News

Encrypted Word Maldocs https://isc.sans.edu/forums/diary/More+malspam+using+passwordprotected+Word+docs/24262/ iOS / MacOS ICMP Error Remote Code Execution https://lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407 iOS Lock Screen Bypass https://www.youtube.com/watch?v=ojigFgwrtKs

Change in Strategy for Hancitor Malware https://isc.sans.edu/forums/diary/Campaign+evolution+Hancitor+malspam+starts+pushing+Ursnif+this+week/24256/ Apple Updates https://support.apple.com/en-us/HT201222 Telegram Stores Conversations Locally https://twitter.com/nathanielrsuchy

In Episode 93, Ben sits down with Daivat Dholakia, Director of Products at Spanning. They have a discussion around Office 365 backup and recovery, starting with what Office 365 does for you and where you may need to look for additional features and functionality outside of Office 365. Sponsors Mover.io - Read More

Maldoc Duplicating PowerShell https://isc.sans.edu/forums/diary/Maldoc+Duplicating+PowerShell+Prior+to+Use/24254/ New File Types Emerge in Malware Spam Attachments https://blog.trendmicro.com/trendlabs-security-intelligence/same-old-yet-brand-new-new-file-types-emerge-in-malware-spam-attachments/ Malicious Mac Crypto Currency Tracker Installs Backdoor https://blog.malwarebytes.com/threat-analysis/2018/10/mac-cryptocurrency-ticker-app-installs-backdoors/ Sandbox For Windows Defender https://cloudblogs.microsoft.com/microsoftsecure/2018/10/26/windows-defender-antivirus-can-now-run-in-a-sandbox/

Dissecting Malicious Office Documents in Linux https://isc.sans.edu/forums/diary/Dissecting+Malicious+Office+Documents+with+Linux/24248/ Analyzing Compressed RTF Documents https://isc.sans.edu/forums/diary/Detecting+Compressed+RTF/24250/ SystemD DHCPv6 Remote Code Executing Vulnerability https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-15688 Cryptominers Scan for Docker Engine https://blog.trendmicro.com/trendlabs-security-intelligence/misconfigured-container-abused-to-deliver-cryptocurrency-mining-malware DemonBot Targeting Hadoop https://blog.radware.com/security/2018/10/new-demonbot-discovered/

Scam Calls Targeting Chinese Living in the US https://isc.sans.edu/forums/diary/Fake+BankPost+Office+Phone+Calls+Targeting+Chinese+Immigrants/24244/ X.org Privilege Elevation Flaw https://lists.x.org/archives/xorg-announce/2018-October/002927.html Remote Videos in Office Documents https://blog.cymulate.com/abusing-microsoft-office-online-video Mac Malware Injects Ads https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/

In Episode 92, Scott sits down with Adam Levithan from Withum Digital to talk all things modern SharePoint - Intranets, Hub Sites, Communication Sites, and how to inflict value on your users. Sponsors Mover.io - Scan, Plan, Migrate, Report. Migrations that don’t suck - with Mover! Office365Mon.com - How do Read More

Reversing AutoIT https://isc.sans.edu/forums/diary/Diving+into+Malicious+AutoIT+Code/24238/ Arcserve Vulnerabilities https://www.digitaldefense.com/blog/zero-day-alerts/arcserve-disclosure/ WebExec Vulnerability https://webexec.org/ More ALPC Flaws from Sandbox Escaper https://twitter.com/SandboxEscaper/status/1054744201244692485 https://twitter.com/mkolsek/status/1054794984908562432

Malware Uses Decoy Picture https://isc.sans.edu/forums/diary/Malicious+Powershell+using+a+Decoy+Picture/24234/ DNS over HTTPS Pushback https://twitter.com/paulvixie/status/1053765281917661184 Signal Desktop Leaves Encryption Key Exposed https://twitter.com/nathanielrsuchy Firefox 63 Allows Less Tracking https://blog.mozilla.org/security/2018/10/23/firefox-63-lets-users-block-tracking-cookies/

MSG Files: Compressed RTF https://isc.sans.edu/forums/diary/MSG+Files+Compressed+RTF/24228/ FreeRTOS TCP/IP Stack Vulnerabilities https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-put-wide-range-devices-risk-compromise-smart-homes-critical-infrastructure-systems/ VLC/Live555 RTSP Server Vulnerability https://www.talosintelligence.com/reports/TALOS-2018-0684 Microsoft Yammer Update https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2018-8569#ID0EGB

MacOS LaunchAgent https://isc.sans.edu/forums/diary/Beyond+good+ol+LaunchAgent+part+0/24230/ TLS Session Tracking https://arxiv.org/pdf/1810.07304.pdf jQuery File Upload Plugin https://blogs.akamai.com/sitr/2018/10/having-the-security-rug-pulled-out-from-under-you.html Drupal Update https://www.drupal.org/sa-core-2018-006

Cisco Patches https://tools.cisco.com/security/center/Search.x?publicationTypeIDs=1&firstPublishedStartDate=2018%2F10%2F17&firstPublishedEndDate=2018%2F10%2F17&lastPublishedStartDate=2018%2F10%2F17&lastPublishedEndDate=2018%2F10%2F17 51% Attack Against Crypto Currencies https://old.reddit.com/r/CryptoCurrency/comments/9m1uuj/if_i_livestreamed_the_setup_and_execution_of/ VMWare Patch https://www.vmware.com/au/security/advisories/VMSA-2018-0026.html

In Episode 91, Scott sits down at Ignite with Sony Kogin from Citrix to talk about Azure Virtual WAN, Azure Front Door, and how to think about implementing network controls for end-user experience when accessing cloud services. Also, join Scott and I at Live!360 in Orlando. Sponsors Mover.io - Scan, Read More

Abandoned "NewShareCount" Twitter Counter abused https://blog.sucuri.net/2018/10/malicious-redirects-from-newsharecounts-com-tweet-counter.html Multiple D-Link Vulnerabilities https://seclists.org/fulldisclosure/2018/Oct/36 RID Hacking in Windows https://www.romhack.io/slides/RomHack%202018%20-%20Sebastian%20Castro%20-%20Windows%20RID%20Hijacking:%20Maintaining%20Access%20on%20Windows%20Machines.pdf

Oracle CPU https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html libssh vulnerability https://www.libssh.org/security/advisories/CVE-2018-10933.txt Vending Machine Mobile App Compromise https://hackernoon.com/how-i-hacked-modern-vending-machines-43f4ae8decec Browsers Announce Timeline to Discontinue TLS1.0/1.1 support https://blogs.windows.com/msedgedev/2018/10/15/modernizing-tls-edge-ie11/ https://security.googleblog.com/2018/10/modernizing-transport-security.html https://blog.mozilla.org/security/2018/10/15/removing-old-versions-of-tls/ https://webkit.org/blog/8462/deprecation-of-legacy-tls-1-0-and-1-1-versions/

In Episode 90, Scott sits down with Alexander Arvidsson from the Knee Deep in Tech podcast to talk about Power BI and how you can approach designing and sharing data within Office 365. Sponsors Mover.io - Scan, Plan, Migrate, Report. Migrations that don’t suck - with Mover! Office365Mon.com - How Read More

Proof Of Concept Exploit for Microsoft Edge Vulnerability CVE-2018-8495 https://leucosite.com/Microsoft-Edge-RCE/ Fake Mining Apps https://www.fortinet.com/blog/threat-research/fortinet-discovers-new-android-apps-that-mine-the-unminable.html Fake Google Photo App Turns out to be Ad-Clicker https://www.geeklatest.com/developer-tricks-microsoft-publishes-app-under-google-llc-name-in-windows-store/

Many Large Websites Affected by Branch.io XSS Flaw https://www.vpnmentor.com/blog/dom-xss-bug-affecting-tinder-shopify-yelp/ Medtronics Pacemakers Disable Remote Update https://www.medtronic.com/content/dam/medtronic-com/us-en/corporate/documents/REV-Medtronic-2090-Security-Bulletin_FNL.pdf IBM Updates WebSphere Update https://www-01.ibm.com/support/docview.wss?uid=swg22016254 Incomplete JET Database Patch https://blog.0patch.com/2018/10/patching-re-patching-and-meta-patching.html

New Campaign Using Old Equation Editor Vulnerability https://isc.sans.edu/forums/diary/New+Campaign+Using+Old+Equation+Editor+Vulnerability/24196/ Root Access Vulnerability in SONY Smart TVs https://www.fortinet.com/blog/threat-research/sony-smart-tv-exploit-inside-view-hijacking-your-living-room.html MicroTik RouterOS Vulnerablities https://github.com/tenable/routeros/blob/master/bug_hunting_in_routeros_derbycon_2018.pdf Reverse Analysis of WebAssembly https://www.forcepoint.com/blog/security-labs/manual-reverse-engineering-webassembly-static-code-analysis Firefox Delays Symantec Certificate Distrust https://www.theregister.co.uk/2018/10/11/firefox_symantec_certs_delay/

In Episode 89, Scott sits down with Jeremy Winter, Director of Azure Management, to talk about Azure Migrate and how to approach the migration lifecycle of Assess, Migrate, Optimize, Secure, and Manage. Sponsors Mover.io - Scan, Plan, Migrate, Report. Migrations that don’t suck - with Mover! Office365Mon.com - How do you Read More