SANS Daily Stormcast

Digital Dispatch Podcast Podcast Artwork Image

Johannes Ullrich

A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter.

Contact Show

Recent Episodes

ISC StormCast for Wednesday, December 7th 2016 December 06, 2016

Attacking NoSQL Applications https://isc.sans.edu/forums/diary/Attacking+NoSQL+applications/21787/ Heap Buffer Overflow in Encase Forensic Imager https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20161128-0_Guidance_Software_Encase_DoS_heap_buffer_overflow_vulnerabilities_v10.txt Raspbian To Increase Default Security https://www.raspberrypi.org/blog/a-security-update-for-raspbian-pixel/ SONY Camera Backdoor https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20161206-0_Sony_IPELA_Engine_IP_Cameras_Backdoors_v10.txt Feedback: https://isc.sans.edu/contact.html

ISC StormCast for Tuesday, December 6th 2016 December 05, 2016

Video Walk Through: Analysing Hancitor Malicious Document https://isc.sans.edu/forums/diary/Hancitor+Maldoc+Videos/21783/ Rapid Distributed Credit Card Number Brute Forcing http://eprint.ncl.ac.uk/file_store/production/230123/19180242-D02E-47AC-BDB3-73C22D6E1FDB.pdf Cloudflare Detecting Large DDoS Attacks Over Thanksgiving / Cyber Monday https://blog.cloudflare.com/the-daily-ddos-ten-days-of-massive-attacks/ Free Windows Tool to Harden Networks: SAMRi10 https://gallery.technet.microsoft.com/SAMRi10-Hardening-Remote-48d94b5b NY State Outlawing Automated Ticket Purchasing Software https://www.nysenate.gov/legislation/bills/2015/S8123

ISC StormCast for Monday, December 5th 2016 December 04, 2016

CSP Bypass with Polyglot Images http://blog.portswigger.net/2016/12/bypassing-csp-using-polyglot-jpegs.html also see this Youtube video on Polyglot Images: https://www.youtube.com/watch?v=Ub5G_t-gUBc Stack Overflow SQL Injection Questions https://laurent22.github.io/so-injections/ Mirai Update: More Outages and Vulnerable Chipset Identified http://www.theregister.co.uk/2016/12/02/broadband_mirai_takedown_analysis/ SEC503 Intrusion Detection in Depth in Brussles (Jan 2017): https://www.sans.org/event/brussels-winter-2017/course/intrusion-detection-in-depth

ISC StormCast for Friday, December 2nd 2016 December 01, 2016

Open Source Tool "Beamgun" Fights Rogue USB Devices on Windows https://github.com/JLospinoso/beamgun "Shamoon" Malware is back with a new destructive attack against Saudi Arabia https://www.bloomberg.com/news/articles/2016-12-01/destructive-hacks-strike-saudi-arabia-posing-challenge-to-trump British ISP "KCOM" Suffering Outage After Attack http://www.hulldailymail.co.uk/kcom-blames-cyber-attack-for-thousands-losing-internet-access-in-hull/story-29944084-detail/story.html#xf23rtZbUqlh5uXY.99 Microsoft Fixes Long Known Priviledge Escalation Issue https://threatpost.com/microsoft-silently-fixes-kernel-bug-that-led-to-chrome-sandbox-bypass/122179/

ISC StormCast for Thursday, December 1st 2016 November 30, 2016

Mozilla Patches Firefox 0-Day (Exploit already avaiable!) https://isc.sans.edu/forums/diary/Unpatched+Vulnerability+in+Firefox+used+to+Attack+Tor+Browser/21769/ SQL Slammer "Resurgance" ? https://isc.sans.edu/forums/diary/Take+Back+Wednesday+SQL+Slammer+still+alive+but+barely+kicking/21767/ Goolian Android Malware http://blog.checkpoint.com/2016/11/30/1-million-google-accounts-breached-gooligan/ Bypassing SAML 2.0 SSO http://research.aurainfosec.io/bypassing-saml20-SSO/ Webcast: The Six Most Dangerous New Cyber Attack Techniques https://cc.readytalk.com/registration/#/?meeting=9yq9nbx4tp7a&campaign=nggmjhc39guc

ISC StormCast for Wednesday, November 30th 2016 November 29, 2016

Mirai/TR-069 Update: Deutsche Telekom Routers May have been DDoSed by Traffic Volume, not Exploit https://comsecuris.com/blog/posts/were_900k_deutsche_telekom_routers_compromised_by_mirai/ Bitlocker Encrypted Drives Exposed During System Upgrade http://blog.win-fu.com/2016/11/every-windows-10-in-place-upgrade-is.html Software-Only Defenses Against Rowhammer https://arxiv.org/abs/1611.08396

ISC StormCast for Tuesday, November 29th 2016 November 28, 2016

Mirai Variant Scanning Port 5555 and 7547 For TR-069/SOAP Vulnerability https://isc.sans.edu/forums/diary/Port+7547+SOAP+Remote+Code+Execution+Attack+Against+DSL+Modems/21759/ Paypal OAuth Vulnerability http://blog.intothesymmetry.com/2016/11/all-your-paypal-tokens-belong-to-me.html

ISC StormCast for Monday, November 28th 2016 November 27, 2016

Extracting Shellcode from Javascript https://isc.sans.edu/forums/diary/Extracting+Shellcode+From+JavaScript/21753/ Using Scapy to Test CozyDuke Snort Signatures https://isc.sans.edu/forums/diary/Scapy+vs+CozyDuke/21755/ Malicious JPEG Spreading via Facebook http://blog.checkpoint.com/2016/11/24/imagegate-check-point-uncovers-new-method-distributing-malware-images/ San Francisco Public Transport ("MUNI") hit by Ransomware http://sanfrancisco.cbslocal.com/2016/11/26/you-hacked-cyber-attackers-crash-muni-computer-system-across-sf/ Tesla Smartphone App Vulnerability https://promon.co/blog/tesla-cars-can-be-stolen-by-hacking-the-app/

ISC StormCast for Wednesday, November 23rd 2016 November 22, 2016

WordPress RCE Via Fake Updates http://www.openwall.com/lists/oss-security/2016/11/21/3 Turning Speakers into Microphones http://cyber.bgu.ac.il/advanced-cyber/system/files/SPEAKEaR.pdf 5 Second Video iOS Crash http://www.cultofmac.com/455215/455215/ "Stubby" Implements Encrypted DNS http://www.theregister.co.uk/2016/11/22/dns_boffins_offer_up_privacy_test/

ISC StormCast for Tuesday, November 22nd 2016 November 21, 2016

Encrypted ZIP File With Comments https://isc.sans.edu/forums/diary/ZIP+With+Comment/21737/ Siemens Surveilance Cameras Use Static Default Password https://ics-cert.us-cert.gov/advisories/ICSA-16-322-01 NTP Single Packet DoS Vulnerablity http://dumpco.re/cve-2016-7434/ Windows 10 Does Not Provide the Same Protections as EMET https://insights.sei.cmu.edu/cert/2016/11/windows-10-cannot-protect-insecure-applications-like-emet-can.html

ISC StormCast for Monday, November 21st 2016 November 20, 2016

Converting Timestamps with Epocalypse https://isc.sans.edu/forums/diary/How+many+Epoch+times+Epocalypsepy+timestamp+converter/21733/ SIP Disabled on Some Macbook Pros http://www.macrumors.com/2016/11/17/system-integrity-protection-disabled-macbook-pro/ Spoofing Microsoft.com E-Mails with Outlook.com https://www.utkusen.com/blog/sending-valid-phishing-emails-from-microsoftcom.html Various High Profile Twitter Accounts Hijacked By Spammers https://www.engadget.com/2016/11/19/spammers-compromised-twitter-accounts-for-playstation-and-other/ Dyn Attack Caused by Single Angry Playstation User http://www.wsj.com/articles/october-internet-attack-targeted-playstation-network-researchers-say-1479250847

ISC StormCast for Friday, November 18th 2016 November 17, 2016

Phishers Protect Phishing Sites from Security Researchers https://isc.sans.edu/forums/diary/Example+of+Getting+Analysts+Researchers+Away/21721/ Fedora / Chrome Automatic Downloads and Code Execution https://scarybeastsecurity.blogspot.de/2016/11/0day-poc-risky-design-decisions-in.html Volutility Version 1.0 Released https://techanarchy.net/2016/11/volutility-version-1-0-release/ iOS Synchronizing Call Logs via iCloud http://www.forbes.com/sites/thomasbrewster/2016/11/17/iphone-call-logs-in-icloud-warns-elcomsoft-hackers/#5d96b21c2936

ISC StormCast for Thursday, November 17th 2016 November 16, 2016

Russian Malspam Distributing Troldesh Ransomware https://isc.sans.edu/forums/diary/Malspam+distributing+Troldesh+ransomware/21717/ Poisontap Exploits USB Ethernet Adapters https://samy.pl/poisontap/ Symantec Patches Untrusted DLL Loading Vulnerability https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20161115_00 VMWare Patches VM Escape Vulnerablity http://www.vmware.com/security/advisories/VMSA-2016-0019.html Some Android Phones Leak Data To China http://www.prnewswire.com/news-releases/kryptowire-discovered-mobile-phone-firmware-that-transmitted-personally-identifiable-information-pii-without-user-consent-or-disclosure-300362844.html Jacksonville ISC2 Meeting https://www.eventbrite.com/e/isc2-ne-florida-chapter-meeting-november-2016-tickets-29050701430

ISC StormCast for Wednesday, November 16th 2016 November 15, 2016

Vulnerability in LUKS Can Be used to Boot Encrypted Linux Systems http://betanews.com/2016/11/15/linux-security-bug-cryptsetup-luks/ Shazam Keeps Microphone Turned on Even While not "Listening" https://objective-see.com/blog/blog_0x13.html nginx Privilege Escalation Vulnerability (Debian Only) http://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html

ISC StormCast for Tuesday, November 15th 2016 November 14, 2016

Indictment for the theft of FIFA Game Coins https://regmedia.co.uk/2016/11/14/fifafraudindictment.pdf Crysis Ransomware Master Encryption Key Released http://www.bleepingcomputer.com/news/security/master-decryption-keys-and-decryptor-for-the-crysis-ransomware-released-/ Adult Friend Finder Breached https://www.leakedsource.com/blog/friendfinder Lightbulb Web Application Firewall Auditing Framework http://seclist.us/lightbulb-is-an-open-source-python-framework-for-auditing-web-applications-firewalls.html

ISC StormCast for Monday, November 14th 2016 November 13, 2016

EMET Will Defeat Shell Code Executing Inside Word https://isc.sans.edu/forums/diary/VBA+Shellcode+and+EMET/21705/ Bitcoin Miners Distributed via FTP Exploits https://isc.sans.edu/forums/diary/Bitcoin+Miner+File+Upload+via+FTP/21707/ 5 Russian Banks Suffer DoS Attack https://www.rt.com/news/366172-russian-banks-ddos-attack/ Wifi May Reveal Mobile Phone Passwords http://dl.acm.org/citation.cfm?id=2978397

ISC StormCast for Friday, November 11th 2016 November 10, 2016

ICMP Unreachable DoS Attacks https://isc.sans.edu/forums/diary/ICMP+Unreachable+DoS+Attacks+aka+Black+Nurse/21699/ OpenSSL 1.1.0 Patch https://www.openssl.org/news/secadv/20161110.txt OWASP ModSecurity Core Rule Set Version 3.0.0 Release https://lists.owasp.org/pipermail/owasp-modsecurity-core-rule-set/2016-November/002265.html

ISC StormCast for Thursday, November 10th 2016 November 09, 2016

DoS Attack Turns off Heat for More then a Week http://www.hs.fi/kotimaa/a1478495966653 (finish only) DLink HNAP Vulnerability https://raw.githubusercontent.com/pedrib/PoC/master/advisories/dlink-hnap-login.txt PoC Exploits Available for Two MSFT Vulnerabilities https://github.com/tinysec/public/tree/master/CVE-2016-7255 https://g-laurent.blogspot.com/2016/11/ms16-137-lsass-remote-memory-corruption.html OpenSSL Patch Pre-Announced https://mta.openssl.org/pipermail/openssl-announce/2016-November/000085.html Hue Lightbulb Exploit/Worm http://iotworm.eyalro.net (Sophos labels this link as "Spam", but appears to be harmless)

ISC StormCast for Wednesday, November 9th 2016 November 08, 2016

Microsoft Patch Tuesday https://isc.sans.edu/forums/diary/November+2016+Microsoft+Patch+Day/21689/ Adobe Updates https://helpx.adobe.com/security/products/connect/apsb16-35.html https://helpx.adobe.com/security/products/flash-player/apsb16-37.html

ISC StormCast for Tuesday, November 8th 2016 November 07, 2016

Tesco Bank Limits Online Banking After Online Criminal Activity https://yourcommunity.tescobank.com/t5/News/Message-for-Current-Account-customers/td-p/6599 Belkin WeMo Devices Used To Attack Mobile Devices https://www.blackhat.com/eu-16/briefings/schedule/index.html#breaking-bhad-abusing-belkin-home-automation-devices-4640 Fake Retail Apps Flooding Apple App Store http://www.nytimes.com/2016/11/07/technology/more-iphone-fake-retail-apps-before-holidays.html?_r=0 Netflix Password Recovery via Phone Call Vulnerability https://slashcrypto.org/2016/11/07/Netflix/ Webcast: 8 Ways To Watch The Invisible: Analyzing Encrypted Network Traffic https://www.sans.org/webcasts/8-ways-watch-invisible-analyzing-encrypted-network-traffic-103277

Older Entries Newer Entries