Scott Lynch

OhMyDebn 4.14.0 is out! Sign PDFs with your own signature, OpenCode 2 and its new desktop app, Crush from Charm, a speed and bufferbloat test, and Zorin OS 18 support.

should I add a pew pew map to SO-CRATES?

SO-CRATES 5.1 is out. Last week brought two big issues: php2shell, a pair of PHP flaws that turn a multipart upload into a remote shell, and the eMudhra CA key compromise, where eight intermediate CAs turned out to have recoverable private keys. Would you spot either in a packet capture? php2shell: yes. Emerging Threats Open added rules within days, and the 5.1 image ships them, so SO-CRATES flags the exploit attempts under Network Alerts. eMudhra: no IDS rule existed. Those eight intermediates never issued a real certificate, so any certificate from one of them on the wire is a forgery. SO-CRATES 5.1 adds a high-severity Finding that flags exactly that, on new captures and ones you've already analyzed. Also new: right-click any value to pivot, and tighter stat cards that show more results above the fold. SO-CRATES is free and open source from Security Onion Solutions: one container, works offline, for PCAPs, logs, email and binaries.

Happy to support such a worthy cause!

For those that couldn't make it to the Security Onion Conference or BSidesAugusta over the weekend, here are some announcements you missed: 📢 @chrissanders88 is doing great work with the @RuralTechFund and so Security Onion Solutions is donating $25K this year 📢 SO-CRATES 5.0 is now available and when you analyze a pcap with @Suricata_IDS it is now also analyzed with tshark which supports thousands of additional network protocols 📢 Security Onion 3.4 is coming soon and Pro users will be able to use its new automated alert triage @securityonion Great to see amazing folks like David Bianco, Andrew Case, Tim Crothers, Tim Kosiba, Jason Lynch, Paul Melson, George Sandford, and others! Special thanks to my Security Onion Solutions teammates, @BSidesAugusta organizers and volunteers, and everybody who came out to the conferences!

SO-CRATES 5.0 is out 🧅 SO-CRATES is a free, open source web app for analyzing PCAPs, logs, emails and binaries, all in one container that works offline. New in 5.0: tshark runs alongside @Suricata_IDS and provides additional protocol support, including S7comm, IEC 104, BACnet, OPC UA, Telnet, RADIUS, IPMI, DHCPv6 and tunnels. A new Findings tab ranks what those records show.