SANS Daily Stormcast

Digital Dispatch Podcast Podcast Artwork Image

Johannes Ullrich

A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter.

Contact Show

Recent Episodes

ISC StormCast for Tuesday, May 30th 2017 May 29, 2017

Analysis of Competing Hypotheses https://isc.sans.edu/forums/diary/Analysis+of+Competing+Hypotheses+ACH+part+1/22460/ Microsoft Master File Table BSOD Exploit http://www.theregister.co.uk/2017/05/29/microsoft_master_file_table_bug_exploited_to_bsod_windows_7_81/ SMTP Split Tunnel / Transparent Proxy Exploit https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

ISC StormCast for Friday, May 26th 2017 May 25, 2017

Samba Remote Code Execution Vulnerability https://isc.sans.edu/forums/diary/Critical+Vulnerability+in+Samba+from+350+onwards/22452/ Pacemaker Vulnerabilities http://blog.whitescope.io/2017/05/understanding-pacemaker-systems.html Patching May have Affected Access to Australian Health Systems http://www.cairnspost.com.au/news/cairns-hospital-suffers-software-catastrophe-with-possible-loss-of-patient-data/news-story/c828de3f4a0f73132ec3d19284cbae88

ISC StormCast for Thursday, May 25th 2017 May 24, 2017

Jaff Ransomware Gets a Makeover https://isc.sans.edu/forums/diary/Jaff+ransomware+gets+a+makeover/22446/ OpenVPN Access Server Vulnerability http://seclists.org/oss-sec/2017/q2/332 Large Credential Dumps Used in Password Brute Forcing Attacks http://info.digitalshadows.com/AccountTakeover-WhitePapersPage_Registration.html

ISC StormCast for Wednesday, May 24th 2017 May 23, 2017

Multiple Video Players are Vulnerable to Code Execution via Subtitle Files http://blog.checkpoint.com/2017/05/23/hacked-in-translation/ Samsung Galaxy S8 Iris Scanner Bypass https://www.ccc.de/en/updates/2017/iriden Verizon XSS Flaw in Web Messaging Application https://randywestergren.com/xss-sms-hacking-text-messages-verizon-messages

ISC StormCast for Tuesday, May 23rd 2017 May 22, 2017

Fake "Uber Disputes" Site Lures Victims With Valid TLS Certificate https://isc.sans.edu/forums/diary/Investigating+Sites+After+They+are+Gone+And+a+Case+of+Uber+Phishing+With+SSL/22440/ Let's Encrypt Outage http://letsencrypt.status.io/pages/history/55957a99e800baa4470002da https://community.letsencrypt.org/t/ocsp-and-issuance-outage-2017-05-19/34506 More ImageMagik Flaws https://scarybeastsecurity.blogspot.com/2017/05/bleed-continues-18-byte-file-14k-bounty.html

ISC StormCast for Monday, May 22nd 2017 May 21, 2017

Typosquatting: A recent example and what to do with look alike domains https://isc.sans.edu/forums/diary/Typosquatting+Awareness+and+Hunting/22436/ Netgear Collecting Analytics Data in Recent Update https://kb.netgear.com/000038663/What-router-analytics-data-is-collected-and-how-is-the-data-being-used-by-NETGEAR disable: https://kb.netgear.com/000038661/How-do-I-Enable-Disable-Router-Analytics-Data-Collection WannaCry Updates https://venturebeat.com/2017/05/19/ransomware-wannacry-causes-fewer-tears-than-feared/ LastPass Authenticator Cloud Backup https://blog.lastpass.com/2017/05/announcing-cloud-backup-for-lastpass-authenticator-easier-multifactor-security-for-everyone.html/

ISC StormCast for Friday, May 19th 2017 May 18, 2017

Discovering Relevant CVEs with CVE Bot https://isc.sans.edu/forums/diary/My+Little+CVE+Bot/22432/ Probablility of Vulnerability Re-Discovery https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2928758 Wannakey May Recover WannaCry Keys https://github.com/aguinet/wannakey Finding Bad With Splunk https://www.sans.org/reading-room/whitepapers/critical/finding-bad-splunk-3748

ISC StormCast for Thursday, May 18th 2017 May 18, 2017

Handbreak Proton Malware Used to Steal Sourcecode https://panic.com/blog/stolen-source-code/ NIST Password Guidance Update https://isc.sans.edu/forums/diary/Wait+What+We+dont+have+to+change+passwords+every+90+days/22428/ Exploiting XXE Vulnerabilities in Peoplesoft https://www.ambionics.io/blog/oracle-peoplesoft-xxe-to-rce

ISC StormCast for Wednesday, May 17th 2017 May 16, 2017

Docusign Breach Leads to Increase in Phishing Email https://trust.docusign.com/en-us/personal-safeguards/ HP Updates Audio Drivers (twice) to Remove Keylogger https://support.hp.com/us-en/document/c05519670 Chrome File Download Behaviour Can Lead to SMB Credential Theft http://defensecode.com/news_article.php?id=21

ISC StormCast for Tuesday, May 16th 2017 May 15, 2017

Apple Updates Everything https://support.apple.com/en-us/HT201222 OpenVPN Audit Results https://www.privateinternetaccess.com/blog/2017/05/openvpn-2-4-evaluation-summary-report/ Italian Car Insurance Leaks User Driving Data https://www.andreascarpino.it/posts/how-my-car-insurance-exposed-my-position.html

ISC StormCast for Monday, May 15th 2017 May 14, 2017

WannaCry Malware Links Latest updates see https://isc.sans.edu Webcast: https://www.sans.org/webcasts/special-webcast-wannacry-ransomeware-threat-105160 PowerPoint: https://isc.sans.edu/presentations/WannaCry.ppt

ISC StormCast for Friday, May 12th 2017 May 11, 2017

Conexant Audio Drivers Log Keystrokes; https://www.modzero.ch/modlog/archives/2017/05/11/en_keylogger_in_hewlett-packard_audio_driver/index.html Rig Exploit Kit Used to Send Ramnit Trojan https://isc.sans.edu/forums/diary/Seamless+Campaign+using+Rig+Exploit+Kit+to+send+Ramnit+Trojan/22404/ Encase Forensic Imager Exploit http://blog.sec-consult.com/2017/05/chainsaw-of-custody-manipulating.html

ISC StormCast for Thursday, May 11th 2017 May 11, 2017

How to Review OAUTH Application Permissions for Popular Sites https://isc.sans.edu/forums/diary/OAuth+and+Its+High+Time+for+Some+Personal+SecurityScaping+Today/22400/ Apple Working on Firmware Integrity Check http://apple.stackexchange.com/questions/282028/pop-up-firmware-changes-detected-randomly-appear Panda Mobile Anti Malware Releases Patch for Evilgrade Bug https://www.contextis.com/resources/blog/exploiting-vulnerable-pandas/ ASUS RT Router Vulnerabilities https://wwws.nightwatchcybersecurity.com/2017/05/09/multiple-vulnerabilities-in-asus-routers/ Microsoft Edge SOP Bypass https://www.brokenbrowser.com/sop-bypass-uxss-stealing-credentials-pretty-fast/ Linux Kernel Packet Socket Vulnerability Exploit https://googleprojectzero.blogspot.com/2017/05/exploiting-linux-kernel-via-packet.html

ISC StormCast for Wednesday, May 10th 2017 May 09, 2017

Microsoft Path Tuesday Summary https://isc.sans.edu/forums/diary/Microsoft+Patch+Tuesday+and+Adobe/22396/ Snake For Mac OS X Included in Handbrake https://blog.fox-it.com/2017/05/03/snake-coming-soon-in-mac-os-x-flavour/ Cisco Patches CMP-Telnet Vulnerability https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp WolfSSL Library X.509 Certificate Text Parsing Code Execution Vulnerability http://blog.talosintelligence.com/2017/05/wolfssl-x509-vuln.html

ISC StormCast for Tuesday, May 9th 2017 May 08, 2017

Exploring a P2P Transient Botnet - From Discovery to Enumeration https://isc.sans.edu/forums/diary/Exploring+a+P2P+Transient+Botnet+From+Discovery+to+Enumeration/22392/ Video Conversion Application Handbrake Compromised https://forum.handbrake.fr/viewtopic.php?f=33&t=36364 Emergency Update for Microsoft Malware Protection Engine https://technet.microsoft.com/en-us/library/security/4022344 OS X Keychain OTR Vulnerability https://medium.com/@longtermsec/bypassing-otr-signature-verification-to-steal-icloud-keychain-secrets-9e92ab55b605

ISC StormCast for Monday, May 8th 2017 May 07, 2017

Tenable Discovers Details Regarding Intel AMT Vulnerability http://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability Android Apps Use Ultrasound Beacons To Track Users http://christian.wressnegger.info/content/projects/sidechannels/2017-eurosp.pdf HTTP Headers... the Achilles' Heel of Many Applications https://isc.sans.edu/forums/diary/HTTP+Headers+the+Achilles+heel+of+many+applications/22382/

ISC StormCast for Friday, May 5th 2017 May 04, 2017

Google OAUTH Spam Wrapup https://threatpost.com/1-million-gmail-users-impacted-by-google-docs-phishing-attack/125436/ Artificial Master Fingerprint Set https://wp.nyu.edu/memon/the-master-print/ rpcbind denial of service https://guidovranken.wordpress.com/2017/05/03/rpcbomb-remote-rpcbind-denial-of-service-patches/ Debian Discontinue FTP Support for Downloads https://www.debian.org/News/2017/20170425

ISC StormCast for Thursday, May 4th 2017 May 03, 2017

Google Docs OAUTH Phishing E-Mails https://isc.sans.edu/forums/diary/OAUTH+phishing+against+Google+Docs+beware/22372/ Review Google App Permissions https://myaccount.google.com/u/0/permissions?pli=1 SS7 Exploits Documented in Banking Attacks http://www.sueddeutsche.de/digital/it-sicherheit-schwachstelle-im-mobilfunknetz-kriminelle-hacker-raeumen-konten-leer-1.3486504 http://www.theregister.co.uk/2017/05/03/hackers_fire_up_ss7_flaw/

ISC StormCast for Wednesday, May 3rd 2017 May 02, 2017

Scans Sighted for Ports Used by Intel Remote Management Interface https://isc.sans.edu/port.html?port=16992 https://isc.sans.edu/port.html?port=16993 Outlook Forms Can Run Macros https://sensepost.com/blog/2017/outlook-forms-and-shells/ Jenkins Vulnerability https://jenkins.io/security/advisory/2017-04-26/ Google Android May Patchday https://source.android.com/security/bulletin/2017-05-01 IBM Storwize USB Stick Malware http://www-01.ibm.com/support/docview.wss?uid=ssg1S1010146&myns=s028&mynp=OCSTHGUJ&mynp=OCSTLM5A&mynp=OCSTLM6B&mynp=OCHW206&mync=E&cm_sp=s028-_-OCSTHGUJ-OCSTLM5A-OCSTLM6B-OCHW206-_-E

ISC StormCast for Tuesday, May 2nd 2017 May 01, 2017

Intel AMT, SBT and ISM Escalation of Privilege Vulnerability https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr https://semiaccurate.com/2017/05/01/remote-security-exploit-2008-intel-platforms/ Local Root Exploit in chkrootkit https://lepetithacker.wordpress.com/2017/04/30/local-root-exploit-in-chkrootkit/ Escape Sequence Exploits in Various Linux Terminals http://www.openwall.com/lists/oss-security/2017/05/01/13

Older Entries Newer Entries