SANS Daily Stormcast

Digital Dispatch Podcast Podcast Artwork Image

Johannes Ullrich

A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter.

Contact Show

Recent Episodes

ISC StormCast for Wednesday, October 24th 2018 October 23, 2018

Malware Uses Decoy Picture https://isc.sans.edu/forums/diary/Malicious+Powershell+using+a+Decoy+Picture/24234/ DNS over HTTPS Pushback https://twitter.com/paulvixie/status/1053765281917661184 Signal Desktop Leaves Encryption Key Exposed https://twitter.com/nathanielrsuchy Firefox 63 Allows Less Tracking https://blog.mozilla.org/security/2018/10/23/firefox-63-lets-users-block-tracking-cookies/

ISC StormCast for Tuesday, October 23rd 2018 October 22, 2018

MSG Files: Compressed RTF https://isc.sans.edu/forums/diary/MSG+Files+Compressed+RTF/24228/ FreeRTOS TCP/IP Stack Vulnerabilities https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-put-wide-range-devices-risk-compromise-smart-homes-critical-infrastructure-systems/ VLC/Live555 RTSP Server Vulnerability https://www.talosintelligence.com/reports/TALOS-2018-0684 Microsoft Yammer Update https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2018-8569#ID0EGB

ISC StormCast for Monday, October 22nd 2018 October 21, 2018

MacOS LaunchAgent https://isc.sans.edu/forums/diary/Beyond+good+ol+LaunchAgent+part+0/24230/ TLS Session Tracking https://arxiv.org/pdf/1810.07304.pdf jQuery File Upload Plugin https://blogs.akamai.com/sitr/2018/10/having-the-security-rug-pulled-out-from-under-you.html Drupal Update https://www.drupal.org/sa-core-2018-006

ISC StormCast for Friday, October 19th 2018 October 18, 2018

Cisco Patches https://tools.cisco.com/security/center/Search.x?publicationTypeIDs=1&firstPublishedStartDate=2018%2F10%2F17&firstPublishedEndDate=2018%2F10%2F17&lastPublishedStartDate=2018%2F10%2F17&lastPublishedEndDate=2018%2F10%2F17 51% Attack Against Crypto Currencies https://old.reddit.com/r/CryptoCurrency/comments/9m1uuj/if_i_livestreamed_the_setup_and_execution_of/ VMWare Patch https://www.vmware.com/au/security/advisories/VMSA-2018-0026.html

ISC StormCast for Thursday, October 18th 2018 October 17, 2018

Abandoned "NewShareCount" Twitter Counter abused https://blog.sucuri.net/2018/10/malicious-redirects-from-newsharecounts-com-tweet-counter.html Multiple D-Link Vulnerabilities https://seclists.org/fulldisclosure/2018/Oct/36 RID Hacking in Windows https://www.romhack.io/slides/RomHack%202018%20-%20Sebastian%20Castro%20-%20Windows%20RID%20Hijacking:%20Maintaining%20Access%20on%20Windows%20Machines.pdf

ISC StormCast for Wednesday, October 17th 2018 October 16, 2018

Oracle CPU https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html libssh vulnerability https://www.libssh.org/security/advisories/CVE-2018-10933.txt Vending Machine Mobile App Compromise https://hackernoon.com/how-i-hacked-modern-vending-machines-43f4ae8decec Browsers Announce Timeline to Discontinue TLS1.0/1.1 support https://blogs.windows.com/msedgedev/2018/10/15/modernizing-tls-edge-ie11/ https://security.googleblog.com/2018/10/modernizing-transport-security.html https://blog.mozilla.org/security/2018/10/15/removing-old-versions-of-tls/ https://webkit.org/blog/8462/deprecation-of-legacy-tls-1-0-and-1-1-versions/

ISC StormCast for Tuesday, October 16th 2018 October 15, 2018

Proof Of Concept Exploit for Microsoft Edge Vulnerability CVE-2018-8495 https://leucosite.com/Microsoft-Edge-RCE/ Fake Mining Apps https://www.fortinet.com/blog/threat-research/fortinet-discovers-new-android-apps-that-mine-the-unminable.html Fake Google Photo App Turns out to be Ad-Clicker https://www.geeklatest.com/developer-tricks-microsoft-publishes-app-under-google-llc-name-in-windows-store/

ISC StormCast for Monday, October 15th 2018 October 14, 2018

Many Large Websites Affected by Branch.io XSS Flaw https://www.vpnmentor.com/blog/dom-xss-bug-affecting-tinder-shopify-yelp/ Medtronics Pacemakers Disable Remote Update https://www.medtronic.com/content/dam/medtronic-com/us-en/corporate/documents/REV-Medtronic-2090-Security-Bulletin_FNL.pdf IBM Updates WebSphere Update https://www-01.ibm.com/support/docview.wss?uid=swg22016254 Incomplete JET Database Patch https://blog.0patch.com/2018/10/patching-re-patching-and-meta-patching.html

ISC StormCast for Friday, October 12th 2018 October 11, 2018

New Campaign Using Old Equation Editor Vulnerability https://isc.sans.edu/forums/diary/New+Campaign+Using+Old+Equation+Editor+Vulnerability/24196/ Root Access Vulnerability in SONY Smart TVs https://www.fortinet.com/blog/threat-research/sony-smart-tv-exploit-inside-view-hijacking-your-living-room.html MicroTik RouterOS Vulnerablities https://github.com/tenable/routeros/blob/master/bug_hunting_in_routeros_derbycon_2018.pdf Reverse Analysis of WebAssembly https://www.forcepoint.com/blog/security-labs/manual-reverse-engineering-webassembly-static-code-analysis Firefox Delays Symantec Certificate Distrust https://www.theregister.co.uk/2018/10/11/firefox_symantec_certs_delay/

ISC StormCast for Thursday, October 11th 2018 October 10, 2018

Remote Code Execution Vulnerability in WhatsApp https://bugs.chromium.org/p/project-zero/issues/detail?id=1654 Salesforce Releases hashh Library https://github.com/salesforce/hassh CVE-2018-8453 Details from Kaspersky https://securelist.com/cve-2018-8453-used-in-targeted-attacks/88151/ Juniper Patches https://kb.juniper.net/InfoCenter/index?page=content&channel=SECURITY_ADVISORIES Experian Vulnerability Could Have Leaked Credit Freeze PINs https://www.nerdwallet.com/blog/finance/security-flaw-at-experian-allows-easy-access-to-pin-to-unlock-credit-freeze/

ISC StormCast for Wednesday, October 10th 2018 October 10, 2018

Microsoft Patch Tuesday https://isc.sans.edu/forums/diary/October+2018+Microsoft+Patch+Tuesday/24186/ Adobe Updates https://helpx.adobe.com/security.html Magecart Infects "Shopper Approved" Plugin https://www.riskiq.com/blog/labs/magecart-shopper-approved/

ISC StormCast for Tuesday, October 9th 2018 October 08, 2018

Apple Updates iOS and iCloud for Windows https://support.apple.com/en-ca/HT209162 https://support.apple.com/en-ca/HT209141 Intel Adds Spectre/Meltdown Mitigation to 9th Generation CPUs https://www.bleepingcomputer.com/news/security/spectre-and-meltdown-hardware-protection-added-to-intels-9th-gen-cpus/ Windows October Update File Deleting Issues https://support.microsoft.com/en-us/help/4464619/windows-10-update-history https://blogs.technet.microsoft.com/filecab/2018/08/30/9205/ macOS Code Signing Vulnerabilities https://www.virusbulletin.com/conference/vb2018/abstracts/code-signing-flaw-macos

ISC StormCast for Monday, October 8th 2018 October 07, 2018

WPA2 Karck Attack Update https://www.krackattacks.com/followup.html#overview Cisco Updates https://tools.cisco.com/security/center/publicationListing.x?product=Cisco&sort=-day_sir#~Vulnerabilities Seattle Police Tries to Stop SWATing https://www.seattle.gov/police/need-help/swatting git Vulnerability Fixed https://github.com/timwr/CVE-2017-1000117

ISC StormCast for Friday, October 5th 2018 October 05, 2018

Does the Chinese Military Manipulate Supermicro Motherboards? https://www.bloomberg.com/news/articles/2018-10-04/the-big-hack-amazon-apple-supermicro-and-beijing-respond Cloudflare IPFS Gateway Used For Phishing https://www.bleepingcomputer.com/news/security/phishing-attacks-distributed-through-cloudflares-ipfs-gateway/ DNSSEC Root Key Signing Key Rollover https://www.icann.org/resources/pages/ksk-rollover https://www.icann.org/news/blog/2018-ksk-rollover-operator-preparedness-survey

ISC StormCast for Thursday, October 4th 2018 October 04, 2018

Identifying a Phisher https://isc.sans.edu/forums/diary/Identifying+a+phisher/24164/ Phishing via Azure Blob Storage https://www.netskope.com/blog/phishing-in-the-public-cloud Zoho Domains Used for Phishing and Keyloggers https://cofense.com/staggering-amount-stolen-data-heading-zoho-domains/ Dell iDRAC Exploit https://www.servethehome.com/idracula-vulnerability-impacts-millions-of-legacy-dell-emc-servers/

ISC StormCast for Wednesday, October 3rd 2018 October 03, 2018

How to Write Yara Rules https://isc.sans.edu/forums/diary/Developing+YARA+Rules+a+Practical+Example/24158/ GhostDNS DNS Changer Malware https://blog.netlab.360.com/70-different-types-of-home-routers-all-together-100000-are-being-hijacked-by-ghostdns-en/ Foxit PDF Reader Vulnerabilities https://www.foxitsoftware.com/support/security-bulletins.php Apple Laptops Shipped With CPU in Manufacturing Mode http://blog.ptsecurity.com/2018/10/intel-me-manufacturing-mode-macbook.html

ISC StormCast for Tuesday, October 2nd 2018 October 02, 2018

Update About Facebook Breach https://newsroom.fb.com/news/2018/09/security-update/ Adobe Acrobat/Reader Update https://helpx.adobe.com/security/products/acrobat/apsb18-30.html SMTP MTA Strict Transport Security (MTA-STS) https://www.rfc-editor.org/rfc/rfc8461.txt

ISC StormCast for Monday, October 1st 2018 September 30, 2018

Facebook Leaks more than 50 Million Accounts https://newsroom.fb.com/news/2018/09/security-update/ Telegram Leaks Local IP Address By Default https://www.inputzero.io/2018/09/bug-bounty-telegram-cve-2018-17780.html Site Tricks Users Into Subscribing to Browser Notifications https://www.bleepingcomputer.com/news/security/sites-trick-users-into-subscribing-to-browser-notification-spam/ DDE Code Injection https://isc.sans.edu/forums/diary/More+Excel+DDE+Code+Injection/24150/

ISC StormCast for Friday, September 28th 2018 September 27, 2018

Enriching Radare2 and x64dbg malware analysis with statically decoded strings https://isc.sans.edu/forums/diary/Enriching+Radare2+and+x64dbg+malware+analysis+with+statically+decoded+strings/24146/ Weaknesses in Apple's Mobile Device Management https://duo.com/labs/research/mdm-me-maybe LoJax UEFI Rootkit https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group/

ISC StormCast for Thursday, September 27th 2018 September 27, 2018

Emotet Malware Delivery Service Update https://isc.sans.edu/forums/diary/One+Emotet+infection+leads+to+three+followup+malware+infections/24140/ Fedora Crypto Policy Update Causes SSH Issues https://bugzilla.redhat.com/show_bug.cgi?id=1631970 Android Banking Trojan Impersonates QRecorder https://lukasstefanko.com/2018/09/banking-trojan-found-on-google-play-stole-10000-euros-from-victims.html Google Reverts Changes to Chrome https://www.blog.google/products/chrome/product-updates-based-your-feedback/amp/

Older Entries Newer Entries