SANS Daily Stormcast

Digital Dispatch Podcast Podcast Artwork Image

Johannes Ullrich

A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter.

Contact Show

Recent Episodes

ISC StormCast for Friday, September 20th 2019 September 19, 2019

Agent Tesla https://isc.sans.edu/forums/diary/Agent+Tesla+Trojan+Abusing+Corporate+Email+Accounts/25336/ Apple Updates https://support.apple.com/en-us/HT201222 https://developer.apple.com/documentation/safari_release_notes/safari_13_release_notes SAMBA 4.11 Released https://www.samba.org/samba/history/samba-4.11.0.html GitHub Security Updates https://github.blog/2019-09-18-securing-software-together/

ISC StormCast for Thursday, September 19th 2019 September 18, 2019

Analyzing a Current Emotet Sample https://isc.sans.edu/forums/diary/Emotet+malspam+is+back/25330/ Windows Defender "Scan Now" Failed Bug Fix https://www.bleepingcomputer.com/news/microsoft/windows-defender-antivirus-scans-broken-after-new-update/ https://borncity.com/win/2019/09/18/defender-antimalware-version-4-18-1908-7-released/ QEMU Vulnerablity https://www.openwall.com/lists/oss-security/2019/09/17/1 VMWare Vulnerabilty https://blogs.vmware.com/security/2019/09/amd-display-driver-security-updates-address-cve-2019-5685.html New CWE Top 25 Released https://cwe.mitre.org/top25/archive/2019/2019_cwe_top25.html

ISC StormCast for Wednesday, September 18th 2019 September 17, 2019

Investigating Gaps in Windows Event Logs https://isc.sans.edu/forums/diary/Investigating+Gaps+in+your+Windows+Event+Logs/25328/ SOHOpelesly Broken 2 https://www.securityevaluators.com/whitepaper/sohopelessly-broken-2/ HP Printer Privacy https://robertheaton.com/2019/09/15/hp-printers-send-data-on-what-you-print-back-to-hp/

ISC StormCast for Tuesday, September 17th 2019 September 16, 2019

Encrypted Sextortion https://isc.sans.edu/forums/diary/Encrypted+Sextortion+PDFs/25324/ SimJacker https://www.adaptivemobile.com/blog/simjacker-next-generation-spying-over-mobile LastPass Password Leak https://bugs.chromium.org/p/project-zero/issues/detail?id=1930 Microsoft Extends EoL For Exchange Server 2010 https://techcommunity.microsoft.com/t5/Exchange-Team-Blog/Microsoft-Extending-End-of-Support-for-Exchange-Server-2010-to/ba-p/753591

ISC StormCast for Monday, September 16th 2019 September 15, 2019

Rig Exploit Kit Delivering VBScript https://isc.sans.edu/forums/diary/Rig+Exploit+Kit+Delivering+VBScript/25318/ Pentesters Arrested During Physical Access Pentest https://arstechnica.com/information-technology/2019/09/check-the-scope-pen-testers-nabbed-jailed-in-iowa-courthouse-break-in-attempt/ iOS Lock Screen Unlock Vulnerability https://www.theregister.co.uk/2019/09/12/apples_ios_lock_workaround/

ISC StormCast for Wednesday, September 11th 2019 September 10, 2019

Microsoft Patch Tuesday https://isc.sans.edu/forums/diary/Microsoft+September+2019+Patch+Tuesday/25310/ Adobe Patches https://helpx.adobe.com/security.html Intel SSH Side Channel Vulnerability https://www.vusec.net/projects/netcat/ https://www.cs.vu.nl/~herbertb/download/papers/netcat_sp20.pdf

ISC StormCast for Tuesday, September 10th 2019 September 09, 2019

Firefox to Enable DNS over HTTPs by Default in September https://blog.mozilla.org/futurereleases/2019/09/06/whats-next-in-making-dns-over-https-the-default/ Telegram Fixes Privacy Bug https://www.inputzero.io/2019/09/telegram-privacy-fails-again.html PsiXBot Uses DoH https://www.proofpoint.com/us/threat-insight/post/psixbot-now-using-google-dns-over-https-and-possible-new-sexploitation-module

ISC StormCast for Monday, September 9th 2019 September 08, 2019

Unidentified Scanning Activity Likely Associated with Mirai/Successors https://isc.sans.edu/forums/diary/Unidentified+Scanning+Activity/25304/ Bluekeep Exploit Now in Metasploit https://blog.rapid7.com/2019/09/06/initial-metasploit-exploit-module-for-bluekeep-cve-2019-0708/ How to Remove GMail Calendar Spam https://support.google.com/calendar/answer/6084018?co=GENIE.Platform%3DDesktop&hl=en Exim SNI TLS Vulnerability https://exim.org/static/doc/security/CVE-2019-15846.txt

ISC StormCast for Wednesday, September 4th 2019 September 03, 2019

Tricky Link Retrieves Trick Bot https://isc.sans.edu/forums/diary/Guest+Diary+Tricky+LNK+points+to+TrickBot/25290/ Supermicro Virtual USB Vulnerability https://eclypsium.com/2019/09/03/usbanywhere-bmc-vulnerability-opens-servers-to-remote-attack/ Facebook Free Basics Key Used to Sign Unrelated Android Apps https://www.androidpolice.com/2019/08/29/cryptographic-key-used-to-sign-one-of-facebooks-android-apps-compromised/

ISC StormCast for Tuesday, September 3rd 2019 September 02, 2019

Malware Installs Node.js https://isc.sans.edu/forums/diary/Malware+Dropping+a+Local+Nodejs+Instance/25284/ Dovecot and PigeonHole Vulnerability https://www.openwall.com/lists/oss-security/2019/08/28/3 Cloudflare Workers Spreading Malware https://medium.com/@marcelx/threat-actor-behind-astaroth-is-now-using-cloudflare-workers-to-bypass-your-security-solutions-2c658d08f4c

ISC StormCast for Monday, September 2nd 2019 September 01, 2019

iOS Exploits in the Wild https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html Twitter CEO's Twitter Account Hijacked https://twitter.com/TwitterComms/status/1167528672523210752

ISC StormCast for Friday, August 30th 2019 August 29, 2019

Malware Samples Compiling Their Next Stage On PremiseMalware Compiling Itself; https://isc.sans.edu/forums/diary/Malware+Samples+Compiling+Their+Next+Stage+on+Premise/25278/ CERT-Bund Attempts to Notify Users of Vulnerable Home Automation Systems https://www.heise.de/security/meldung/CERT-Bund-warnt-vor-offenen-Smarthome-Systemen-4509977.html French Authorities Shut Down Coinminer Botnet https://decoded.avast.io/janvojtesek/putting-an-end-to-retadup-a-malicious-worm-that-infected-hundreds-of-thousands/

ISC StormCast for Thursday, August 29th 2019 August 28, 2019

Open Redirects: A Small But Very Common Vulnerability https://isc.sans.edu/forums/diary/Guest+Diary+Open+Redirect+A+Small+But+Very+Common+Vulnerability/25276/ CamScanner Malicious Download Component https://securelist.com/dropper-in-google-play/92496/ Ares ADB Botnet https://www.wootcloud.com/blogs/ars_botnet.html Cisco REST API Container for IOS XE Authentication Bypass https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-iosxe-rest-auth-bypass

ISC StormCast for Wednesday, August 28th 2019 August 27, 2019

Is it "Safe" To Require TLS 1.2 for Email https://isc.sans.edu/forums/diary/Is+it+Safe+to+Require+TLS+12+for+EMail/25270/ Android Trojan Infects Tens of Thousands of Devices in 4 Months https://www.bleepingcomputer.com/news/security/android-trojan-infects-tens-of-thousands-of-devices-in-4-months/ LYCEUM Threat Group Targeting Middle East https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign

ISC StormCast for Tuesday, August 27th 2019 August 26, 2019

Apple Patches Jailbreak Vulnerability https://support.apple.com/en-us/HT210549 Scanning for Pulse Secure VPN Endpoints https://badpackets.net/over-14500-pulse-secure-vpn-endpoints-vulnerable-to-cve-2019-11510/ Emotet is Back https://www.bleepingcomputer.com/news/security/emotet-botnet-is-back-servers-active-across-the-world/

ISC StormCast for Monday, August 26th 2019 August 25, 2019

Simple Mimikatz And RDPWrapper Dropper https://isc.sans.edu/forums/diary/Simple+Mimikatz+RDPWrapper+Dropper/25262/ Malware Impersonating IRS https://www.irs.gov/newsroom/security-summit-warns-of-new-irs-impersonation-email-scam-reminds-taxpayers-the-irs-does-not-send-unsolicited-emails Instagram Phishing with 2FA Codes https://nakedsecurity.sophos.com/2019/08/23/instagram-phishing-uses-2fa-as-a-lure/ GitHub Adding WebAuthn Support https://www.theregister.co.uk/2019/08/23/github_upgrades_its_twofactor_authentication_with_webauthn_support/ Lenovo Solution Center Privilege Escalation https://www.pentestpartners.com/security-blog/privesc-in-lenovo-solution-centre-10-minutes-later/

ISC StormCast for Friday, August 23rd 2019 August 22, 2019

Steam Zero Days and Bug Bounty Controversy https://www.theregister.co.uk/2019/08/22/valve_bug_bounty_steam_u_turn/ bb-builder malicious npm Package https://blog.reversinglabs.com/blog/the-npm-package-that-walked-away-with-all-your-passwords Phishers Customize Branded Outlook 365 Login Pages https://www.bleepingcomputer.com/news/security/phishing-attacks-scrape-branded-microsoft-365-login-pages/

ISC StormCast for Thursday, August 22nd 2019 August 21, 2019

KAPE vs. Commando VM: Red vs. Blue https://isc.sans.edu/forums/diary/KAPE+Kroll+Artifact+Parser+and+Extractor/25258/ Attacks against Exposed Sphinx Servers https://www.bsi.bund.de/EN/Topics/IT-Crisis-Management/CERT-Bund/CERT-Reports/HOWTOs/Open-Sphinx-Server/open-Sphinx-server_node.html Cisco Patches https://tools.cisco.com/security/center/publicationListing.x?product=Cisco&sort=-day_sir&limit=50#~Vulnerabilities Newly Registered Domains Most Dangerous https://unit42.paloaltonetworks.com/newly-registered-domains-malicious-abuse-by-bad-actors/

ISC StormCast for Wednesday, August 21st 2019 August 20, 2019

Guildma Malware is Now Using Facebook and YouTube as Update Channel https://isc.sans.edu/forums/diary/Guildma+malware+is+now+accessing+Facebook+andYouTube+to+keep+uptodate/25222/ Supply Chain Issues: rest-client ruby gem backdoored https://www.theregister.co.uk/2019/08/20/ruby_gem_hacked/

ISC StormCast for Tuesday, August 20th 2019 August 19, 2019

iOS 12.4 Jailbreak Released after Reindruced Vulnerability form 12.2 https://github.com/pwn20wndstuff/Undecimus/releases SHA2-Signed Updates for Windows Not Available with Symantec Endpoint Protection https://support.symantec.com/us/en/article.tech255857.html Attacking and Downgrading Bluetooth Key Negotiation https://knobattack.com

Older Entries Newer Entries