SANS Daily Stormcast

Digital Dispatch Podcast Podcast Artwork Image

Johannes Ullrich

A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter.

Contact Show

Recent Episodes

ISC StormCast for Wednesday, May 18th 2016 May 17, 2016

Exploit for Recently Patched Cisco IKEv1/v2 Bufferoverflow Published https://isc.sans.edu/forums/diary/Exploit+Available+For+Cisco+IKEv1+and+IKEv2+Buffer+Overflow+Vulnerability/21065/ Symantec Antivirus Engine Malformed PE Header Parser Vulnerability https://isc.sans.edu/forums/diary/CVE20162208+Symantec+Antivirus+Engine+Malformed+PE+Header+Parser+Memory+Access+Violation/21069/ New CryptXXX Decryption Tool From Kaspersky https://blog.kaspersky.com/cryptxxx-decryption-20/12091/ More Malware in Google Play Store http://blog.checkpoint.com/2016/05/09/viking-horde-a-new-type-of-android-malware-on-google-play/ iPadPro Crashes After Updating to iOS 9.3.2 http://www.macrumors.com/2016/05/17/9-7-inch-ipad-pro-crashing-issues-safari/ New Remote Code Execution in Magento E-Commerce Software http://netanelrub.in/2016/05/17/magento-unauthenticated-remote-code-execution/

ISC StormCast for Tuesday, May 17th 2016 May 16, 2016

419 Death Scams Still Going Around https://isc.sans.edu/forums/diary/An+oldie+but+a+goodie+419+Death+Scam/21061/ Apple Updates https://support.apple.com/en-us/HT201222 Flash Zero Day Details https://www.fireeye.com/blog/threat-research/2016/05/cve-2016-4117-flash-zero-day.html Google "HTML5 By Default" Draft https://docs.google.com/presentation/d/106_KLNJfwb9L-1hVVa4i29aw1YXUy9qFX-Ye4kvJj-4/edit#slide=id.p

ISC StormCast for Monday, May 16th 2016 May 15, 2016

Python Malware https://isc.sans.edu/forums/diary/Python+Malware+Part+1/21057/ Ubiquity AirOS Worm http://community.ubnt.com/t5/airMAX-General-Discussion/Virus-attack-URGENT-UBNT/td-p/1562940 Google Chrome Update http://www.theregister.co.uk/2016/05/13/google_crushes_five_vulns_with_patch_run_and_20k_in_bug_bounties/ More Banks Affected By Fake SWIFT Transactions http://www.nytimes.com/2016/05/13/business/dealbook/swift-global-bank-network-attack.html?_r=0 Microsoft Releases Windows 10 Security Auditing And Monitoring Reference https://www.microsoft.com/en-us/download/details.aspx?id=52630

ISC StormCast for Friday, May 13th 2016 May 12, 2016

Adobe Flash Player Update Released https://helpx.adobe.com/security/products/flash-player/apsb16-15.html Microsoft Excel Phishing https://isc.sans.edu/forums/diary/Another+Day+Another+Wave+of+Phishing+Emails/21045/ Squid Proxy Bug Allows For Cache Poisoning http://bugs.squid-cache.org/show_bug.cgi?id=4501 Nation State Attackers May Exploit Firefox https://blog.mozilla.org/blog/2016/05/11/advanced-disclosure-needed-to-keep-users-secure/

ISC StormCast for Thursday, May 12th 2016 May 11, 2016

Exploited Flash Vulnerablity Patched Only For Windows https://helpx.adobe.com/security/products/flash-player/apsa16-02.html SAP Vulnerabilities Exploited https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applications Free Decryption Tool For CryptXXX No Longer Works https://www.proofpoint.com/us/threat-insight/post/cryptxxx2-ransomware-authors-strike-back-against-free-decryption-tool Multiple 7-Zip Vulnerabilities http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html Ransomware Overview https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/edit#gid=0

ISC StormCast for Wednesday, May 11th 2016 May 10, 2016

Windows Patch Tuesday https://isc.sans.edu/mspatchdays.html?viewday=2016-05-10 Adobe Patch Tuesday https://helpx.adobe.com/security.html

ISC StormCast for Tuesday, May 10th 2016 May 09, 2016

Network Forensics With DShell https://isc.sans.edu/forums/diary/Performing+network+forensics+with+Dshell+Part+1+Basic+usage/21035/ Aruba Vulnerabilities (and Patches) http://seclists.org/fulldisclosure/2016/May/19 Allwinner Android Device Debug Backdoor http://forum.armbian.com/index.php/topic/1108-security-alert-for-allwinner-sun8i-h3a83th8/ ImageTragick Flaw Being Exploited https://blog.cloudflare.com/inside-imagetragick-the-real-payloads-being-used-to-hack-websites-2/ Attacking JSON Web Tokens https://www.notsosecure.com/crafting-way-json-web-tokens/ ASUS UEFI Red Screen Of Death Workaround https://www.asus.com/support/FAQ/1016356/

ISC StormCast for Monday, May 9th 2016 May 08, 2016

A Quick Introduction To Linux Capabilities https://isc.sans.edu/forums/diary/Guest+Diary+Linux+Capabilities+A+friend+and+foe/21031/ Review of TLS Proxy Security Issues http://users.encs.concordia.ca/~mmannan/publications/ssl-interception-ndss2016.pdf Ransomware Claims to Donate Proceeds To Charity https://heimdalsecurity.com/blog/security-alert-new-ransomware-donate-earnings-charity/

ISC StormCast for Friday, May 6th 2016 May 06, 2016

Large Number of Credentials Offered For Sale http://www.reuters.com/article/us-cyber-passwords-idUSKCN0XV1I6 Alphalocker: Affordable Ransom Ware https://blog.cylance.com/an-introduction-to-alphalocker JAKU Botnet https://www.forcepoint.com/sites/default/files/resources/files/report_jaku_analysis_of_botnet_campaign_en_0.pdf Juniper Update http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734&cat=SIRT_1&actp=LIST

ISC StormCast for Thursday, May 5th 2016 May 04, 2016

Malicious Ads Seens On CBS TV Stations https://blog.malwarebytes.org/threat-analysis/2016/05/cbs-affiliated-television-stations-expose-visitors-to-angler-exploit-kit/ ImageMagick Vulnerability https://isc.sans.edu/forums/diary/ImageTragick+Another+Vulnerability+Another+Nickname/21023/ Fake DDoS Threats Continue http://www.actionfraud.police.uk/news/online-extortion-demands-affecting-businesses-apr16/ Cisco Patches Tele Presence Equipment https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-tpxml Cracking PeopleSoft PS_TOKEN with oclHashcat http://blog.gosecure.ca/2016/05/04/oracle-peoplesoft-still-a-threat-for-enterprises/

ISC StormCast for Wednesday, May 4th 2016 May 04, 2016

OpenSSL Update Released https://isc.sans.edu/forums/diary/OpenSSL+Updates/21015/ Gerber Exploit Kit Installed By Neutrino EK https://isc.sans.edu/forums/diary/Neutrino+exploit+kit+sends+Cerber+ransomware/21017/ Image Magick Vulnerablity https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588 http://www.openwall.com/lists/oss-security/2016/05/03/18 Microsoft Will No Longer Consider SHA-1 Certificates As Secure https://blogs.windows.com/msedgedev/2016/04/29/sha1-deprecation-roadmap/

ISC StormCast for Tuesday, May 3rd 2016 May 02, 2016

Fake Google Chrome Update Installs Malware on Android https://www.zscaler.com/blogs/research/android-infostealer-posing-fake-google-chrome-update Android May Security Bulletin https://source.android.com/security/bulletin/2016-05-01.html Google Chrome Update https://source.android.com/security/bulletin/2016-05-01.html Pwned List Got Pwned http://krebsonsecurity.com/2016/05/how-the-pwnedlist-got-pwned/

ISC StormCast for Monday, May 2nd 2016 May 01, 2016

ATM Jackpotting: Analysis of ATM APIs https://securelist.com/analysis/publications/74533/malware-and-non-malware-ways-for-atm-jackpotting-extended-cut/ Reverse Engineering A ATM Machine Skimmer https://trustfoundry.net/reverse-engineering-a-discovered-atm-skimmer/ Bathroom Scale Vulnerability https://help.fitbit.com/articles/en_US/Help_article/How-do-I-update-my-Aria-scale/ Fake Mobile Payment Apps in Google Play Store https://info.phishlabs.com/blog/fraudster-phishing-users-with-malicious-mobile-apps

ISC StormCast for Friday, April 29th 2016 April 28, 2016

Powershell and DNS/DHCP https://isc.sans.edu/forums/diary/DNS+and+DHCP+Recon+using+Powershell/20995/ New Version of PCI Standard Released https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2_Summary_of_Changes.pdf OpenSSL Patch Pre-Announced https://mta.openssl.org/pipermail/openssl-announce/2016-April/000069.html NTP Patches http://blog.talosintel.com/2016/04/vulnerability-spotlight-further-ntpd_27.html#more

ISC StormCast for Thursday, April 28th 2016 April 27, 2016

SAML Federated Identity Vulnerability in Office 365 http://www.economyofmechanism.com/office365-authbypass.html .AS Registry Vulnerable to Direct Object Reference https://isecguy.wordpress.com/2016/04/25/flaw-allowed-anyone-to-modify-take-control-over-any-as-domain/ Driveby Exploit Used to Deliver Android Ransomware https://www.bluecoat.com/security-blog/2016-04-25/android-exploit-delivers-dogspectus-ransomware CryptXXX Decrypt Tool https://support.kaspersky.com/viruses/disinfection/8547?_ga=1.128163404.1397432418.1454514283#block3

ISC StormCast for Wednesday, April 27th 2016 April 26, 2016

OS X Memory Forensics https://isc.sans.edu/forums/diary/An+Introduction+to+Mac+memory+forensics/20989/ Facebook App Used to Delivery Facebook Phish http://news.netcraft.com/archives/2016/04/22/hook-like-and-sinker-facebook-serves-up-its-own-phish.html Android.Spy.277.origin Keeps Being Delivered By Google Play Store Apps http://blog.checkpoint.com/2016/04/22/in-the-wild-google-cant-close-the-door-on-android-malware/ Tool To Replay RDP Sessions From pcaps http://www.contextis.com/resources/blog/rdp-replay-code-release/ Juniper Update http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727&cat=SIRT_1&actp=LIST RouterSploit Router Exploit Framework https://github.com/reverse-shell/routersploit

ISC StormCast for Tuesday, April 26th 2016 April 25, 2016

Details From the Breach of the Central Bank of Bangladesh http://baesystemsai.blogspot.de/2016/04/two-bytes-to-951m.html Apple Image IO Denial of Service https://www.landaire.net/blog/apple-imageio-denial-of-service/ Text Messages Used to Phish Apple IDs http://www.independent.co.uk/life-style/gadgets-and-tech/news/apple-id-password-expired-expiry-text-website-scam-phishing-a6991126.html Critical HP Data Protector Patch https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05085988 Armada Collection (or imposter) Making Fake DDoS Threats https://blog.cloudflare.com/empty-ddos-threats-meet-the-armada-collective/

ISC StormCast for Monday, April 25th 2016 April 24, 2016

Angler EK Used to Spread CryptXXX https://isc.sans.edu/forums/diary/Angler+Exploit+Kit+Bedep+and+CryptXXX/20981/ Honeports Powershell Script https://isc.sans.edu/forums/diary/Honeyports+powershell+script/20979/ Online Credit Card Fraud Soars http://www.pymnts.com/fraud-prevention/2016/online-fraud-attack-rates-soar-since-october/ How to Trick Traffic Sensors https://securelist.com/blog/research/74454/how-to-trick-traffic-sensors/ Opera VPN Service Analysis https://gist.github.com/spaze/558b7c4cd81afa7c857381254ae7bd10 https://www.helpnetsecurity.com/2016/04/21/opera-browser-free-vpn/

ISC StormCast for Friday, April 22nd 2016 April 21, 2016

Accellion Secure File Transfer Vulnerability and Facebook Exploitation http://devco.re/blog/2016/04/21/how-I-hacked-facebook-and-found-someones-backdoor-script-eng-ver/ Application Whitelisting Bypass With regsvr32 http://subt0x10.blogspot.com/2016/04/bypass-application-whitelisting-script.html New NetworkManager Version Released https://cgit.freedesktop.org/NetworkManager/NetworkManager/plain/NEWS?id=nm-1-2 Opera Includes Free VPN http://www.opera.com/blogs/desktop/2016/04/free-vpn-integrated-opera-for-windows-mac/

ISC StormCast for Thursday, April 21st 2016 April 20, 2016

Decoding Pseudo Darkleech https://isc.sans.edu/forums/diary/Decoding+PseudoDarkleech+1/20969/ Tesla Crypt 4.1 https://www.endgame.com/blog/your-package-has-been-successfully-encrypted-teslacrypt-41a-and-malware-attack-chain RansomWhere Protects OS X Users from Ransware https://objective-see.com/products/ransomwhere.html Testing TLS Libraries With TLS Attackers https://github.com/RUB-NDS/TLS-Attacker

Older Entries Newer Entries