SANS Daily Stormcast

Digital Dispatch Podcast Podcast Artwork Image

Johannes Ullrich

A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter.

Contact Show

Recent Episodes

ISC StormCast for Monday, May 1st 2017 April 30, 2017

Simple Javascript Word Macro Not Recognized By Many AV Products https://isc.sans.edu/forums/diary/Another+Day+Another+Obfuscation+Technique/22354/ OS X Malware Adds Proxy To Intercept HTTPS http://blog.checkpoint.com/2017/04/27/osx-malware-catching-wants-read-https-traffic/ OVH Vulnerability Put Servers at Risk https://jrwr.io/doku.php?id=blog:ovh_vrack_security_issue

ISC StormCast for Friday, April 28th 2017 April 27, 2017

VISA IP Block Hijacked By Russian ISP https://isc.sans.edu/forums/diary/BGP+Hijacking+The+Internet+is+StillAgain+Broken/22350/ Antminer "Checking" DoS Vulnerability http://www.antbleed.com Symantec Offers Audits To Stave Off Google's CA Blacklisting https://www.symantec.com/connect/blogs/symantec-ca-proposal NoMX Security E-Mail Appliance Pentest https://scotthelme.co.uk/nomx-the-worlds-most-secure-communications-protocol/ vendor response: www.nomx.com SANS Defending Web Applications https://www.sans.org/dev522

ISC StormCast for Thursday, April 27th 2017 April 26, 2017

Bots Disrupts US ISP https://www.bleepingcomputer.com/news/security/us-isp-goes-down-as-two-malware-families-go-to-war-over-its-modems/ Samsung Smart TV Wi-Fi Direct Exploit http://seclists.org/fulldisclosure/2017/Apr/101 Adobe Publishes ColdFusion Update https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html SNMP Misconfiguration Eliminates Community String Validation https://stringbleed.github.io/#

ISC StormCast for Wednesday, April 26th 2017 April 25, 2017

CAA Records and Certificate Issuance https://isc.sans.edu/forums/diary/CAA+Records+and+Certificate+Issuance/22342/ Hyundai Blue Link Infomration Disclosure https://community.rapid7.com/community/infosec/blog/2017/04/25/r7-2017-02-hyundai-blue-link-potential-info-disclosure-fixed HP, Philips, Fujitsu Display Software Privilege Escalation http://blog.sec-consult.com/2017/04/what-unites-hp-philips-and-fujitsu-one.html

ISC StormCast for Tuesday, April 25th 2017 April 24, 2017

Android Malware MilyDoor Builds Backdoor Into Networks Via SSH/SOCKS http://blog.trendmicro.com/trendlabs-security-intelligence/dresscode-android-malware-finds-successor-milkydoor/ Remote Code Execution Flaw in Squirrelmail http://seclists.org/fulldisclosure/2017/Apr/81 Atlassian Confluence Update https://confluence.atlassian.com/doc/confluence-security-advisory-2017-04-19-887071137.html TCP Proxy Over Named Pipes / SMB https://github.com/dxflatline/flatpipes

ISC StormCast for Monday, April 24th 2017 April 23, 2017

Increase in Port 81 Traffic https://isc.sans.edu/forums/diary/WTF+tcp+port+81/22332/ Analyzing a Document and Malware Trying to Exploit CVE-2017-0199 (HTA) https://isc.sans.edu/forums/diary/Malicious+Documents+A+Bit+Of+News/22334/ DOUBLEPULSAR Detected on Tens of Thousands of Systems http://www.theregister.co.uk/2017/04/21/windows_hacked_nsa_shadow_brokers/ NVidia Includes Node.js Server With Drivers http://blog.sec-consult.com/2017/04/application-whitelisting-application.html Android SMSVova Spyware Survives in Google Play Store for 3 Years https://www.zscaler.com/blogs/research/android-spyware-smsvova-posing-system-update-play-store

ISC StormCast for Friday, April 21st 2017 April 20, 2017

Detecting Covert DNS Channels https://isc.sans.edu/forums/diary/DNS+Query+Length+Because+Size+Does+Matter/22326/ Ambient Light Sensors May Become Accessible Via JavaScript https://blog.lukaszolejnik.com/stealing-sensitive-browser-data-with-the-w3c-ambient-light-sensor-api/ BIND Name Server Update https://kb.isc.org/article/AA-01491 Entropy As A Service https://www.getnetrandom.com Webcast: NoSQL Doesn't Make You NoVulnerable https://www.sans.org/webcasts/nosql-doesnt-novulnerable-104897

ISC StormCast for Thursday, April 20th 2017 April 19, 2017

Hunting and Analyzing Malicious Excel Files https://isc.sans.edu/forums/diary/Hunting+for+Malicious+Excel+Sheets/22322/ Bose May Be Spying on Listeners https://www.scribd.com/document/345620278/Bose-Privacy-Complaint Microsoft No-Password Sign In https://blogs.technet.microsoft.com/enterprisemobility/2017/04/18/no-password-phone-sign-in-for-microsoft-accounts/ Owncloud/Nextcloud Bug Reports Include Passwords https://blog.hboeck.de/archives/885-Passwords-in-the-Bug-Reports-OwncloudNextcloud.html Fuzzing Used to Find a Tcpdump Vulnerability https://www.softscheck.com/en/identifying-security-vulnerabilities-with-cloud-fuzzing/ DNS Homograph Detection https://github.com/dutchcoders/homographs For Friday's (and other upcoming webcasts), see https://www.sans.org/webcasts

ISC StormCast for Wednesday, April 19th 2017 April 18, 2017

Details about how to exploit CVE-2017-0199 https://rewtin.blogspot.com.au/2017/04/cve-2017-0199-practical-exploitation-poc.html User Provided Patch To Help Update Old Operating Systems on New CPU https://github.com/zeffy/kb4012218-19 Forensics Tools and Issues With Windows 10 Compact OS https://www.heise.de/security/artikel/Forensik-Tools-patzen-bei-neuer-Windows-Kompression-3676075.html

ISC StormCast for Tuesday, April 18th 2017 April 17, 2017

Detecting IDN Phishing Domains https://isc.sans.edu/forums/diary/Tool+to+Detect+Active+Phishing+Attacks+Using+Unicode+LookAlike+Domains/22310/ Old Linux Kernel Bug Allows for Remote Code Execution via UDP https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=197c949e7798fbf28cfadc69d9ca0c2abbf93191 Microsoft Edge JavaScript "fetch" Function Can Be Used to Leak User Data http://mov.sx/2017/04/16/microsoft-edge-leaks-url.html

ISC StormCast for Monday, April 17th 2017 April 16, 2017

Detecting SMB Cover Channel "Doublepulsar" https://isc.sans.edu/forums/diary/Detecting+SMB+Covert+Channel+Double+Pulsar/22312/ ETERNALBLUE: Windows SMBv1 Exploit https://isc.sans.edu/forums/diary/ETERNALBLUE+Windows+SMBv1+Exploit+Patched/22304/

ISC StormCast for Friday, April 14th 2017 April 13, 2017

Packet Captures Filtered By Process https://isc.sans.edu/forums/diary/Packet+Captures+Filtered+by+Process/22296/ C-LDAP Used to Amplify DDoS Attack https://isc.sans.edu/forums/diary/Akamai+reports+UDP+DDOS+Using+CLDAP+reaching+24Gbps/22300/ Juniper Updates https://kb.juniper.net/InfoCenter/index?page=content&channel=SECURITY_ADVISORIES SAP Patches Code Injection in TREX https://erpscan.com/press-center/press-release/critical-vulnerability-affects-sap-hana-dozen-sap-applications/ More Details About Dallas Siren Hack https://duo.com/blog/the-dallas-county-siren-hack

ISC StormCast for Thursday, April 13th 2017 April 12, 2017

Mole Ransomware Delivered via Fake USPS E-Mails https://isc.sans.edu/forums/diary/Malspam+on+20170411+pushes+yet+another+ransomware+variant/22290/ Identifying HTTPS-Protected Netflix Videos in Real-Time https://www.mjkranch.com/docs/CODASPY17_Kranch_Reed_IdentifyingHTTPSNetflix.pdf SMS Messages Used to Control Oven https://www.pentestpartners.com/blog/iot-Aga-cast-iron-security-flaw/ Android Hardening TLS Use https://android-developers.googleblog.com/2017/04/android-o-to-drop-insecure-tls-version.html

ISC StormCast for Wednesday, April 12th 2017 April 11, 2017

MSFT/Adobe Patch Tuesday https://isc.sans.edu/forums/diary/April+2017+Microsoft+Patch+Tuesday/22288/ Solaris 0-Day https://twitter.com/hackerfantastic/status/851555538597011460 OWASP Top 10 Update https://github.com/OWASP/Top10/raw/master/2017/OWASP%20Top%2010%20-%202017%20RC1-English.pdf

ISC StormCast for Tuesday, April 11th 2017 April 10, 2017

TPLink Modem Responds With Admin Password to SMS http://www.theregister.co.uk/2017/04/10/tplink_3gwifi_modem_spills_credentials_to_an_evil_text_message/ Fake Google Map Weblinks https://www.bleepingcomputer.com/news/google/thousands-of-fake-google-maps-listings-redirect-users-to-fraudulent-sites-each-month/ Apple Fixes Apple Music For Android http://seclists.org/bugtraq/2017/Apr/26 Dalles Sirens Hacked via Wireless Attacks http://www.theregister.co.uk/2017/04/10/hackers_set_off_dallas_emergency_siren_system/ NATO Discovers (finally?) that IPv6 Can be Used As a Covert Channel https://t.co/FvSSwhtUH7

ISC StormCast for Monday, April 10th 2017 April 09, 2017

Domain Whitelisting with Alexa and Umbrella Lists (and update) https://isc.sans.edu/forums/diary/Domain+Whitelisting+With+Alexa+and+Umbrella+Lists/22270/ https://isc.sans.edu/forums/diary/Domain+Whitelisting+With+Alexa+and+Umbrella+Lists+update/22274/ SANS Security West (San Diego) https://www.sans.org/event/sans-security-west-2017 Dallas Tornado Sirens Hacked https://www.washingtonpost.com/news/the-intersect/wp/2017/04/09/someone-hacked-every-tornado-siren-in-dallas-it-was-loud/?utm_term=.ca706deea318 Shadowbroker Files https://github.com/x0rz/EQGRP Word Vulnerability https://securingtomorrow.mcafee.com/mcafee-labs/critical-office-zero-day-attacks-detected-wild/

ISC StormCast for Friday, April 7th 2017 April 06, 2017

Automatically Inferring Malware Signatures for Anti-Virus Assisted Attacks https://www.sec.cs.tu-bs.de/pubs/2017-asiaccs.pdf Cisco Aironet Default Credentials https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-ame Intercepting Two-Factor Authentication https://breakdev.org/evilginx-advanced-phishing-with-two-factor-authentication-bypass/ QNAP NAS Vulnerabilities https://sintonen.fi/advisories/qnap-qts-multiple-rce-vulnerabilities.txt

ISC StormCast for Thursday, April 6th 2017 April 05, 2017

Whitelists: The Holy Grail of Attackers https://isc.sans.edu/forums/diary/Whitelists+The+Holy+Grail+of+Attackers/22262/ Java Struts2 Vulnerability Used To Install Ransomware https://isc.sans.edu/forums/diary/Java+Struts2+Vulnerability+Used+To+Install+Cerber+Crypto+Ransomware/22264/ Brazilian Bank Looses Control Over Domains https://threatpost.com/lessons-from-top-to-bottom-compromise-of-brazilian-bank/124770/ Google Android April Patch Day https://source.android.com/security/bulletin/2017-04-01#security-vulnerability-summary Radware Observes "BrickerBot" Destroying Devices https://security.radware.com/ddos-threats-attacks/brickerbot-pdos-permanent-denial-of-service/ Struts2 Vulnerability Webcast https://www.sans.org/webcasts/struts-shock-current-attacks-struts2-defend-104787

ISC StormCast for Wednesday, April 5th 2017 April 04, 2017

Exploiting Broadcom's Wi-Fi Stack https://googleprojectzero.blogspot.com/2017/04/over-air-exploiting-broadcoms-wi-fi_4.html Covert Channel Between Virtual Machines Via CPU Cache https://cmaurice.fr/pdf/ndss17_maurice.pdf 40 Vulnerabilities in Samsung Tizen https://motherboard.vice.com/en_us/article/samsung-tizen-operating-system-bugs-vulnerabilities

ISC StormCast for Tuesday, April 4th 2017 April 03, 2017

Apple Releases iOS 10.3.1 to Remedy Wifi Remote Code Execution https://support.apple.com/en-us/HT207688 Practical Use of SHA1 Collisions: ISO Images https://isc.sans.edu/forums/diary/A+Practical+Use+for+a+SHA1+Collision/22257/ Microsoft Defender False Positive https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Worm%3AWin32%2FBluber.A Cracking Weak Session Secrets https://martinfowler.com/articles/session-secret.html Skype Malvertising Advertises Fake Flash Players https://www.bleepingcomputer.com/news/security/skype-malvertising-campaign-pushes-fake-flash-player/

Older Entries Newer Entries