Security

Testing Magika

Google recently announced the release of Magika, an “AI-powered file-type identification system”. I tested this on a corpus of nearly 125k files to see how it fared.

David Cannings
Mar 24, 2024 9 min read Computing
Essential skills for working in incident response
CREST interviewed David Cannings (Director, PwC UK) about what he finds most interesting about working in incident response, the main …
David Cannings
Video
rtfsig released
Today I released a new tool named rtfsig. rtfsig is a simple Python utility that helps create signatures for malicious RTF documents. The tool automatically generates YARA rules and makes suggestions for VirusTotal’s vtgrep based off potentially distinctive parts of RTF documents.
David Cannings
Sep 21, 2020 1 min read Computing
New GPG key

I have updated my GPG key, revoking ID 0x35076cbaa663a704 and replacing it with 0x57974c5b48a00d9b (find it on keyservers).

David Cannings
Mar 22, 2019 1 min read General, Computing
Automating IOC extraction from malware

This presentation was given at 44CON 2014. It provides an introduction to automated extraction of useful indicators of compromise …
David Cannings
Project Slides
Understanding ransomware

This whitepaper looks at ransomware and the impact, evolution and defensive strategies that can be employed by organisations.

While the …
David Cannings
PDF Project
Ticketweb followup
Ticketweb (a UK arm of Ticketmaster) have confirmed that someone was able to send emails to subscribers fraudulently. Their initial response was covered on the Naked Security blog. A second email was sent out this evening:
David Cannings
Feb 14, 2012 2 min read Computing
Ticketmaster / Ticketweb hacked?
This afternoon I received an email with the spammy subject Action Required : Update Your PDF Application. I almost ignored it until I noticed that the link inside pointed to a domain owned by Ticketmaster.
David Cannings
Feb 11, 2012 3 min read Computing
Stupid password rules
Today I forgot the password for a site I use only occasionally. This is rare, as I have a number of password schemes that I use to create a password unique to each site.
David Cannings
Nov 24, 2011 1 min read Computing
Reporting a phishing site, is it worth it?
So I thought I was being a good internet citizen when I received the following email a week ago: Dear User; Please update to our new server click here to begin
David Cannings
Jul 3, 2011 1 min read Computing