News

Microsoft Patch Tuesday https://isc.sans.edu/forums/diary/Microsoft+April+2020+Patch+Tuesday/26022/ Adobe Security Bulletins https://helpx.adobe.com/security.html Microsoft Extending EOL For Windows 10 1709/1809 https://support.microsoft.com/en-us/help/4557164/lifecycle-changes-to-end-of-support-and-servicing-dates Dell Safe BIOS https://blog.dellemc.com/en-us/dell-technologies-bolsters-pc-security-todays-remote-workers/

Comparing the same Phishing Campaign 3 Months Appart https://isc.sans.edu/forums/diary/Look+at+the+same+phishing+campaign+3+months+apart/26018/ Setting 3D Printers On Fire https://www.coalfire.com/The-Coalfire-Blog/April-2020/With-IoT-Common-Devices-Pose-New-Threats Junos OS: vMX Default Credentials https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10998 DNS is Changing: So What? (@Mic Webinar) https://www.sans.org/webcasts/113635

Dynamic Analysis Technique to Get Decrypted KPOT Malware https://isc.sans.edu/forums/diary/Reader+Analysis+Dynamic+analysis+technique+to+get+decrypted+KPOT+Malware/26010/ VMWare vCenter Server Vulnerability https://www.vmware.com/security/advisories/VMSA-2020-0006.html Sodinokibi Ransomware Switching to Monero https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-to-stop-taking-bitcoin-to-hide-money-trail/ Malware Impersonates Security Researchers https://www.bleepingcomputer.com/news/security/new-wiper-malware-impersonates-security-researchers-as-prank/

Spoofing OS Fingerprints https://isc.sans.edu/forums/diary/Performing+deception+to+OS+Fingerprint+Part+1+nmap/25960/ Dell iDRAC Patch https://www.dell.com/support/article/de-de/sln320717/dsa-2020-063-idrac-buffer-overflow-vulnerability?lang=en VISA Ends Magento 1 Support https://usa.visa.com/content/dam/VCOM/global/support-legal/documents/acquirer-advisory-magento-migration.pdf Slack WebRTC TURN Compromise https://www.rtcsec.com/2020/04/01-slack-webrtc-turn-compromise/ COVID 19 Domain Classifier https://isc.sans.edu/covidclassifier.html

In Episode 172, Ben and Scott break down some announced changes around the rebranding of several Office 365 for Business SKUs to Microsoft 365. Sponsors ShareGate – ShareGate’s industry-leading products help IT professionals worldwide migrate their business to the Office 365 or SharePoint, automate their Office 365 governance, and understand their Read More

German Malspam Pushes ZLoader Malware; Decrypting HTTPs https://isc.sans.edu/forums/diary/German+malspam+pushes+ZLoader+malware/25996/ Microsoft Purchases Corp.com https://krebsonsecurity.com/2020/04/microsoft-buys-corp-com-so-bad-guys-cant/ Microsoft Delaying Removal of Basic Authentiation from Exchange Online https://techcommunity.microsoft.com/t5/exchange-team-blog/basic-authentication-and-exchange-online-april-2020-update/ba-p/1275508 Dark Nexus Botnet https://www.bitdefender.com/files/News/CaseStudies/study/319/Bitdefender-PR-Whitepaper-DarkNexus-creat4349-en-EN-interactive.pdf

@MrEricAlmighty is back on this Wait For It Wednesday to talk about the second half of My Hero Academia Season 4. The Remedial and U.A. School Festival arcs seemed like they would be just be filler episodes, but we got so much more than that, including a season finale that Read More

RDP Scanning Increase https://isc.sans.edu/forums/diary/Increase+in+RDP+Scanning/25994/ Atlassian Advices Users To Secure Jira Service Desk https://community.atlassian.com/t5/Jira-Service-Desk-articles/Tips-for-setting-customer-permissions-in-Jira-Service-Desk/ba-p/1340617 Android Updates https://support.google.com/pixelphone/thread/38337876

ROSTELECOM Reroutes Traffic for Multiple Cloud Providers https://twitter.com/bgpmon/status/1246842916502302723 https://bgpstream.com/event/230837 Vuln Cost Security Scanner for VS Code https://snyk.io/security-scanner-vuln-cost/ Microsoft Exchange Server Vulnerability still not Patched https://blog.rapid7.com/2020/04/06/phishing-for-system-on-microsoft-exchange-cve-2020-0688/ Fake Zoom Installer https://blog.trendmicro.com/trendlabs-security-intelligence/zoomed-in-a-look-into-a-coinminer-bundled-with-zoom-installer/

New Bypass Technique or Corrupt Word Document https://isc.sans.edu/forums/diary/New+Bypass+Technique+or+Corrupt+Word+Document/25984/ CitizenLab Analyzes Zoom Encryption https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/ https://www.sans.org/webcasts/zomg-its-zoom-114670 Mozilla Patches Critical Firefox Flaws https://www.mozilla.org/en-US/security/advisories/mfsa2020-11/ Malicious JavaScript injected into Discord https://www.bleepingcomputer.com/news/security/discord-turned-into-an-account-stealer-by-updated-malware/

Twitter Cache Bug in Firefox https://privacy.twitter.com/en/blog/2020/data-cache-firefox MS-SQL Server Attack https://www.guardicore.com/2020/04/vollgar-ms-sql-servers-under-attack/ More Zoom Vulnerabilities https://objective-see.com/blog/blog_0x56.html Covid-19 Economic Impact Payments Scams https://www.justice.gov/usao-edky/press-release/file/1265371/download Safari Camera Access Bug https://www.ryanpickren.com/webcam-hacking-overview

In Episode 171, Ben and Scott are joined by Sarah Lean, Microsoft Cloud Advocate, to talk about working from home and some ways to adapt to remote presentations. Sponsors Sperry Software – Powerful Outlook Add-ins developed to make your email life easy even if you’re too busy to manage your inbox Read More

Quakbot Malspam Sent From an Infected Windows Host https://isc.sans.edu/forums/diary/Qakbot+malspam+sent+from+an+infected+Windows+host/25972/ TPOT Cowrie to ISC Logs https://isc.sans.edu/forums/diary/TPOTs+Cowrie+to+ISC+Logs/25976/ SSH Issues After MacOS Update https://feed.tyler.io/so-uh-i-think-catalina-10154-broke-ssh/ Cloudflare DNS For Families https://blog.cloudflare.com/introducing-1-1-1-1-for-families/ Zoom Leaks Windows Password Hashes via UNC Links https://twitter.com/hackerfantastic/status/1245133371262619654

@MrEricAlmighty is back with an all new episode on his recurring series "Why you should watch ______ in 10 minutes!", and this week, we talk about Cells At Work. Find out what the show's strengths are, what it's all about, and why you should find the time to watch it! 🔻BACKGROUND Read More

Kwampirs Update https://isc.sans.edu/forums/diary/Kwampirs+Targeted+Attacks+Involving+Healthcare+Sector/25968/ Exposed RDP https://blog.shodan.io/trends-in-internet-exposure/ D-Link DSL-2640B Vulnerability https://raelize.com/posts/d-link-dsl-2640b-security-advisories/ SMB 3.1.1 (CVE-2020-0796) Local Privilege Escalation Exploit https://github.com/danigargu/CVE-2020-0796

Crashing Windows Explorer Without a Click https://isc.sans.edu/forums/diary/Crashing+explorerexe+without+a+click/25966/ Zoom Privacy Policy https://blogs.harvard.edu/doc/2020/03/27/zoom/ Zoom Bombing https://www.fbi.gov/contact-us/field-offices/boston/news/press-releases/fbi-warns-of-teleconferencing-and-online-classroom-hijacking-during-covid-19-pandemic Zoom Related Domains Used for Phishing https://blog.checkpoint.com/2020/03/30/covid-19-impact-cyber-criminals-target-zoom-domains/

Covid19 Domain Classifier https://isc.sans.edu/covidclassifier.html https://www.youtube.com/watch?v=yNIlyJ3gI-4 Attackers Mail Malicious USB Drives and Teddy Bears https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/would-you-exchange-your-security-for-a-gift-card/ HongKong News Sites Used to Install Malware on iOS Devices https://blog.trendmicro.com/trendlabs-security-intelligence/operation-poisoned-news-hong-kong-users-targeted-with-mobile-malware-via-local-news-links/

Very Large Sample as an Obfuscation Technique https://isc.sans.edu/forums/diary/Very+Large+Sample+as+Evasion+Technique/25948/ iOS VPN Bypass https://protonvpn.com/blog/apple-ios-vulnerability-disclosure/ Free Covid19 Domain List https://www.domaintools.com/resources/blog/free-covid-19-threat-list-domain-risk-assessments-for-coronavirus-threats Linux Rubber Ducky Protection https://opensource.googleblog.com/2020/03/usb-keystroke-injection-protection.html

In Episode 170, Ben and Scott are joined by Alex Neihaus to talk about Azure Resource Manager Templates, PowerShell, and the Azure CLI. Sponsors ShareGate - ShareGate's industry-leading products help IT professionals worldwide migrate their business to the Office 365 or SharePoint, automate their Office 365 governance, and understand their Read More

Dridex Update https://isc.sans.edu/forums/diary/Recent+Dridex+activity/25944/ Covid-19 Ransom https://twitter.com/johullrich/status/1242983197555789824 HP Enterprise SSD Firmware Bug https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=a00097382en_us Fake Google Chrome Update https://news.drweb.com/show/?i=13746&lng=en TrickBot Pushing a 2FA Bypass App in Germany https://securityintelligence.com/posts/trickbot-pushing-a-2fa-bypass-app-to-bank-customers-in-germany/