Hello, welcome to the Monday, August 28th, 2017 edition of the Science and its Storm Center's

Stormcast. My name is Johannes Ulrich and the day I'm recording from Jacksonville, Florida.

We recently received some matter samples that were compressed using 7-zip instead of the more common regular SIP or RAR.

Now DDA has a walkthrough about how to do some preliminary static analysis of these samples.

In this particular case, the SIP file contains a visual basic script that will then download additional malware.

The idea shows how to extract and the off-usegate the URLs, the actual malware is then downloaded from.

So if you run into one piece of malware like this, follow his guide and you pretty much have most of your indicators of compromise here

to find and block additional factions. And researchers at the University of California, Berkeley,

and from Princeton University took a closer look at the Internet censorship in different countries. Now, internet censorship

takes many forms. In recent years, we have seen countries disconnecting themselves from the internet

in order to prevent protesters, for example, from coordinating via social media sites. And of course, there is the well-known

big Chinese firewall that is blocking connections to a number of sites. Now, the Chinese firewall,

at least in part, is implemented using DNS. And these researchers looked in particularly at DNS manipulations.

They looked less at like outright blocking for example of VPNs, but just whether or not

DNS responses in various countries were tampered with.

They did this globally, not just in particular countries,

and they essentially first did a scan for recursive resolvers in these countries and then used

them in order to resolve various host names. The research shows that Iran followed closely by China use DNS manipulation

the most. Now these two countries are not alone. Overall they found that online gambling and

porn sites were the number one targets, not so much tour and sites like this.

In some cases, this may be also the effect of individual ISPs taking measures to block controversial content.

Now, when conducting research like this, one has to be careful to interpret the results, Just the fact that a different IP address is returned

...