Category Archives: IT Pros

Adventures in Fileless Malware, Part V: More DDE and COM Scriplets

in IT Pros • Last Updated: 6/13/2018
Adventures in Fileless Malware, Part V: More DDE and COM Scriplets

In this series of post, we’ve been exploring attack techniques that involve minimal efforts on the part of hackers. With the lazy code-free approach I introduced last time, it’s even possible to slip in a teeny payload into a DDE field within Microsoft Word. And by opening the document attached to a phish mail, the unwary user lets the attacker gain a foothold on her laptop. To bring the story up to date, Microsoft ultimately closed the…

Adventures in Fileless Malware, Part IV: DDE and Word Fields

in IT Pros • Last Updated: 6/13/2018
Adventures in Fileless Malware, Part IV: DDE and Word Fields

For this next post, I was all ready to dive into a more complicated fileless attack scenario involving multiple stages and persistence. Then I came across an incredibly simple code-free attack — no Word or Excel macro required! — that far more effectively proves the underlying premise in this series: it ain’t that hard to get past the perimeter. The first attack I’ll describe is based on a Microsoft Word vulnerability involving the archaic Dynamic…

12 Ways Varonis Helps You Manage Mergers and Acquisitions

in IT Pros • Last Updated: 3/5/2018
12 Ways Varonis Helps You Manage Mergers and Acquisitions

A well-constructed Merger & Acquisition (M&A) playbook reduces the overall time, cost and risk of the upcoming merger and/or acquisition. Gartner advises that organizations who intend to grow through acquisitions involve the CIO and IT teams early in the process by “sharing models with their business executives that raise the right questions and issues to consider.” Further, according to Gartner analysts Cathleen E. Blanton and Lee Weldon, CIOs should “create a reusable IT M&A playbook…

Adventures in Fileless Malware, Part II: Sneaky VBA Scripts

in IT Pros • Last Updated: 6/13/2018
Adventures in Fileless Malware, Part II: Sneaky VBA Scripts

I’m a fan of the Hybrid Analysis site. It’s kind of a malware zoo where you can safely observe dangerous specimens captured in the wild without getting mauled. The HA team runs the malware in safe sandboxes and records systems calls, file created, and internet traffic, displaying the results for each malware sample. So you don’t have to necessarily spend time puzzling over or even, gulp, running the heavily obfuscated code to understand the hackers’…

Five Brain Hacks for Sysadmins and Infosec Pros

in IT Pros • Last Updated: 11/7/2018
Five Brain Hacks for Sysadmins and Infosec Pros

Automation has always been a good friend to IT. It’s helped us get our work done faster on projects that involved lots of tedium but required little technical skills. Automation allows us to focus our time on more rewarding projects that require years of experience and special tech wisdom. You know, like redesigning a Hadoop cluster or taming the company’s cable infrastructure so that it’s a thing of beauty. Of course, if only everything in…

DNSMessenger: 2017’s Most Beloved Remote Access Trojan (RAT)

in IT Pros • Last Updated: 12/17/2017
DNSMessenger: 2017’s Most Beloved Remote Access Trojan (RAT)

I’ve written a lot about Remote Access Trojans (RATs) over the last few years. So I didn’t think there was that much innovation in this classic hacker software utility. RATs, of course, allow hackers to get shell access and issue commands to search for content and then stealthily copy files. However, I somehow missed, DNSMessenger, a new RAT variant that was discovered earlier this year. The malware runs when the victim clicks on a Word doc…

Top Azure Active Directory Tutorials

in IT Pros • Last Updated: 11/17/2017
Top Azure Active Directory Tutorials

Remember a few years ago when security pros and IT admins were afraid to store business files on the cloud? Today, the circumstances are different. I recently spoke with an engineer and he said he’s getting more questions about the cloud than ever before. What’s more, according to Microsoft, 86% of Fortune 500 companies use Microsoft cloud services –  Azure, Office 365, CRM Online etc – all of which sit on Azure AD. And so…

Defining Deviancy With User Behavior Analytics

in IT Pros • Last Updated: 11/27/2017
Defining Deviancy With User Behavior Analytics

For over the last 10 years, security operations centers and analysts have been trading indicators of compromise (IoC), signatures or threshold-based signs of intrusion or attempted intrusion, to try to keep pace with the ever-changing threat environment. It’s been a losing battle. During the same time, attackers have become ever more effective at concealing their activities. A cloaking technique, known as steganography, has rendered traditional signature and threshold-based detective measures practically useless. In response, the…

My Big Fat Data Breach Cost Post, Part III

in IT Pros • Last Updated: 11/6/2017
My Big Fat Data Breach Cost Post, Part III

How much does a data breach cost a company? If you’ve been following this series, you’ll know that there’s a huge gap between Ponemon’s average cost per record numbers and the Verizon DBIR’s (as well other researcher’s). Verizon was intentionally provocative in its $.58 per record claim. However, Verizon’s more practical (and less newsworthy) results were based on using a different model that derived average record costs more in line with Ponemon’s analysis. The larger…

Active Directory: Difference Between Windows and Azure AD

in IT Pros • Last Updated: 8/10/2018
Active Directory: Difference Between Windows and Azure AD

Once upon a time, IT pros believed that the risks of a data breach and compromised credentials were high enough to delay putting data on the cloud. After all, no organization wants to be a trending headline, announcing yet another data breach to the world. But over time with improved security, wider adoption and greater confidence, tech anxiety subsides and running cloud-based applications such as Microsoft’s subscription-based service Office 365 feels like a natural next…

[Transcript] Ofer Shezaf and Keeping Ahead of the Hackers

in IT Pros • Last Updated: 10/3/2017
[Transcript] Ofer Shezaf and Keeping Ahead of the Hackers

Inside Out Security: Today I’m with Ofer Shezaf, who is Varonis’s Cyber Security Director. What does that title mean? Essentially, Ofer’s here to make sure that our products help customers get the best security possible for their systems. Ofer has had a long career in data security and I might add is a graduate of Israel’s amazing Technion University. Welcome, Ofer. Ofer Shezaf: Thank you. IOS: So I’d like to start off by asking you…