SANS Daily Stormcast

Digital Dispatch Podcast Podcast Artwork Image

Johannes Ullrich

A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter.

Contact Show

Recent Episodes

ISC StormCast for Wednesday, November 21st 2018 November 20, 2018

Critical Flash Update https://helpx.adobe.com/security/products/flash-player/apsb18-44.html Thanksgiving Lure for Emotet https://www.forcepoint.com/blog/security-labs/thanks-giving-emotet

ISC StormCast for Tuesday, November 20th 2018 November 19, 2018

Google Play Malware https://twitter.com/LukasStefanko ATM Vulnerabilities https://www.ptsecurity.com/upload/corporate/ww-en/analytics/ATM-Vulnerabilities-2018-eng.pdf Nagios XI Update https://www.tenable.com/security/research/tra-2018-37

ISC StormCast for Monday, November 19th 2018 November 18, 2018

Multipurpose PCAP Analysis Tool https://isc.sans.edu/forums/diary/Multipurpose+PCAP+Analysis+Tool/24322/ Quickly Investigating Websites with Lookyloo https://isc.sans.edu/forums/diary/Quickly+Investigating+Websites+with+Lookyloo/24320/ From Field Spoofing in GMail https://blog.cotten.io/hacking-gmail-with-weird-from-fields-d6494254722f?gi=ce61de4cb006

ISC StormCast for Friday, November 16th 2018 November 15, 2018

Emotet Spreading IcedID Banking Malware https://isc.sans.edu/forums/diary/Emotet+infection+with+IcedID+banking+Trojan/24312/ Crypto Miners Abusing Insecure Docker Installs https://forums.juniper.net/t5/Threat-Research/Container-Malware-Miners-Go-Docker-Hunting-In-The-Cloud/ba-p/400587 GPS Watches Can Be Used To Track Kids https://www.pentestpartners.com/security-blog/tracking-and-snooping-on-a-million-kids/ Firefox Will Notify Users of Breached Sites https://blog.mozilla.org/blog/2018/11/14/firefox-monitor-launches-in-26-languages-and-adds-new-desktop-browser-feature/ David Kennel: All-Seeing Eye or Blind Man? Understanding the Linux Kernel Auditing System https://www.sans.org/reading-room/whitepapers/linux/all-seeing-eye-blind-man-understanding-linux-kernel-auditing-system-38605

ISC StormCast for Thursday, November 15th 2018 November 14, 2018

Details about Zero Day Exploit Taking Advantage of Win32k Vuln. https://securelist.com/a-new-exploit-for-zero-day-vulnerability-cve-2018-8589/88845/ PacSec Pwn2Own Results https://www.zerodayinitiative.com/blog/2018/11/13/pwn2own-tokyo-2018-day-one-results https://www.zerodayinitiative.com/blog/2018/11/14/pwn2own-tokyo-2018-day-two-results-and-master-of-pwn More Spectre/Meltdown Flaws https://arxiv.org/pdf/1811.05441.pdf

ISC StormCast for Wednesday, November 14th 2018 November 13, 2018

Microsoft Patch Tuesday https://isc.sans.edu/forums/diary/November+2018+Microsoft+Patch+Tuesday/24308/ Adobe Security Bulletins https://helpx.adobe.com/security.html

ISC StormCast for Tuesday, November 13th 2018 November 12, 2018

Google BGP Hijack via Russia https://twitter.com/thousandeyes/status/1062102171506765825 https://www.wsj.com/articles/google-internet-traffic-is-briefly-misdirected-through-russia-china-1542068392 Microcode Bootloader USB https://www.techpowerup.com/forums/threads/intel-microcode-boot-loader.248858/ Wordpress GDPR Tool Vulnerable https://www.wordfence.com/blog/2018/11/trends-following-vulnerability-in-wp-gdpr-compliance-plugin/

ISC StormCast for Monday, November 12th 2018 November 11, 2018

Cloudflare Releases Mobile Apps To Use 1.1.1.1 https://blog.cloudflare.com/1-thing-you-can-do-to-make-your-internet-safer-and-faster/ Crypto Coin Miners Now With Rootkits https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/cryptocurrency-mining-malware-targets-linux-systems-uses-rootkit-for-stealth Google Play Protect Reduces Malware https://security.googleblog.com/2018/11/introducing-android-ecosystem-security.html

ISC StormCast for Friday, November 9th 2018 November 08, 2018

Cisco Security Bulletins https://tools.cisco.com/security/center/publicationListing.x Ruby Deserialization https://www.elttam.com.au/blog/ruby-deserialization/ Ouch Newsletter: Am I Hacked? https://www.sans.org/security-awareness-training/resources/am-i-hacked Jonathan Sweeny: Smart Contract Botnets https://www.sans.org/reading-room/whitepapers/covert/botnet-resiliency-private-blockchains-38050 https://www.sans.org/reading-room/whitepapers/warfare/tearing-smart-contract-botnets-38650

ISC StormCast for Thursday, November 8th 2018 November 07, 2018

VirtualBox 0 Day Guest Escape Exploit Released https://github.com/MorteNoir1/virtualbox_e1000_0day WooCommerce / Wordpress Bug Leads to RCE https://blog.ripstech.com/2018/wordpress-design-flaw-leads-to-woocommerce-rce/ Bing Advertises Fake Version of Notepad2 https://www.bleepingcomputer.com/news/security/beware-of-unofficial-sites-pushing-notepad2-adware-bundles/ Jacksonville BSides https://bsidesjax.org

ISC StormCast for Wednesday, November 7th 2018 November 06, 2018

China Telecom's Internet Traffic Misdirection https://internetintel.oracle.com/blog-single.html?id=China+Telecom%27s+Internet+Traffic+Misdirection Android Security Updates; Last for Nexus https://source.android.com/security/bulletin/2018-11-01#framework PoC Facetime Exploit https://bugs.chromium.org/p/project-zero/issues/detail?id=1641 Vulnerability in U-Boot Bootloader https://github.com/inversepath/usbarmory/blob/master/software/secure_boot/Security_Advisory-Ref_IPVR2018-0001.txt

ISC StormCast for Tuesday, November 6th 2018 November 05, 2018

Struts 2.3 Uses Outdated commons-fileupload library https://isc.sans.edu/forums/diary/Struts+23+Vulnerable+to+Two+Year+old+File+Upload+Flaw/24278/ Fake Elon Musk Tweet used to steal Bitcoin https://www.bleepingcomputer.com/news/security/fake-elon-musk-twitter-bitcoin-scam-earned-180k-in-one-day/ Bypassing SSD Drive Hardware Encryption https://www.ru.nl/english/news-agenda/news/vm/icis/cyber-security/2018/radboud-university-researchers-discover-security/

ISC StormCast for Monday, November 5th 2018 November 04, 2018

Beyond good ol' LaunchAgents https://isc.sans.edu/forums/diary/Beyond+good+ol+LaunchAgent+part+1/24274/ Dissecting a CVE-2017-11882 Exploit https://isc.sans.edu/forums/diary/Dissecting+a+CVE201711882+Exploit/24272/ Microsoft Edge Exploit About to Be Released https://twitter.com/Yux1xi Portsmash Vulnerability https://github.com/bbbrumley/portsmash RC4 (Arcfour) Depreciation in SSH https://tools.ietf.org/html/draft-ietf-curdle-rc4-die-die-die-12

ISC StormCast for Friday, November 2nd 2018 November 01, 2018

Windows Defender Sandboxing Bug https://isc.sans.edu/forums/diary/Windows+Defenders+Sandbox/24266/ Bleedingbit Bluetooth Low Energy Vulnerability https://armis.com/bleedingbit/ Cisco ASA/Firepower DoS Vulnerability Actively Exploited https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181031-asaftd-sip-dos

ISC StormCast for Thursday, November 1st 2018 October 31, 2018

Encrypted Word Maldocs https://isc.sans.edu/forums/diary/More+malspam+using+passwordprotected+Word+docs/24262/ iOS / MacOS ICMP Error Remote Code Execution https://lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407 iOS Lock Screen Bypass https://www.youtube.com/watch?v=ojigFgwrtKs

ISC StormCast for Wednesday, October 31st 2018 October 30, 2018

Change in Strategy for Hancitor Malware https://isc.sans.edu/forums/diary/Campaign+evolution+Hancitor+malspam+starts+pushing+Ursnif+this+week/24256/ Apple Updates https://support.apple.com/en-us/HT201222 Telegram Stores Conversations Locally https://twitter.com/nathanielrsuchy

ISC StormCast for Tuesday, October 30th 2018 October 29, 2018

Maldoc Duplicating PowerShell https://isc.sans.edu/forums/diary/Maldoc+Duplicating+PowerShell+Prior+to+Use/24254/ New File Types Emerge in Malware Spam Attachments https://blog.trendmicro.com/trendlabs-security-intelligence/same-old-yet-brand-new-new-file-types-emerge-in-malware-spam-attachments/ Malicious Mac Crypto Currency Tracker Installs Backdoor https://blog.malwarebytes.com/threat-analysis/2018/10/mac-cryptocurrency-ticker-app-installs-backdoors/ Sandbox For Windows Defender https://cloudblogs.microsoft.com/microsoftsecure/2018/10/26/windows-defender-antivirus-can-now-run-in-a-sandbox/

ISC StormCast for Monday, October 29th 2018 October 28, 2018

Dissecting Malicious Office Documents in Linux https://isc.sans.edu/forums/diary/Dissecting+Malicious+Office+Documents+with+Linux/24248/ Analyzing Compressed RTF Documents https://isc.sans.edu/forums/diary/Detecting+Compressed+RTF/24250/ SystemD DHCPv6 Remote Code Executing Vulnerability https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-15688 Cryptominers Scan for Docker Engine https://blog.trendmicro.com/trendlabs-security-intelligence/misconfigured-container-abused-to-deliver-cryptocurrency-mining-malware DemonBot Targeting Hadoop https://blog.radware.com/security/2018/10/new-demonbot-discovered/

ISC StormCast for Friday, October 26th 2018 October 25, 2018

Scam Calls Targeting Chinese Living in the US https://isc.sans.edu/forums/diary/Fake+BankPost+Office+Phone+Calls+Targeting+Chinese+Immigrants/24244/ X.org Privilege Elevation Flaw https://lists.x.org/archives/xorg-announce/2018-October/002927.html Remote Videos in Office Documents https://blog.cymulate.com/abusing-microsoft-office-online-video Mac Malware Injects Ads https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/

ISC StormCast for Thursday, October 25th 2018 October 24, 2018

Reversing AutoIT https://isc.sans.edu/forums/diary/Diving+into+Malicious+AutoIT+Code/24238/ Arcserve Vulnerabilities https://www.digitaldefense.com/blog/zero-day-alerts/arcserve-disclosure/ WebExec Vulnerability https://webexec.org/ More ALPC Flaws from Sandbox Escaper https://twitter.com/SandboxEscaper/status/1054744201244692485 https://twitter.com/mkolsek/status/1054794984908562432

Older Entries Newer Entries