Sponsored by..

Friday 4 May 2018

"Best porno ever" Necurs spam

This spam (apparently from the Necurs botnet) promises much, but seems not to deliver.

From:    Susanne@victimdomain.tld [Susanne@victimdomain.tld]
Date:    4 May 2018, 10:22
Subject:    Best porno ever

Hi [redacted],

Best gay,teen,animal porno ever
Please click the following link to activate your account.

hxxp:||46.161.40.145:3314

Regards,
Susanne
The sender's name varies, but is always in the same domain as the victim.

I only saw four different links in the body text:
Warning live links - do not click
http://46.161.40.145:3314/
http://37.1.211.221:1699/
http://31.207.47.125/3FgtbvCf
http://77.72.84.115/

None of these sites were working when I tested them. Hosting IPs are:

46.161.40.145 (Ankas Ltd, Moldova)
37.1.211.221 (3NT Solutions, UK)
31.207.47.125 (Hostkey, Netherlands)
77.72.84.115 (Netup, UK)

3NT Solutions are a well-known purveyor of badness and I recommend blocking everthing, What the payload is here is unclear, but you can guarantee that's it's nothing good. And probably not smut either.


Sunday 1 April 2018

New Traffic Light Protocol (TLP) levels for 2018

The Traffic Light Protocol should be familiar to anyone working with sensitive data, with levels RED, AMBER, GREEN and WHITE being used to specify how far information can be shared. In recent years it has become clear that these four levels are not enough, so the United Nations International Committee on Responsible Naming (UN/ICoRN) has introduced nine new TLP levels for implementation from the first day of April 2018.

It seems to me that these new levels do offer a much more nuanced approach to sensitive data and are in alignment with real-world needs. What do you think?


TLP Level
Description
RED
Information cannot be disclosed to anyone other than the current participants.
AMBER
Information can be disclosed within participant’s organisations where appropriate.
GREEN
Information can be shared within the community but not published.
WHITE
Information can be published subject to copyright.
BLACK
Information can be retained by participants until the end of the meeting when their minds will be wiped with a Neuralyzer.
BROWN
Knowledge of this information may cause recipients to soil themselves.
PINK
Information is intended to be TLP:RED but someone will inevitably treat it as TLP:WHITE.
BLUE
Knowledge of this information entitles recipients to a free ride in a police car.
BEIGE
Information is so unmemorable that participants will not be able to recall it even if they try (cf. TLP:BLACK)
TARTAN
Information is a complex mix of different TLP levels that cannot be easily separated.
YELLOW
Knowledge of this information may cause recipients to wet themselves. (cf. TLP:BROWN)
GREY
It is not known if participants should have knowledge of this information or not.
RAINBOW
Information pertains to the existence of unicorns.