SANS Daily Stormcast

Digital Dispatch Podcast Podcast Artwork Image

Johannes Ullrich

A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter.

Contact Show

Recent Episodes

ISC StormCast for Thursday, February 1st 2018 January 31, 2018

Tax Phishing Season Starts https://isc.sans.edu/forums/diary/Tax+Phishing+Time/23295/ Using FLIR In Incident Response https://isc.sans.edu/forums/diary/Using+FLIR+in+Incident+Response/23291/ Oracle MICROS POS Vulnerability https://erpscan.com/press-center/blog/oracle-micros-pos-breached/

ISC StormCast for Wednesday, January 31st 2018 January 30, 2018

DCShadow Attack https://www.dropbox.com/s/baypdb6glmvp0j9/Buehat%20IL%20v2.3.pdf https://blog.alsid.eu/dcshadow-explained-4510f52fc19d Cisco WebVPN Update https://isc.sans.edu/forums/diary/Cisco+ASA+WebVPN+Vulnerability/23289/ Reviving DDE Code Execution via OneNote https://posts.specterops.io/reviving-dde-using-onenote-and-excel-for-code-execution-d7226864caee

ISC StormCast for Tuesday, January 30th 2018 January 29, 2018

Lenovo Fingerprint Mananger Pro Vulnerability https://support.lenovo.com/us/en/product_security/len-15999 ClamAV Vulnerablities http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html https://blog.malwarebytes.com/malwarebytes-news/2018/01/important-web-blocking-ram-usage/ Malwarebytes Corrupted Update https://www.malwarebytes.com/pdf/WebProtectionFP.pdf Cisco Adaptive Security Appliance Remote Code Execution Vulnerability https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1 Web2Top Proxy onion.tor Appears to Steal Ransomware Payments https://www.proofpoint.com/us/threat-insight/post/double-dipping-diverting-ransomware-bitcoin-payments-onion-domains

ISC StormCast for Monday, January 29th 2018 January 28, 2018

Analyzing a Word Document Used in a Pentest https://isc.sans.edu/forums/diary/Is+this+a+pentest/23283/ Analyzing BITS Activity https://isc.sans.edu/forums/diary/Investigating+Microsoft+BITS+Activity/23281/ CryptoJacking on YouTube due to Malicious Ads https://blog.trendmicro.com/trendlabs-security-intelligence/malvertising-campaign-abuses-googles-doubleclick-to-deliver-cryptocurrency-miners/ Coincheck Hack Nets 400M USD https://coincheck.com/en/blog/4673 PHPBB Mirror Compromissed https://www.phpbb.com/community/viewtopic.php?f=14&t=2456896 Microsoft Disables Sepctre Variant 2 Patches https://support.microsoft.com/en-us/help/4078130/update-to-disable-mitigation-against-spectre-variant-2

ISC StormCast for Friday, January 26th 2018 January 25, 2018

Ransomware As a Service https://isc.sans.edu/forums/diary/Ransomware+as+a+Service/23277/ libcurl Vulnerability http://seclists.org/oss-sec/2018/q1/94 Hide 'N Seek IoT Botnet https://labs.bitdefender.com/2018/01/new-hide-n-seek-iot-botnet-using-custom-built-peer-to-peer-communication-spotted-in-the-wild/ Container Intrusions: Assessing the Efficacy of Intrusion Detection and Analysis Methods for Linux Container Environments https://www.sans.org/reading-room/whitepapers/detection/container-intrusions-assessing-efficacy-intrusion-detection-analysis-methods-linux-container-environments-38245

ISC StormCast for Thursday, January 25th 2018 January 24, 2018

RTF Files For Hancitor Utilize Exploit for CVE-2017-11882 https://isc.sans.edu/forums/diary/RTF+files+for+Hancitor+utilize+exploit+for+CVE201711882/23271/ Electron Fixes Protocol Handlers Flaw https://electronjs.org/blog/protocol-handler-fix Xerox Workcenters Fudge Numbers http://www.dkriesel.com/en/blog/2013/0802_xerox-workcentres_are_switching_written_numbers_when_scanning? Tracking Users Using CSS https://github.com/jbtronics/CrookedStyleSheets

ISC StormCast for Wednesday, January 24th 2018 January 23, 2018

Apple Patches Everything, Again https://isc.sans.edu/forums/diary/Apple+Updates+Everything+Again/23269/ OpenSSL Introduces its Version of a "Patch Tuesday" https://www.openssl.org/blog/blog/2018/01/18/f2f-london/ "Rapid" Ransomware https://id-ransomware.blogspot.ru/2018/01/rapid-ransomware.html (Russian) https://www.bleepingcomputer.com/forums/t/667032/rapid-ransomware-rapid-paymeme-how-recovery-filestxt-support-topic/page-2

ISC StormCast for Tuesday, January 23rd 2018 January 22, 2018

HTTPs on Every Port https://isc.sans.edu/forums/diary/HTTPS+on+every+port/23261/ Curl over TOR https://isc.sans.edu/forums/diary/Retrieving+malware+over+Tor/23257/ Spectre/Meltdown Microcode Patch Problems https://newsroom.intel.com/news/root-cause-of-reboot-issue-identified-updated-guidance-for-customers-and-partners/ https://lkml.org/lkml/2018/1/21/192 DNS Rebinding Attacks Against Geth https://ret2got.wordpress.com/2018/01/19/how-your-ethereum-can-be-stolen-using-dns-rebinding/ Chinese Quantum Cryptography Satellite Link Transmits Intercontinental Videolink https://journals.aps.org/prl/abstract/10.1103/PhysRevLett.120.030501

ISC StormCast for Monday, January 22nd 2018 January 21, 2018

Analyzing an RTF Phishing Document https://isc.sans.edu/forums/diary/An+RTF+phish/23255/ Satori Variant Steals ETH from Miners http://blog.netlab.360.com/art-of-steal-satori-variant-is-robbing-eth-bitcoin-by-replacing-wallet-address-en/ Evrial Trojan Modifies Copy / Pasted Bitcoin Addresses https://twitter.com/malwrhunterteam/status/953313514629853184 Legal Challenges of Bug Bounties https://www.heise.de/security/meldung/US-Bug-Bountys-lassen-gute-Hacker-in-die-Falle-tappen-3946508.html

ISC StormCast for Friday, January 19th 2018 January 18, 2018

Oracle E-Business Suite Server Can Be Attackt via WebLogic https://www.onapsis.com/blog/oracle-january-cpu-analysis-64-patches-affect-business-critical-applications Microsoft Resumes Patches for AMD Systems https://www.amd.com/en/corporate/speculative-execution Speculations About Yet Another CPU Attack https://skyfallattack.com Smiths Medfusion 4000 Vulnerabilities https://github.com/sgayou/medfusion-4000-research/blob/master/doc/README.md#summary

ISC StormCast for Thursday, January 18th 2018 January 17, 2018

Reviewing the Spam Filters: Malspam Pushing Gozi-ISFB https://isc.sans.edu/forums/diary/Reviewing+the+spam+filters+Malspam+pushing+GoziISFB/23245/ Auditing Secure USB Keys https://www.j-michel.org/blog/2018/01/16/attacking-secure-usb-keys-behind-the-scene Malicious Open Graph title Tag Crashes iMessage https://www.macrumors.com/2018/01/16/malicious-link-ios-mac-freezes/ BIND Fixes DoS Vulnerablity https://kb.isc.org/article/AA-01542

ISC StormCast for Tuesday, January 9th 2018 January 08, 2018

WebLogic Flaw Used to Install Monero Crypto Coin Miner https://isc.sans.edu/forums/diary/Campaign+is+using+a+recently+released+WebLogic+exploit+to+deploy+a+Monero+miner/23191/ Fake Anti-Virus Pages Poppding Up Like Weeds https://isc.sans.edu/forums/diary/Fake+antivirus+pages+popping+up+like+weeds/23207/ Apple Spectre/Meltdown Patches https://support.apple.com/en-us/HT201222 Meltdown Patch Fallout https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB43600/?l=en_US&fs=Search&pn=1&atype= https://forums.sandboxie.com/phpBB3/viewtopic.php?t=25114 https://support.microsoft.com/en-us/help/4072699/january-3-2018-windows-security-updates-and-antivirus-software WPA3 Announced https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-security-enhancements

ISC StormCast for Monday, January 8th 2018 January 07, 2018

Campaign is using a recently released WebLogic exploit to deploy a Monero miner https://isc.sans.edu/forums/diary/Campaign+is+using+a+recently+released+WebLogic+exploit+to+deploy+a+Monero+miner/23191/ Misc News about Meltdown and Spectre https://www.qualcomm.com/company/product-security/bulletins AMD Processor Flaw http://seclists.org/fulldisclosure/2018/Jan/12 Western Digital MyCloud Backdoor http://gulftech.org/advisories/WDMyCloud%20Multiple%20Vulnerabilities/125

ISC StormCast for Friday, January 5th 2018 January 04, 2018

SANS Special Webcast https://www.sans.org/webcast/recording/citrix/106815/138095 ISC Diary with Links to Patches https://isc.sans.edu/forums/diary/Spectre+and+Meltdown+What+You+Need+to+Know+Right+Now/23193/

ISC StormCast for Thursday, January 4th 2018 January 03, 2018

Intel CPU Vulnerablity https://meltdownattack.com Crypto Coin Mining Pool IP List https://isc.sans.edu/api/threatlist/miner Phishing to Rural America Leads to Six-figure Wire Fraud Losses https://isc.sans.edu/forums/diary/Phishing+to+Rural+America+Leads+to+Sixfigure+Wire+Fraud+Losses/23185/

ISC StormCast for Wednesday, January 3rd 2018 January 02, 2018

Extracting URLs From PDFs https://isc.sans.edu/forums/diary/PDF+documents+URLs+update/23167/ Priviledge Escalation Exploit for macOS https://siguza.github.io/IOHIDeous/ 34C3: Chaos Communications Congress https://media.ccc.de/c/34c3 Vulnerabilities in Online Geolocation Services https://0x0.li/trackmageddon/

ISC StormCast for Tuesday, January 2nd 2018 January 01, 2018

Analyzing TNEF Files https://isc.sans.edu/forums/diary/Analyzing+TNEF+files/23175/ Obfuscated RTF Files https://isc.sans.edu/forums/diary/Dealing+with+obfuscated+RTF+files/23169/ 2017 Flood of CVEs https://isc.sans.edu/forums/diary/2017+The+Flood+of+CVEs/23173/ Sonos/Bose Smart Speaker Flaws https://documents.trendmicro.com/assets/pdf/The-Sound-of-a-Targeted-Attack.pdf Web Trackers Exploit Login Managers https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-user-identities-web-trackers-exploit-browser-login-managers/ Backdoored Wordpress Plugins https://www.bleepingcomputer.com/news/security/three-more-wordpress-plugins-found-hiding-a-backdoor/

ISC StormCast for Friday, December 22nd 2017 December 21, 2017

Critical Flaw in SMBv1 Implementation of Dell EMC Data Domain DD OS http://seclists.org/fulldisclosure/2017/Dec/79 Facebook Enables Feature To Review All E-Mails Sent By Facebook https://www.facebook.com/notes/facebook-security/new-security-feature-reveals-if-facebook-mails-are-legit/10154983636230766/ EtherDelta DNS Attack https://twitter.com/etherdelta Enigmail Vulnerability https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf

ISC StormCast for Thursday, December 21st 2017 December 20, 2017

Kernel Hooking Basics https://isc.sans.edu/forums/diary/Guest+Diary+Etay+Nir+Kernel+Hooking+Basics/23155/ Intel Memory Encryption https://software.intel.com/sites/default/files/managed/a5/16/Multi-Key-Total-Memory-Encryption-Spec.pdf https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=33e63acc119d15c2fac3e3775f32d1ce7a01021b WordPress Sites Infected with Monero Miners https://www.wordfence.com/blog/2017/12/aggressive-brute-force-wordpress-attack/

ISC StormCast for Wednesday, December 20th 2017 December 19, 2017

Example of "MouseOver" Link in a Powerpoint File https://isc.sans.edu/forums/diary/Example+of+MouseOver+Link+in+a+Powerpoint+File/23149/ Adups Malware Still Haunting Android Phones https://blog.malwarebytes.com/cybercrime/2017/12/mobile-menace-monday-upping-the-ante-on-adups-fwupgradeprovider/ Popular Wordpress Captcha Included Backdoor https://www.wordfence.com/blog/2017/12/backdoor-captcha-plugin/ Comparing DNS Filters https://medium.com/@nykolas.z/dns-security-filters-compared-quad9-x-opendns-x-comodo-secure-x-norton-connectsafe-x-yandex-safe-a00ace3bf21f

Older Entries Newer Entries