News

It only cost Disney $71.3 billion to bring some of their most important characters back home. @PhilTheFilipino & @MrEricAlmighty are back together again & they're going to discuss which of Marvel's newly reacquired heroes they want to see in Phase 5 & beyond. Who do you guys want to see Read More

Google Photo Cross-Site-Leak Exposes Picture Meta Data https://www.imperva.com/blog/now-patched-google-photos-vulnerability-let-hackers-track-your-friends-and-location-history/ Fake CDC EMails Spread GandCrab Ransomware https://myonlinesecurity.co.uk/fake-cdc-flu-pandemic-warning-delivers-gandcrab-5-2-ransomware/ Atlassian Sourcetree Vulnerability https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2019-03-06-966678691.html Microsoft Defender for MacOS https://www.theregister.co.uk/2019/03/21/microsoft_defender_atp/

Ben and Scott dive into a set of listener questions about Azure subscription and resource governance.

Using Active Directory (AD) To Find Hosts That Are Not in AD https://isc.sans.edu/forums/diary/Using+AD+to+find+hosts+that+arent+in+AD+fun+with+the+IPAddress+construct/24762/ Microsoft Anti Malware Crashing Windows https://social.technet.microsoft.com/Forums/en-US/18ab60a3-3b26-4a07-b68d-84085ce66ce5/scep-crashing-pcs?forum=ConfigMgrCompliance&prof=required Reduction in DDoS Attacks https://www.nexusguard.com/threat-report-q4-2018

@PhilTheFilipino is here with his first conspiracy theory episode about "The Unsinkable Ship", The Titanic. Was one of the worst disasters in modern history just an insurance scam gone horribly, horribly wrong? What do you guys think actually happened? Is the truth right on the surface, or has it sunk Read More

Putty Updates https://www.chiark.greenend.org.uk/~sgtatham/putty/ Fujitsu Wireless Keyboard Vulnerabilities https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-033.txt Signed Malware Goes Undetected https://twitter.com/malwrhunterteam/status/1104082562216062978/photo/1?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1104082562216062978&ref_url=https%3A%2F%2Fwww.theregister.co.uk%2F2019%2F03%2F18%2Fsecurity_roundup_150319%2F Free Support for Ubuntu 14.04 LTS Ends in April https://lists.ubuntu.com/archives/ubuntu-announce/2019-March/000241.html Latest Mirai Version with Even More Exploits https://unit42.paloaltonetworks.com/new-mirai-variant-targets-enterprise-wireless-presentation-display-systems/

Binary Analysis With Jupyter and Radare2 https://isc.sans.edu/forums/diary/Binary+Analysis+with+Jupyter+and+Radare2/24748/ IMAP Brute Forcing against Cloud Accounts https://www.proofpoint.com/us/threat-insight/post/threat-actors-leverage-credential-dumps-phishing-and-legacy-email-protocols Google Allows GSuite Users to Disable SMS/Voice Authentication https://gsuiteupdates.googleblog.com/2019/03/more-control-over-2-step-verification-security-phone-sms.html Sniffing Bitlocker Keys from TPM https://pulsesecurity.co.nz/articles/TPM-sniffing

Analyzing ZIP Files in Ghydra https://isc.sans.edu/forums/diary/Tip+Ghidra+ZIP+Files/24732/ 64 Bit Certificate Serial Number Revocation https://adamcaudill.com/2019/03/09/tls-64bit-ish-serial-numbers-mass-revocation/ Cisco Default Account Problem https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190313-cspcscv Intel Patches https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00185.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00191.html

Ben and Scott dive into Azure Sentinel, a new cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution from Microsoft.

Microsoft Patch Tuesday https://isc.sans.edu/forums/diary/Microsoft+March+2019+Patch+Tuesday/24742/ Adobe Updates https://helpx.adobe.com/security.html PSMiner https://blog.360totalsecurity.com/en/new-mining-worm-psminer-uses-multiple-high-risk-vulnerabilities-to-spread/ Automatic Certificate Managment Environment https://tools.ietf.org/html/rfc8555

DevOps Tool StackStorm Vulnerability https://quitten.github.io/StackStorm/ Developers Will Not Code Secure By Default https://net.cs.uni-bonn.de/fileadmin/user_upload/naiakshi/Naiakshina_Password_Study.pdf Gaming Industry Supply Chain Attack https://www.welivesecurity.com/2019/03/11/gaming-industry-scope-attackers-asia/

Reversing HTA Files https://isc.sans.edu/forums/diary/Quick+and+Dirty+Malicious+HTA+Analysis/24728/ Apache SOLR Patch https://issues.apache.org/jira/browse/SOLR-13301 Windows 7 + Google Chrome Exploit in the Wild https://security.googleblog.com/2019/03/disclosing-vulnerabilities-to-protect.html Vulnerable Car Alarms https://www.pentestpartners.com/security-blog/gone-in-six-seconds-exploiting-car-alarms/

RSA Panel Video https://www.rsaconference.com/videos/the-five-most-dangerous-new-attack-techniques-and-how-to-counter-them Disposable E-Mail Addresses https://isc.sans.edu/forums/diary/Keep+an+Eye+on+Disposable+Email+Addresses/24716/ NetApp Default Account Vulnerability https://security.netapp.com/advisory/ntap-20190305-0001/ Cisco NS-OS NX-API Privilege Escalation https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-NXAPI-cmdinj Slub Backdoor Users GitHub and Slack https://blog.trendmicro.com/trendlabs-security-intelligence/new-slub-backdoor-uses-github-communicates-via-slack/

Ben and Scott start their day trying to understand the psychology of Microsoft and their latest marketing efforts for Office on the desktop and then they discuss the recent outages in Microsoft Teams and alerts in Azure Monitor.

More Resume Malspam. Now With Trickbot and EternalBlue https://isc.sans.edu/forums/diary/Malspam+with+passwordprotected+word+docs+still+pushing+IcedID+Bokbot+with+Trickbot/24708/ Cloudflare Deploys Rules to Protect Against Recent Drupal Exploit https://www.bleepingcomputer.com/news/security/cloudflare-deploys-firewall-rule-to-block-new-drupal-exploits/ Cisco DoS Vulnerability Activity Exploited https://www.pentestpartners.com/security-blog/cisco-rv130-its-2019-but-yet-strcpy/ MonitorKit uses macOS Game Engine to Analyze Security Events https://github.com/objective-see

Comcast Uses same "0000" PIN For All Number Porting Requests https://nakedsecurity.sophos.com/2019/03/05/comcast-security-nightmare-default-0000-pin-on-everybodys-account/ NSA Releases Ghidra Reverse Analysis Tool https://ghidra-sre.org/ Recent Google Chrome Vulnerability Being Exploited https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop.html?m=1 Android Monthly Security Bulletin https://source.android.com/security/bulletin/2019-03-01

MacOS Unpatched Privilge Escalation Vulnerability made Public https://bugs.chromium.org/p/project-zero/issues/detail?id=1726 Windows Exploit Suggester Next Generation Released https://github.com/bitsadmin/wesng Docker Vulnerability used for Crypto Miners https://www.imperva.com/blog/hundreds-of-vulnerable-docker-hosts-exploited-by-cryptocurrency-miners/ Russian GPS Jamming Exercises https://thebarentsobserver.com/en/security/2019/03/russian-military-officials-arrive-oslo-norway-provides-facts-gps-jamming

Cisco Router Patch https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190227-rmi-cmd-ex Coldfusion Patch and Exploit https://www.carehart.org/blog/client/index.cfm/2019/3/1/urgent_CF_security_update_Part_1 Ransomware Impersonates Protonmail https://twitter.com/demonslay335/status/1097866931762282498 eBay Site Used for eBay Phish (article in German) https://www.heise.de/security/meldung/eBay-Phishing-auf-eBay-Seite-4324266.html

Emotet Backend Analysis https://maxkersten.nl/binary-analysis-course/malware-analysis/emotet-droppers/ Kaspersky Vs. Chromecast https://www.bleepingcomputer.com/news/security/kaspersky-av-having-certificate-conflicts-with-google-chromecast/ MageCart Updates https://www.riskiq.com/research/inside-magecart/

Ben and Scott have a chat with Sarah Lean, a Cloud Solution Architect from Microsoft about why you should be looking at the cloud and how to govern your Azure environments.