SANS ISC Diary
The SANS Internet Storm Center diary is a daily log by security handlers covering malware, vulnerabilities, internet threats, and practical security tips.
What HN says
HN links it for threat reports and uses it as a status source; commenters also mention its Daily Stormcast podcast among security podcasts.
Stats for nerds
205HN people shared it
255linked in comments
3Kstory points
Mar 2026last shared
Top posts on HN
- 1How to Find Hidden Cameras in Your Airbnb4 people · 361 points · first shared 2019 · 313 comments on HN
- 2Log4j 2.15.0 – Previously suggested mitigations may not be enough1 person · 271 points · first shared 2021 · 98 comments on HN
- 3Over 20k servers have their iLO interfaces exposed to the internet2 people · 178 points · first shared 2022 · 71 comments on HN
- 4IPv6 Day Has Started1 person · 176 points · first shared 2011 · 57 comments on HN
- 5Microsoft Certificate used to sign "Flame"1 person · 160 points · first shared 2012 · 47 comments on HN
- 6Ransomware as a Service1 person · 160 points · first shared 2018 · 36 comments on HN
- 7Something is amiss with the Interwebs: BGP is a flapping1 person · 156 points · first shared 2014 · 50 comments on HN
- 8Xz sshd backdoor collecting usernames from logs1 person · 143 points · first shared 2024 · 10 comments on HN
- 9Packet capturing on Windows with netsh1 person · 121 points · first shared 2015 · 27 comments on HN
- 10Multiple banking IP addresses hijacked1 person · 118 points · first shared 2013 · 18 comments on HN
What HN people wrote when they linked it
- eneveuJul 2011
Many developers need to read and understand this. It is far from mainstream knowledge...
The other day, I saw the following post about password hashing in my RSS feed: http://isc.sans.org/diary.html?storyid=11110
- No mention of bcrypt (though the posts mentions key stretching using SHA1)
- "When selecting an algorithm to hash passwords, it is important to select carefully as it is difficult to change the algorithm later. You will have to ask users to change their password if you do as you no longer know what password they picked." --> seriously? you can update the password the next time they log in...
- "You could also add a secret, in addition to the salt. If the secret is not stored in the database, it would not be easily reachable via a SQL injection exploit (yes, you can use them to read files, but it requires sufficient privileges)." --> security through obscurity, nice
- "For the paranoid, you may want to do the hashing on the client side (javascript) . This way, the server never receives the plain text password. We do this here for the ISC website on our login form [2]." --> oh noes...
Note that the blog has ~15k subscribers according to Google Reader...
---------
I also launched a debate on StackOverflow the other day. A self-proclaimed "security expert" (he later edited his post to remove this part) was advising against using bcrypt, arguing that it would facilitate DOS attacks against the login page... He prefers security through obscurity, using a secret…
- mrguyoramaOct 2017
I had three fun ones.
I wanted to learn powershell, and I was interested in the history of worms on the internet, so I made a script to check https://isc.sans.edu/ and send me an email if the status was not green. Turns out, powershell has an all-in-one function to send an SMTP email, which I thought was hilarious. I used windows task scheduler to run it every hour.
Second, I was struggling with my Cable internet connection, and it was incredibly difficult to nail down what was causing my slow speeds. To help with the diagnostics, I wrote a little python script to download the files that Netflix uses for speedtests (check Fast.com) and logged the average of 10 runs to a file. It similarly used task scheduler to run every 10 minutes and as a result I now have a big old dataset of SpeedTests and unix timestamps which I graphed while playing around with Pillow
I wrote a python bot to Read project Gutenburg books to twitter. This was to participate in a contest that involved seeing which "team" could get a hashtag into more tweets. A twitter bot takes about five minutes to make, as I found a brilliant little Python-Twitter library. Unfortunately, my teammates got cold feet and convinced me to de-rate the bot's posting frequency, meaning we barely lost to a group of 60 or so sorority girls doing it the "correct" way. However, as we did it sort of below-radar, the loophole of automating it is still open and valid.
Currently I'm working on automating the process of creating…
- jen_hSep 2011
What in the world must DigiNotar's business plan for the future include? How could anyone trust them again? How is it possible that root-level certs were being issued and they've got no warning systems, no logging to determine what actually happened? And remember, we only really know about it now because someone caught the DigiNotar-issued SSL cert floating out in the wild and put it up on Pastebin! As rhizome noted, it borders criminality (if you think about it, does it even border?). These folks told users "Users of SSL certificates can depending on the browser vendor be confronted with a statement that the certificate is not trusted. This is in 99.9% of the cases incorrect, the certificate can be trusted" & their site is full of old defacement tags (on both of these, see http://isc.sans.org/diary/DigiNotar+breach+-+the+story+so+far/11500 - also worth reading).
The CA system is broked. Everyone's known it for awhile, but man, it's still tough to look straight in the eyes at its brokenness like this.
- News-DogFeb 2022
!WalterGR, as you can see declaring the url with the <url..> protection works.
There is a-work-around which I wrote last-year, but !danG rewrote the 'Submissions' url-parser filter which did work.
See full history; Hacker News > News-Dog 'Submissions' https://news.ycombinator.com/submitted?id=News-Dog
Sorry I have not had more time to look at this, once again, thank for reporting.
I think the following is from the-Mod Daniel;
>You didn't post a bad URL.
"Our software replaces links with canonical URLs now, when there is one,
and unfortunately that site is pointing to what appears to be an incorrect canonical URL:
<link rel="canonical" href="https://isc.sans.edu/forums/diary/28072/" />
I've fixed it on https://news.ycombinator.com/item?id=29350804 now and killed the previous post."
Also, please see here; 'We remove the plus sign and everything after it. Spammers love the + alias.'
https://news.ycombinator.com/item?id=29322301
- eddygJun 2017
I listen to the SANS Internet StormCast ("daily 5-10 minute information security threat updates") every morning:
https://isc.sans.edu/podcast.htmlMany of my other favorites have already been mentioned, but I also listen to:
Twenty Thousand Hertz ("stories behind the world's most
recognizable and interesting sounds")
https://www.20k.organd have started listening to this new NPR podcast:
Wow in the World ("a new way for families to connect, look up and discover the wonders in the world around them. Every episode, hosts Mindy and Guy guide curious kids and their grown-ups away from their screens and on a journey. Through a combination of careful scientific research and fun, we'll go inside our brains, out into space, and deep into the coolest new stories in science and technology")
http://www.npr.org/podcasts/510321/wow-in-the-world - hacdaddySep 2018
Malicious Life https://malicious.life
—-A bit of a history lesson in viruses, malware, and cyber crime. From Morris through CryptoLocker and now Target.
Darknet Diaries https://darknetdiaries.com/
—-Similar vein to ML, this one gets you into either specific events, people, or times.
Risky Business https://risky.biz
—-Weekly current affairs and news show dedicated to CyberSecurity. If this is your field, or next to your field, it’s worth listening to the news episodes at least (the numbered episodes).
ISC StormCast https://isc.sans.edu/podcast.html
—-A quick (5 min) daily cyber security podcast. If Risky.biz tickled your fancy, this one is worth the add too.