SANS Daily Stormcast

Digital Dispatch Podcast Podcast Artwork Image

Johannes Ullrich

A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter.

Contact Show

Recent Episodes

ISC StormCast for Wednesday, June 15th 2016 June 14, 2016

Microsoft Updates https://isc.sans.edu/mspatchdays.html?viewday=2016-06-14 Adobe Updates (Incl. active exploitation of Flash Vuln.) https://helpx.adobe.com/security.html

ISC StormCast for Tuesday, June 14th 2016 June 13, 2016

Flocker Ransomware Locks TVs http://blog.trendmicro.com/trendlabs-security-intelligence/flocker-ransomware-crosses-smart-tv/ Samsung Updates Software Update Software http://seclists.org/fulldisclosure/2016/Jun/21 Lets Encrypt Messes Up Notification E-mail, Leaks Addresses https://community.letsencrypt.org/t/email-address-disclosures-preliminary-report-june-11-2016/16867 ClamAV Fuzzing Finds Bugs in 7z Unpacking Code https://foxglovesecurity.com/2016/06/13/finding-pearls-fuzzing-clamav/

ISC StormCast for Monday, June 13th 2016 June 12, 2016

DNS Sinkhole 2.0 Released https://isc.sans.edu/forums/diary/DNS+Sinkhole+ISO+Version+20/21153/ Visual C Telemetry Library https://www.reddit.com/r/cpp/comments/4ibauu/visual_studio_adding_telemetry_function_calls_to/ Crysis Ransomware http://www.eset.com/us/resources/detail/new-ransomware-threat-crysis-lays-claim-to-teslacrypt-s-former-turf/ Intel Releases ROP Attack Protection http://blogs.intel.com/evangelists/2016/06/09/intel-release-new-technology-specifications-protect-rop-attacks/ EMC Fixes Data Domain Session ID Disclosure Vulnerability https://auscert.org.au/render.html?it=35618

ISC StormCast for Friday, June 10th 2016 June 09, 2016

Google Chrome PDF Viewer Remote Code Execution Vulnerability Patched http://blog.talosintel.com/2016/06/pdfium.html Google Continues to Remove SSLv3 Support http://googleappsupdates.blogspot.com.au/2016/06/gradually-disabling-support-for-sslv3.html Vibration Sensor Can Be Used As Microphone http://synrg.csl.illinois.edu/vibraphone/paperdocs/VibraPhone_nirupam.pdf Keypass Fixes Vulnerable Update Procedure http://keepass.info/help/kb/sec_issues.html#updsig

ISC StormCast for Thursday, June 9th 2016 June 08, 2016

CryptXXX Switches From Angler to Neutrino EK https://isc.sans.edu/forums/diary/Neutrino+EK+and+CryptXXX/21141/ Android Flah Keyboard Uses Excessive Permissions https://regmedia.co.uk/2016/06/07/pentestflashkeybpardpaper.pdf Firefox 47 Released https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox47 D-Link Camera Vulnerable To Remote Exploit http://blog.senr.io/blog/home-secure-home BITS used to make malware more persistent https://www.secureworks.com/blog/malware-lingers-with-bits

ISC StormCast for Wednesday, June 8th 2016 June 07, 2016

Various Internet Sites Flag Password Reuse http://krebsonsecurity.com/2016/06/password-re-user-get-to-get-busy/ Facebook Chat Vulnerability Patched https://www.helpnetsecurity.com/2016/06/07/facebook-vulnerability-chat-messenger/ DNS Cookies: Making DNS More Security https://www.rfc-editor.org/rfc/rfc7873.txt

ISC StormCast for Tuesday, June 7th 2016 June 06, 2016

LinkedIn Data Used to Personalize Malicious E-Mail https://twitter.com/certbund/status/739824856011804676?ref_src=twsrc%5Etfw Android Patches https://source.android.com/security/bulletin/2016-06-01.html Mitsubishi Outlander Wifi Hack https://www.pentestpartners.com/blog/hacking-the-mitsubishi-outlander-phev-hybrid-suv/ Using NTP to Calibrate Time Stamps in PCAP https://isc.sans.edu/forums/diary/What+Time+Is+It+Using+NTP+Traffic+to+Calibrate+PCAP+Timestamps/21135/ BING Adds Malware Warning https://blogs.bing.com/webmaster/June-2016/Warning!-Bing-now-offers-enhanced-malware-warnings

ISC StormCast for Monday, June 6th 2016 June 05, 2016

A Recent MySQL Honeypot Compromise https://isc.sans.edu/forums/diary/MySQL+is+YourSQL/21117/ Team Viewer Improves Security http://www.teamviewer.com/en/company/press/teamviewer-launches-trusted-devices-and-data-integrity/ Black Shades Ransomware http://www.bleepingcomputer.com/news/security/black-shades-ransomware-encrypts-your-pc-and-taunts-security-researchers/ NTP Update http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities

ISC StormCast for Friday, June 3rd 2016 June 02, 2016

Docker Containers Logging https://isc.sans.edu/forums/diary/Docker+Containers+Logging/21121/ Lenovo Suggests Uninstalling Accelerator Application https://support.lenovo.com/us/en/product_security/len_6718 Google Chrome Update http://googlechromereleases.blogspot.com/search/label/Stable%20updates MongoDB Injection http://blog.securelayer7.net/mongodb-security-injection-attacks-with-php/ Ouch! Newsletter https://securingthehuman.sans.org/resources/newsletters/ouch/2016#encryption Detecting DNS Tunneling With Splunk https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022 Android AV Vulnerabilities https://www.sit.fraunhofer.de/fileadmin/dokumente/Presse/teamsik_advisories_AV.pdf?_=1464692835

ISC StormCast for Thursday, June 2nd 2016 June 01, 2016

KeePass Insecure Update https://bogner.sh/2016/03/mitm-attack-against-keepass-2s-update-check/ Possible TeamViewer Breach http://www.theregister.co.uk/2016/06/01/teamviewer_mass_breach_report/ Windows 10 Exploit Offered For Sale https://www.trustwave.com/Resources/SpiderLabs-Blog/Zero-Day-Auction-for-the-Masses/?page=1&year=0&month=0 Intrusion Detection in Depth Minneapolis (July 18-23rd) https://www.sans.org/event/minneapolis-2016/course/intrusion-detection-in-depth

ISC StormCast for Wednesday, June 1st 2016 May 31, 2016

Increase in Telnet Scans https://isc.sans.edu/forums/diary/Increase+in+Port+23+telnet+scanning/21115/ Bloatware Introducing Security Flaws in Laptops https://duo.com/blog/out-of-box-exploitation-a-security-analysis-of-oem-updaters Exploit Released for Unpatchable SCADA Controller https://www.exploit-db.com/exploits/37154/ Fail2Ban Adding IPv6 Support https://www.slightfuture.com/security/fail2ban-ipv6 Critical LG Phone Security Flaws http://blog.checkpoint.com/2016/05/29/oems-have-flaws-too-exposing-two-new-lg-vulnerabilities/

ISC StormCast for Tuesday, May 31st 2016 May 30, 2016

Hardcoded Password in Medical Software https://www.kb.cert.org/vuls/id/482135 Google Chorme Update http://googlechromereleases.blogspot.com.au/search/label/Stable%20updates PA DSS Update https://www.pcisecuritystandards.org/document_library JetPack WordPress Plugin XSS vulnerabilties https://jetpack.com/2016/05/27/jetpack-4-0-3-critical-security-update/ Tor Browser Fingerprinting Site https://tor.triop.se Anti-Pastejacking Browser Plugin https://github.com/rocketshipapps/hardenedpaste

ISC StormCast for Monday, May 30th 2016 May 29, 2016

Analysis of a Distributed Denial of Service Attack https://isc.sans.edu/forums/diary/Analysis+of+a+Distributed+Denial+of+Service+DDoS/21109/ Bluecoat CA http://www.theregister.co.uk/2016/05/27/blue_coat_ca_certs/ Google Requires Symantec CAs to Comply With Certificate Transparency https://cabforum.org/pipermail/public/2016-May/007573.html

ISC StormCast for Friday, May 27th 2016 May 26, 2016

Keeping an Eye on Tor Traffic https://isc.sans.edu/forums/diary/Keeping+an+Eye+on+Tor+Traffic/21103/ Next Generation Tor Passed First Test https://blog.torproject.org/blog/mission-montreal-building-next-generation-onion-services DDoS Prives Drop https://www.incapsula.com/blog/unmasking-ddos-for-hire-fiverr.html Older Microsoft Office Vulnerabilities Still Used by "APT" Actors https://securelist.com/analysis/publications/74828/cve-2015-2545-overview-of-current-threats/

ISC StormCast for Thursday, May 26th 2016 May 25, 2016

DNS Covert Channel Used in Targeted Attacks http://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/ Genius Web Annotation Serivce Is Removing Security Headers http://www.theverge.com/2016/5/25/11505454/news-genius-annotate-the-web-content-security-policy-vulnerability Canary Tokens For Windows Binaries http://blog.thinkst.com/2016/05/certified-canarytokens-alerts-from_25.html Cisco Patches IPv6 ND DoS Vulnerability https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160525-ipv6

ISC StormCast for Wednesday, May 25th 2016 May 24, 2016

Verisign/US-Cert Warn of The Use of Local TLDs for WPAD http://www.verisign.com/assets/labs/MitM-Attack-by-Name-Collision-Cause-Analysis-and-WPAD-Vulnerability-Assessment-in-the-New-gTLD-Era.pdf Proposal To Use TLS for DNS https://www.rfc-editor.org/rfc/rfc7858.txt Azure Blacklists Common Password https://blogs.technet.microsoft.com/ad/2016/05/24/another-117m-leaked-usernames-and-passwords-new-best-practices-azuread-and-msa-can-help/ Google Attempts to Eliminate Passwords http://www.androidauthority.com/google-kills-passwords-trust-api-694394/

ISC StormCast for Tuesday, May 24th 2016 May 23, 2016

Detailed Technical Report Released About Targeted Attack Against RUAG https://isc.sans.edu/forums/diary/Technical+Report+about+the+RUAG+attack/21091/ New Variation of PastJacking Exploit Affecting vim https://github.com/dxa4481/Pastejacking Xen qemu Patch Released to Limit Log File Size http://xenbits.xen.org/xsa/advisory-180.html

ISC StormCast for Monday, May 23rd 2016 May 22, 2016

Missing MRU Registry Keys For Files Opened With Winzip https://isc.sans.edu/forums/diary/The+strange+case+of+WinZip+MRU+Registry+key/21087/ OWASP Asking for Top 10 Overhaul Input https://twitter.com/wichers/status/733855223832272896 Google is Updating the Safe Browsing API https://security.googleblog.com/2016/05/evolving-safe-browsing-api.html Facebook Sued Over Scanning Of Private Messages https://cdn2.vox-cdn.com/uploads/chorus_asset/file/6509911/campbell-certification-order.0.pdf Malware Stores Code in Macro UI Buttons https://blogs.technet.microsoft.com/mmpc/2016/05/17/malicious-macro-using-a-sneaky-new-trick/ SANSFIRE 2016 https://www.sans.org/event/sansfire-2016

ISC StormCast for Friday, May 20th 2016 May 19, 2016

EITest Campaign Still Going Strong https://isc.sans.edu/forums/diary/EITest+campaign+still+going+strong/21081/ Android Malware Affecting Google Pay Acceptance http://www.theregister.co.uk/2016/05/19/android_pay_analysis/ OS 9.3 Restricts Use Of Fingerprint https://www.apple.com/business/docs/iOS_Security_Guide.pdf

ISC StormCast for Thursday, May 19th 2016 May 18, 2016

Teslacrypt Shutting Down and Releasing Master Key http://www.bleepingcomputer.com/news/security/teslacrypt-shuts-down-and-releases-master-decryption-key/ Office 365 Risks https://www.skyhighnetworks.com/cloud-security-blog/7-charts-reveal-the-meteoric-rise-of-office-365/ LinkedIn Data Leaked From Past Breach https://twitter.com/troyhunt/status/732838759390191617 Google Discontinuing SSLv3/RC4 Support for SMTP http://googleappsupdates.blogspot.ro/2016/05/disabling-support-for-sslv3-and-rc4-for.html

Older Entries Newer Entries