Removing malware from a web site – Case Study
David Dede We deal with web-based malware every day here at Sucuri. Some are encrypted and very hard to detect and remove, but most of them are…
Good bye securityfocus
I just read the sad announcement that SecurityFocus is going to be shut down (or phased out to sound more nice). The mailing lists will…
Cloud-based (FILE) Integrity Monitoring
If you are a system administrator or have ever worked with security, you probably heard the terms file integrity monitoring or file integrity checking. If…
Screenshot of the apache.org defacement (10 years ago)
We recently published a case study of the apache.org defacement that happened 10 years ago. You can read it here: Apache.org defaced – Security archive…
Ecuador Government site hacked and spreading malware
Colombia, Venezuela and now Ecuador. How far are we from reporting the whole South America? 🙂 The web site from the ‘Municipio del Cantón MejÃa’…
Apache.org defaced – Security archive case study
Security Archive: Remembering security incidents to make sure we don’t commit the same mistakes over and over again. Want to read more stories like this…
The Importance of logging for web applications – Security talk
If you think that your logs are only useful when something crashes or when you need to troubleshoot errors on your web application, think again!…
Venezuela Government site hacked and spreading malware
Since we have been noticing that full-disclosure works, we will continue with that. We have detected in our honeypots that since January the site www.miranda.gov.ve…
Honeypot analysis – Full disclosure works
When all else fails, *full disclosure (the process) seems to work. Early in January, we sent a bunch of emails to the people at the…
.ORG whois reporting DNSSEC status
I was glad to see a handful of whois updates today coming from all the .ORGs that we are monitoring at Sucuri. Basically now at…
PHP in the user agent (attacking log analysis tools?)
Lately I started to see a few web-based attacks with a php script inside the user agent. Something like this: a.b.229.82 – – [19/Jan/2010:22:43:39 -0700]…