Ransomware: Hacienda of Puerto Rico
We are publishing a redacted case study related to the ransomware event that occurred at Hacienda of Puerto Rico. Although some elements have been removed from this case study, and a previous redacted case study [...]
CompSec Direct wins firmware analysis prototype event held at Dreamport
After placing 5th on a previous challenge, we were happy to place 1st on a subsequent firmware challenge. We improved our process, provided analysis and emulation findings to set us apart from the rest. Please [...]
Kleared4 closed-operation fly-away edge kit
We have started integrating closed-operation fly-away edge appliances with Kleared4, our disassociated cyber-operations, and proofing environment. #PCOE #PCTE #CyberRange Unlike other fly-away kits, this one is designed to operate completely closed! This model uses a [...]
Non-attribution classification model published
The proposed model was published on the Military Cyber Professional Association (MCPA) 2020-2021 magazine. Although the author used humor in this publication; no standardized model currently exists to technically vet and verify how non-attribution is [...]
BSides PR 2019 Wrap-Up: It starts with you
Our President, @jfersec, had the privilege of Keynote during BSides PR 2019. During our presentation, we discussed some hard truth's around: the way DeepFakes and "WeakFakes" are utilizedhow we are good imitators and bad innovators [...]
CTF-Pasteables
"Typing Kills", so even if you do not agree with this; it's true. Operator error grows the more you type. It's akin to "measure twice, cut once". In Capture the Flags (CTF's), we often redo [...]
Open-Data wants to be free, but no one looks.
Problem: A few months ago, Giancarlo Gonzales, a former CIO for the island of Puerto Rico, indicated the lack of updates towards open-data in data.pr.gov. As part of an open-data initiative, Puerto Rico created its [...]
Case 1
Case 1. If you like the case study, hit us up and let us know. Take care. Malware Analysis on Hybrid-Analysis. case1Download
CompSec Direct now approved Cyber-security vendor in Maryland
CompSec Direct has been approved as a Qualified Maryland Cybersecurity Seller (QMCS) by the Department of Commerce of Maryland. This allows us to provide cybersecurity services to qualifying companies under the Buy Maryland Cybersecurity (BMC) [...]
White pages are back!: Aeronet Wireless exposes customer info over SNMP
Problem CompSec Direct recently became aware of an information disclosure problem affecting Aeronet Wireless customers in Puerto Rico. In short, querying Shodan.io for Aeronet Wireless and SNMP presents publicly accessible information, such as customer names, [...]
Data Mining PDF documents; using data conversion to reduce analysis time
Problem A month ago, we became aware of a way to harvest legal notifications from a government web-site. Link Here The web-server allows simple requests to be crafted in order to download PDF documents related [...]
Apache brute: A simple brute force deterrent for Linux
We published a simple script to help identify and block possible brute-force attempts on a Linux web-server. The script counts the amount of "bad-actions" an ip has logged in the Apache logs and blocks the [...]
Judicial branch of Puerto Rico exposes sensitive court documents
Problem CompSec Direct recently became aware of an information disclosure problem with the https://unired.ramajudicial.pr/lawyernotificationauthentication/ application used by the judicial branch of the Puerto Rico government. The application uses a weak sequential ID string that is [...]
CompSec Direct’s president presents ZigBee research at local security conference at Inner Harbor
Our President, Jose Fernandez, presented ZigBee research at Bsides Charm 2017 in Baltimore on April 29, 2017. The presentation, called Frony Fronius: Exploring ZigBee signals from SolarCity covered IoT (Internet of Threats) findings on commercial [...]
CompSec Direct receives media mentions as the result from incident response services offered to Hacienda of Puerto Rico
The Center of Investigative News (Centro de Periodismo Investigativo) published an excellent summary of events from the situation the department of Hacienda faced in early March of 2017. Our early involvement in this event helped [...]
CompSec Direct solicited for subject matter expertise on Incident Response for Hacienda of Puerto Rico
CompSec Direct was asked to provide incident response services to the department of Hacienda, the Treasury department of Puerto Rico, on March 7,2017. The department of Hacienda was experiencing daily losses of approximately $20 million [...]
CompSec Direct is awarded CATS+ Master Contract in Maryland
CompSec Direct was awarded a Master contract with the state of Maryland on February, 2017. The CATS+ Master Contract lists provides the state with a list of known vendors in applicable functional areas. We solicited [...]
NTT Group Global Threat Intelligence Report 2016
GTIR 2016 NTT Group published a great threat report for 2016. Quality publication and definitely worth while. Good for CISO's and Info Sec pros alike. Although some of the areas in the Key Findings are [...]
CompSec Direct’s president presents Shodan research at local security conference in Puerto Rico
CompSec Direct president, Jose Fernandez, presented an open-source intelligence gathering tool called Shodan-Runner at the Bsides PR security conference hosted on Oct 6,2016 in Puerto Rico. The tool allows users to use external CSV files [...]
CompSec Direct hosts remote incident response training for local Puerto Rico students and experts
We hosted a training session on remote incident response operation on Oct 7, 2016. The course was provided "pro-bono" through @Obsidis_NGO, participants paid a small registration fee that covered lunch. Students were able to analyze [...]
Forcepoint 2015 Threat Report
An excellent publication from Forcepoint that covers CnC malware, malicious insiders and attribution. Unlike other threat reports, this report covers multiple human factors that are often neglected in technical reports. In some cases, human error [...]
Why going after wp-config is a quick way to get banned
Internet sites with Wordpress are normally exploited with ease in two ways: 1. Vulnerable plugins or a vulnerability in Wordpress. 2. Reading backup's of the wp-config.php file. The first is actually more common place. The [...]
Security firm sued for filing “woefully inadequate” forensics report -Arstechnica
Arstechnica's Dan Goodin has reported that Trustwave is being sued by Affinity Gaming for not eliminating malware presence after a forensic investigation had been done. Mandiant uncovered the malware during a follow up PCI forensic [...]
Wassenaar Arrangement 2013 Plenary Agreements Implementation; Intrusion and Surveillance Items
CompSec Direct and other individuals and companies spoke out against the 2013 Wassenaar Arrangement. We hope our petitions for further revisions are heard. We have included a copy of the document submitted to http://www.regulations.gov/#!docketDetail;D=BIS-2015-0011 Wassenaar [...]
Stepson of Stuxnet stalked Kaspersky for months, tapped Iran nuke talks – ArsTechnica
Excellent report by Kaspersky that unmasks a breach inside their corporate infrastructure. Stepson of Stuxnet stalked Kaspersky for months, tapped Iran nuke talks
Bsides PR 2015 – Fun with Tor : How anonymity services complicate actor attribution CompSec Direct
Hello from Puerto Rico. Here are our slides from Jose Fernandez's talk on Tor and attribution. We are very exited to have participated in BSides PR 2015, and look forward to speaking again in the [...]