News

Exchange E-Discovery Scans https://isc.sans.edu/forums/diary/Scanning+for+Microsoft+Exchange+eDiscovery/27748/ Danabot Distributed Through Malspam https://isc.sans.edu/forums/diary/Example+of+Danabot+distributed+through+malspam/27744/ Weaponizing Middleboxes https://geneva.cs.umd.edu/posts/usenix21-weaponizing-censors/ https://www.usenix.org/conference/usenixsecurity21/presentation/bock Deep Blue Magic Ransomware https://www.ehackingnews.com/2021/08/deepbluemagic-newly-discovered.html

Fans of the Bravo reality show Southern Charm probably already know what happened to our sweet Noami and her relationship with Metul that ended in a very public cheating scandal. But as fans of Noami started to rally to defend her betrayal at the hands of the ex, the social Read More

Print Nightmare Continues: CVE-2021-36958 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36958 Print Nightmare Abused by Ransomware Gangs https://www.crowdstrike.com/blog/magniber-ransomware-caught-using-printnightmare-vulnerability/ PolyNetwork Attack https://www.theregister.com/2021/08/10/poly_networks_cryptocurrency_theft/

You can catch the podcast aired live every Sunday at 7pm EST at https://www.twitch.tv/remnantgamers/You can also view any other scheduled streams or other events going on at our website https://www.remnantgamers.com/Merch:Want a Remnant Gamer Jersey of your own? Head to https://www.remnantgamers.com/copy-of-events and pick out the style that suits you best!You can Read More

In Episode 242, Ben and Scott sit down with Rima Reyes, Principal Program Manager, Microsoft Teams Engineering, to chat about Microsoft Teams, apps across industry clouds, and how to express customer empathy in engineering to build a vibrant partner ecosystem. Sponsors Sperry Software – Powerful Outlook Add-ins developed to make your Read More

TA551 Shathak Continues Pushing BazarLoader Leading to Cobalt Strike https://isc.sans.edu/forums/diary/TA551+Shathak+continues+pushing+BazarLoader+infections+lead+to+Cobalt+Strike/27738/ New AdLoad Campaign Goes Undetected by XProtect https://labs.sentinelone.com/massive-new-adload-campaign-goes-entirely-undetected-by-apples-xprotect/ Android FlyTrap Malware Hitting Facebook Users https://www.ehackingnews.com/2021/08/android-malware-flytrap-hacks-facebook.html 5G Shortcuts allow Evesdropping https://www.wired.com/story/5g-network-stingray-surveillance-non-standalone/ Cloud DNS Service Weeknesses https://www.wiz.io/blog/black-hat-2021-dns-loophole-makes-nation-state-level-spying-as-easy-as-registering-a-domain

Welcome to @PhilTheFilipino's newest series, "My Dark Cryptid Fantasy"! Some of you may be wondering, what the hell is a Cryptid?? Don't worry, we've got you covered. Phil already covers the unknown in terms of the paranormal, aliens, & conspiracy theories. Now he's expanding that library to include creatures that Read More

Microsoft Patches https://isc.sans.edu/forums/diary/Microsoft+August+2021+Patch+Tuesday/27736/ Adobe Patches https://helpx.adobe.com/security.html cPanel/WHM Vulnerabilities https://www.fortbridge.co.uk/research/multiple-vulnerabilities-in-cpanel-whm/ Firefox Update Released https://www.mozilla.org/en-US/firefox/91.0/releasenotes/

Microsoft Exchange ProxyShell https://isc.sans.edu/forums/diary/ProxyShell+how+many+Exchange+servers+are+affected+and+where+are+they/27732/ Synology Warns of Brute Force Attacks https://www.synology.com/en-global/company/news/article/BruteForce/Synology %20Investigates%20Ongoing%20Brute-Force%20Attacks%20From%20Botnet Router Auth Bypass https://threatpost.com/auth-bypass-bug-routers-exploited/168491/ Firefox Version 100 Experiment https://bugzilla.mozilla.org/show_bug.cgi?id=1719070 Interaction Less Vulnerabilities in Messaging Apps https://www.ehackingnews.com/2021/08/the-interaction-less-flaws-in-messaging.html HTTP2 Vulnerabilities https://portswigger.net/research/http2#conclusion

We’ve all been there--we’ve generated a report from a martech tool that makes us look GOOD by showing how many likes and comments the latest Instagram or Linkedin post got. And for a while, the novelty did matter. But as marketing has evolved and buying habits have changed, our education of Read More

We are  back with a new episode from his recurring series "Why you should watch ______ in less than 10 minutes!" and this week, @PhilTheFilipino is taking over to recommend Odd Taxi! Check out why this is one of the best story driven anime available & why you should watch Read More

Malicious Microsoft Word Remains A Key Infection Vector https://isc.sans.edu/forums/diary/Malicious+Microsoft+Word+Remains+A+Key+Infection+Vector/27716/ Malware Bazaar Daily Download https://isc.sans.edu/forums/diary/MALWARE+Bazaar+Download+daily+malware+batches/27728/ Go/Rust IP Address Validation Vulnerability https://github.com/rust-lang/rust/pull/83652 Facial Recognition "Master Keys" https://arxiv.org/pdf/2108.01077.pdf Pulse Secure Patch Bypass https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44858 Hadoop ResourceManager Vulnerability Exploited https://blog.netlab.360.com/wei-xie-kuai-xun-teamtntxin-huo-dong-tong-guo-gan-ran-wang-ye-wen-jian-ti-gao-chuan-bo-neng-li/

When a business decides they need a new website or want to start a new marketing campaign, most marketers will suggest starting with gathering insight from the experts within the company--also known as subject matter experts. But how do you put these SME’s in a position to give you the insight Read More

Cisco Patches Unauthencticated RCE in RV340/345 devices https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv340-cmdinj-rcedos-pY8J3qfy Telegram Flawed Self Destruct in MacOS https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/telegram-self-destruct-not-always/ Significant Vulnerabilities in MacOS Privacy Protections https://www.darkreading.com/application-security/researchers-find-significant-vulnerabilities-in-mac-os-privacy-protections Windows Hello Bypass https://threatpost.com/microsofts-patch-windows-hello-faulty/168392/ STI Student: James Casteel; Content Security Policy Bypass: Exploiting Misconfigurations https://www.sans.org/white-papers/40380

In Episode 241, Ben is on vacation and Scott is on his own, so we're trying a new format offering some quick news and updates around Azure. Please let us know if you like this format and want shorter episodes like this in the future. Sponsors Sperry Software – Powerful Outlook Read More

Pivoting and Hunting for Shenanigans from a Reported Phishing Domain https://isc.sans.edu/forums/diary/Pivoting+and+Hunting+for+Shenanigans+from+a+Reported+Phishing+Domain/27710/ NichStack TCP/IP Vulnerabilities https://jfrog.com/blog/infrahalt-14-new-security-vulnerabilities-found-in-nichestack/ Securing the Cloud https://www.sans.org/newsletters/ouch/securely-using-the-cloud/ Lockbit Recruiting Insiders https://www.bleepingcomputer.com/news/security/lockbit-ransomware-recruiting-insiders-to-breach-corporate-networks/ Sneaky Phishing Hittin Office 365 Users https://www.ehackingnews.com/2021/08/microsoft-warns-office-365-users-of.html

@MrEricAlmighty is swapping places with @PhilTheFilipino on his monthly series titled, "Netflix & Phil"! For these episodes, Phil recommends different shows that you'll find on streaming sites like Netflix, Hulu, Amazon Prime, etc. &  this month, Eric is taking over to talk about a show we have referenced in several Read More

2FA Issues https://isc.sans.edu/forums/diary/Three+Problems+with+Two+Factor+Authentication/27704/ Crazy Smishing https://isc.sans.edu/forums/diary/Is+this+the+Weirdest+Phishing+SMishing+Attempt+Ever/27706/ Google Chrome Update https://chromereleases.googleblog.com/2021/08/the-stable-channel-has-been-updated-to.html https://www.bleepingcomputer.com/news/google/google-chrome-to-no-longer-show-secure-website-indicators/ Google Android Update https://source.android.com/security/bulletin/2021-08-01?hl=en DoD/NSA Publichses Kubernetes Hardening Guides https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/1/CTR_KUBERNETES%20HARDENING%20GUIDANCE.PDF

During our Great Resignation episode, I discussed new research indicating the non-monetary reasons employees were and still are redefining their work experience.  This shift in mindset towards a greater work/life balance is driving companies to finally become flexible with their employment requirements including where and how often to work. So who Read More

Unsolicited DNS Queries https://isc.sans.edu/forums/diary/Unsolicited+DNS+Queries/27694/ Changing BAT Files on the Fly https://isc.sans.edu/forums/diary/Changing+BAT+Files+On+The+Fly/27700/ Empty NPM Package has Over 700,000 Downloads https://www.bleepingcomputer.com/news/software/empty-npm-package-has-over-700-000-downloads-heres-why/ Blocking PetitPotam with netsh RPC Filters https://twitter.com/gentilkiwi/status/1421949715986403329 Pneumatic Tube Vulnerabilities https://www.blackhat.com/us-21/briefings/schedule/index.html#a-hole-in-the-tube-uncovering-vulnerabilities-in-critical-infrastructure-of-healthcare-facilities-23546