News

@PhilTheFilipino is putting his tin foil hat back on for a brand new episode of the PHILuminati series! This week he covers a popular internet theory about singer Avril Lavigne, along with a few other celebrities who have supposedly been replaced or cloned. 🔻BACKGROUND MUSIC PROVIDED BY:Check out the full Read More

Updated Microsoft Advisory 200006 https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/adv200006 Memcached Denial of Service Vulnerability https://github.com/memcached/memcached/issues/629 Adobe Creative Cloud Desktop Application Patches https://helpx.adobe.com/security/products/creative-cloud/apsb20-11.html Microsoft Pausing Cumulative Updates Starting May https://docs.microsoft.com/en-us/windows/release-information/windows-message-center#405 Apple Security Patches https://support.apple.com/en-us/HT201222 OpenWRT Vulnerability Fixed https://thehackernews.com/2020/03/openwrt-rce-vulnerability.html

Windows Font Parsing 0-Day https://isc.sans.edu/forums/diary/Windows+Zeroday+Actively+Exploited+Type+1+Font+Parsing+Remote+Code+Execution+Vulnerability/25936/ Covid-19 Malware Summary https://github.com/parthdmaniar/coronavirus-covid-19-SARS-CoV-2-IoCs Firefox Turns TLS 1.0/1.1 Back on https://www.mozilla.org/en-US/firefox/74.0/releasenotes/

More Covid19 Malware https://isc.sans.edu/forums/diary/More+COVID19+Themed+Malware/25930/ Working Exploit for the Kr00k Wifi Exploit https://hexway.io/research/r00kie-kr00kie/ ZDI Pwn2Own Results https://www.zerodayinitiative.com/blog/2020/3/17/welcome-to-pwn2own-2020-the-schedule-and-live-results

COVID-19 Themed Multistage Malware https://isc.sans.edu/forums/diary/COVID19+Themed+Multistage+Malware/25922/ Cisco SD-WAN Patches https://tools.cisco.com/security/center/publicationListing.x oPatch Selling Patches for Windows 7 https://twitter.com/0patch/status/1240602635205586945 LDAPFragger: Bypassing network restrictions using LDAP attributes https://research.nccgroup.com/2020/03/19/ldapfragger-bypassing-network-restrictions-using-ldap-attributes/

In Episode 169, Ben and Scott take a break from the cloud and talk about the current situation with COVID-19 and how it's impacting many of us with work from home policies that have been put in place to maintain social distancing. Sponsors ShareGate - ShareGate's industry-leading products help IT Read More

TrendMicro Update https://success.trendmicro.com/solution/000245571 More VMWare Updates https://www.vmware.com/security/advisories/VMSA-2020-0005.html EnigmaSpark Malware https://securityintelligence.com/posts/EnigmaSpark-Politically-Themed-Cyber-Activity-Highlights-Regional-Opposition-to-Middle-East-Peace-Plan/ Recent Ransomware Trends https://www.fireeye.com/blog/threat-research/2020/03/they-come-in-the-night-ransomware-deployment-trends.html

@MrEricAlmighty is back with an all new episode on his recurring series "Why you should watch ______ in 10 minutes!", and this week, we talk about Fire Force. Find out what the show's strengths are, what it's all about, and why you should find the time to watch it! 🔻BACKGROUND MUSIC Read More

A Quick Summary of Current Reflective DNS DDoS Attacks https://isc.sans.edu/forums/diary/A+Quick+Summary+of+Current+Reflective+DNS+DDoS+Attacks/25916/ Trickbot gtag red5 distributed as DLL File https://isc.sans.edu/forums/diary/Trickbot+gtag+red5+distributed+as+a+DLL+file/25918/ Is Cryptojacking Dead after Coinhive Shutdown https://arxiv.org/pdf/2001.02975.pdf Adobe Patches https://helpx.adobe.com/security/products/acrobat/apsb20-13.html

Desktop.ini as a post-exploitation tool https://isc.sans.edu/forums/diary/Desktopini+as+a+postexploitation+tool/25912/ VMWAre Workstatation/Fusion Update https://www.vmware.com/security/advisories/VMSA-2020-0004.html Blackwater Malware Abuses Cloudflare Workers https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ tcpdump Heap Based Buffer Over-Read https://nvd.nist.gov/vuln/detail/CVE-2018-19325 Slack Account Takevoer Bug https://hackerone.com/reports/737140

Phishing PDFs With Incremental Updates https://isc.sans.edu/forums/diary/Phishing+PDF+With+Incremental+Updates/25904/ VPN Access and Active Monitoring https://isc.sans.edu/forums/diary/VPN+Access+and+Activity+Monitoring/25906/ Capturing Invalid Ethernet Frames https://isc.sans.edu/forums/diary/Not+all+Ethernet+NICs+are+Created+Equal+Trying+to+Capture+Invalid+Ethernet+Frames/25896/ Cookiethief Android Cookie Stealing Malware https://securelist.com/cookiethief/96332/ SANS Security Awareness Deployment Kit for Securing Your Workforce at Home https://www.sans.org/webcasts/113875

Microsoft Releases Patch for Windows SMBv3 Compression Vulnerability CVE-2020-0796 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796 Hancitor Distributed Through Coronavirus-Themed Malspam https://isc.sans.edu/forums/diary/Hancitor+distributed+through+coronavirusthemed+malspam/25892/ Avast Removes Vulnerable JavaScript Emulator From Products https://github.com/taviso/avscript Checkra1n Exploit Works Against T2 Equipped Macs https://www.idownloadblog.com/2020/03/10/luca-todesco-teases-checkra1n-hacks-on-a-t2-equipped-macbook-pros-touch-bar/

In Episode 168, Ben and Scott come to you live from Collab365 GlobalCon1 (well, really the comfort of their homes) and talk about Universal Print coming to Azure, the announcement that org-wide teams are coming to Office 365 for tenants with less than 5,000 users, and the GA of PowerShell Read More

Mystery SMB3 Flaw Update https://isc.sans.edu/forums/diary/Critical+SMBv3+Vulnerability+Remote+Code+Execution/25890/ COVID19 Malware https://blog.reasonsecurity.com/2020/03/09/covid-19-info-stealer-the-map-of-threats-threat-analysis-report/ Agent Tesla Spread by Fake Canon EOS Notification Email https://isc.sans.edu/forums/diary/Agent+Tesla+Delivered+via+Fake+Canon+EOS+Notification+on+Free+OwnCloud+Account/25884/

Happy Wait For It Wednesday, everyone! This week @MrEricAlmighty & @PhilTheFilipino teamed up to discuss where it all began. The controversial Disney Bracket! This is the idea that got the podcast started & was a really fun launching point for us. Those of you who weren’t around in the beginning Read More

Microsoft Patch Tuesday https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200005 https://isc.sans.edu/diary.html?storyid=25886

Malicious Spreadsheet With Data Connection and Excel 4 Macros https://isc.sans.edu/forums/diary/Malicious+Spreadsheet+With+Data+Connection+and+Excel+4+Macros/25880/ Take a Way: Exploring the Security Implications of AMD's Cache Way Predictors https://mlq.me/download/takeaway.pdf https://www.amd.com/en/corporate/product-security Google Play Store Protect Fails Security Test https://www.av-test.org/en/news/here-s-how-well-17-android-security-apps-provide-protection/

Excel Maldocs: Hidden Sheets https://isc.sans.edu/forums/diary/Excel+Maldocs+Hidden+Sheets/25876/ Wireshark 3.2.2. Released https://www.wireshark.org/docs/relnotes/wireshark-3.2.2.html Linux PPP Vulnerability https://www.kb.cert.org/vuls/id/782301/ NordVPN Vulnerablity https://www.theregister.co.uk/2020/03/06/nordvpn_no_auth_needed_view_user_payments/ Unpatched Android Devices https://www.which.co.uk/news/2020/03/more-than-one-billion-android-devices-at-risk-of-malware-threats/

Survey Phish https://isc.sans.edu/forums/diary/Will+You+Put+Your+Password+in+a+Survey/25866/ Healthcare.gov Sending E-Mail Looking Like Phishing https://twitter.com/johullrich/status/1235740586717720577 Intel x86 Root of Trust: Loss of Trust https://blog.ptsecurity.com/2020/03/intelx86-root-of-trust-loss-of-trust.html Let's Encrypt Revises Revokation Plan https://community.letsencrypt.org/t/2020-02-29-caa-rechecking-bug/114591/2 Trust Me, I'm Certified Podcast https://www.giac.org/podcasts

In Episode 167, Ben and Scott discuss some updates that allow you to deploy resources in Azure to scopes above a resource group and then break down some big changes coming to the Azure certifications. Sponsors ShareGate – ShareGate’s industry-leading products help IT professionals worldwide migrate their business to the Office Read More