I’m Koen . I live in Bruges (Belgium), a splendid medieval city also known as the Venice of the North.

I’m involved with computer security and I work as a freelancer in incident response, incident coordination, threat intelligence, vulnerability management and security best practices. Basically all tasks related to managing a CSIRT / CERT (Computer Emergency Response Team).

My main interests in computers are security, web applications (PHP, MySQL, Apache), system administration and free software.

This site hosts a blog and I have a photo collection at Flickr.

I also have a site with (outdated) Linux information.

Latest posts

Manually deleting Time Machine backups

I use an Apple MacBook as my primary work laptop. One of the nice features that are automatically included in OSX is Time Machine, allowing you to do automatic backups.

You can do the backups to an external disk (via USB) or to a network connected disk. I also have a Synology NAS with a volume (encrypted of course) configured for the backups. I have set a quota for this volume to prevent the backupsRead more.

Analyzing PDF and Office Documents Delivered Via Malspam

I published an article on IBM Security Intelligence on Analyzing PDF and Office Documents Delivered Via Malspam .

The article covers analysing the static properties of malspam and further in depth analysis of malspam via for example the tools from Didier Stevens.

How to Choose the Right Malware Classification Scheme to Improve Incident Response

I published an article on IBM Security Intelligence on How to Choose the Right Malware Classification Scheme to Improve Incident Response.

The article covers malware classification in an ideal world, some of the existing classification schemes and how machine-parsable malware classification can help make incident response processes more fluent.

Doing OSINT and Twitter Analytics with Tinfoleak

Twitter is a great source for conducting open source intelligence. One of my favorite tools is Tweetsniff from Xavier Mertens. It will grab a Twitter user timeline for further processing, for example in Elasticsearch.

Another tool that I recently discovered is Tinfoleak. Tinfoleak is build for Twitter intelligence analysis and provides you with an HTML file output.

I wanted to use Tinfoleak to build profiles of users to tune targeted phishing campaigns (spear phishing) forRead more.

Reducing Dwell Time With Automated Incident Response

I published an article on IBM Security Intelligence on Reducing Dwell Time With Automated Incident Response. The article covers collecting event information, sharing intelligence data and then moving towards automated incident response together with automated digital forensic acquisition (with MIG & GRR).

The incident response orchestration process covers TheHive, MISP, LogicHub and VMRay to extend further on automation.

Drupal SA-CORE-2018-002 aka Drupalgeddon2

The Drupal team released a security advisory for all Drupal sites recommending all these sites to upgrade to the latest Drupal version.

The discovered vulnerability could lead to remote code execution in Drupal 7.x and 8.x.

I have a mindmap on this vulnerability

Further information from Drupal can be found at

Drupal core – Highly critical – Remote Code Execution – SA-CORE-2018-002 The FAQ on SA-CORE-2018-002

According to bojanz this vulnerabilityRead more.

Phishing website using imgur images as background

Another day, another phish. This day it concerns a phishing e-mail for a Belgian bank. The phishing e-mail looked like this The link is only viewable if you enable HTML content in the e-mail client.

The link points to the URL shortening service Bitly and then follows a couple of redirects (including another URL shortening service).

bitly.com, via HTTPS, received 301 Moved Permanently; go2l.ink, via HTTP, received 302 FOUND; A PHP pageRead more.

Understanding calling conventions during malware analysis

When you do analysis of malware in for example x64dbg or IDA Pro it’s important that you understand how functions are called, what arguments are passed to the function and how to recognize the local variables within that function.

Further down in this post are my notes from the SANS FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques course and the The IDA Pro Book.

First some core concepts.

A function is aRead more.