Doing open source intelligence with SpiderFoot (part 2)

I did an earlier post on gathering open source intelligence with SpiderFoot. This post is a small update to incorporate the new version of Spiderfoot that was released recently.

A new version of Spiderfoot was recently released, including some extra modules. In my earlier post I described how I adjusted and added some modules. The new release of Spiderfoot contains part of my changes to the XForce module.

My initial change to Spiderfoot included aRead more.

Will Blockchain Technology Replace Traditional Business Models?

I had to brush up my knowledge on the blockchain technology and decided to write a piece about it on the SecurityIntelligence.com website : Will Blockchain Technology Replace Traditional Business Models?

The article contains a short introduction on what the blockchain technology is and how it works. I conclude with some remarks how blockchain technology could remove the middleman (banks, etc.) for financial transactions.

Whitelist e-mails in Gmail (for example MISP notifications)

Recently I noticed that some of the MISP notification e-mails ended up in my spam folder. I use Gmail linked to my personal domain.

You might argue that processing MISP mails, potentially containing restricted information, via Gmail is a problem. The MISP notifications however are GPG-encrypted so this limits a potential problem.

Whitelisting e-mails in Gmail is not limited to MISP only but I cover this use-case as it caused me some annoyances.

The firstRead more.

HTTP 304 and Apache sinkhole

This is a short post, put here as a “reminder to self” on browser caching.

A colleague recently set up an HTTP sinkhole with Apache. The setup redirected all the user requests to one specific resource.

When deploying the sinkhole, the web server logs showed that the first requests where logged with HTTP status code 200 (“OK”). The next requests however were logged with HTTP status code 304 (“Not Modified”).

The HTTP 304 code basicallyRead more.

Using Geolocation Data to Benefit Security

I had a guest post published on Using Geolocation Data to Benefit Security.

This post lists how you can enrich your information with geolocation data.

Stay Up-to-Date on Security News with OPML feeds

In 2015 I did a posting on the Security Intelligence blog on How to Stay Up-to-Date on Security Trends. The post describes how you can streamline the process of following different news and threat information channels, classify them and bring them to good use.

One of the tools that you can use is RSS feeds. I personally use a setup of fever to grab different RSS feeds and then have them delivered in one centralRead more.

Using open source intelligence feeds, OSINT, with MISP

I love MISP, Malware Information Sharing Platform & Threat Sharing. I did three earlier posts on how to use and setup MISP. part 1, part 2 and part 3.

One of the nice new features by MISP is including feeds from different open source intelligence feed providers.

How does it work? Basically the feeds are provided as a JSON feed, you can browse them within MISP, import them individually or subscribe to the feed toRead more.

9 Things To Know When Using The GDPR To Your Advantage

I had a guest post published about 9 Things To Know When Using The GDPR To Your Advantage on the blog of Ipswitch.com.

The post focuses on important things in the GDPR, General Data Protection Regulation, that can have an influence on how you deal with some of your user -personal- data.

DDoS Protection by country based filtering

DDoS prevention is a hot topic. DDoS attacks have become a weapon of choice for malicious actors to conduct cyberattacks. I did a posting on Defending Against Apache Web Server DDoS Attacks and contributed to a DDoS: Proactive and reactive measures document from CERT.be.

One of the mitigation measures that you can apply is doing country based IP filtering. This basically limits access to your network from a limited set of prefixes. I consider thisRead more.

Secure Communication

I recently had a presentation and information session for human right activists on how to secure their group communication and data sharing.

The target audience was non-technical using different operating systems (Windows, Linux and OSX) and using both default laptops and mobile devices (primarily Android based).

I uploaded the presentation to SlideShare.

Secure Communication from Koen Van Impe