely low…

One doesn't often find malware with 0 detections on VirusTotal, especially if it isn't completely new... Nevertheless, it seems I was “lucky” - a malicious batch file, which was used in a last week's phishing campaign I came across is still at zero… isc.sans.edu/diary/From+sma…

@nmeirmanov Since they don't seem to have their own CSIRT and no security-related contats were published on their site, i reached out to the generic "contact us" telecom@ e-mail ddress (I tried security@ as well, but that message bounced)...

@jk0pr with whom did you contact in Kazakhtelecom?

It can be quite surprising to find out what devices accessible from the internet still support SSLv2. It seems that in Kazakhstan, where such devices are most common, over 166 thousand SSLv2-enabled devices are last-mile network boxes used by the largest national ISP...