VirusTotal

They included, as you say, the President and First Lady, senior officials and other government staff and also accompanying journalists as well.

The file was uploaded to VirusTotal during Yi's European trip in June and remained exposed for about five months.

Cheong Wa Dae was unaware during that period.

Now, new passports have already been issued to the President and First Lady, while replacements for others are underway.

It's believed to be a passenger list for E's trip to the Group of Seven summit in Italy and other European destinations in June.

Though the file had been on the VirusTotal website ever since June 2nd, the presidential office had no idea it was there.

Its belated discovery has prompted the top office to launch an urgent review of security procedures as police begin an investigation.

Authorities don't suspect hacking, but are trying to find out how the list was leaked.

They might use a trusted external version of PowerShell to run a get file hash command.

So they generate the SHA-256 fingerprint of any suspicious artifacts they find in memory and bounce it against community databases like VirusTotal to ID the threat.

Right.

Which brings us to the final and perhaps the most critical phase.

And I'm not going to do it for you live on the show because that's just a bad idea.

But a tool that I've used several times over the years is something called VirusTotal.

which is uh i think it's hosted by google um but uh it is it is a tool where you can upload a file and it will run a whole bunch of different antivirus tools against it and it will give you you know this number of them thought that maybe this was dangerous uh you know this is what it did when we unpacked it this is what what it did when we ran it inside a virtual environment all of those things virus total super useful there's a command line version of it vt-cli.

And it is completely open source.

You can clone it and make it.

We're going to get a lot more noise in the signal, I think.

And so I've been trying to stay ahead of that by keeping updates to the different layers of filters and yara categorization and things that i have going on here so the way that actually works in karen is like at the top level of the funnel we're pulling binaries into the network that have signs of ai integration And when we run those searches against something like VirusTotal, we get binaries that match the strings and the patterns that we're interested in, but we don't necessarily know why those binaries matched to a specific rule.

So there's kind of a second pass that uses YARA classification on the exposed metadata to match other patterns that we can define.

And that's where I can combine some things so I can start to squeeze the filter a little bit more to look for not only just which of these have AI integration, but which maybe have, you know, like a PowerShell component or something to them and start to refine that into more of a complete picture of what each binary looks like.

And at that stage, we're also you know, at VirusTotal, we can pull a lot of the telemetry from all the sandbox runs, any AV labels that get slapped on things.

And that often leads to, like, there's this predisposition to make everything look like malware because The antivirus providers, the sandbox, all their labels are like crypto, stealer, persistence tags.

There's not a lot of labels that mean this is benign or don't waste your time on this one.

That's a pain.

So how do I do that, that it works quickly and I can do multiple at the same time? So my favorite tool that I built is open source investigation tool that is connected to multiple open source intelligence MCPs and resources and a bunch of APIs into VirusTotal and SpamHouse and things like that.

And also I entered, I kind of brought into it a lot of the investigative methodology that I know, an investigative methodology that I've learned from other people, like doing a premortem, second guessing decisions.

And essentially what it does now, I say, okay, open a new case.

PHP powers up to 80% of websites on the internet, including sites built on WordPress, Drupal, and Joomla.

VirusTotal now tracks more than 5.1 million PHP hosts exposed online, and roughly 3.8 million of them have at least one port open to attack.

The UK's National Cybersecurity Centre has told organizations to patch PHP servers immediately, or take them offline until they can.

Two critical Linux kernel flaws are now sitting in public view, and there's no fix.