News

Remote Code Execution Vulnerability in WhatsApp https://bugs.chromium.org/p/project-zero/issues/detail?id=1654 Salesforce Releases hashh Library https://github.com/salesforce/hassh CVE-2018-8453 Details from Kaspersky https://securelist.com/cve-2018-8453-used-in-targeted-attacks/88151/ Juniper Patches https://kb.juniper.net/InfoCenter/index?page=content&channel=SECURITY_ADVISORIES Experian Vulnerability Could Have Leaked Credit Freeze PINs https://www.nerdwallet.com/blog/finance/security-flaw-at-experian-allows-easy-access-to-pin-to-unlock-credit-freeze/

Microsoft Patch Tuesday https://isc.sans.edu/forums/diary/October+2018+Microsoft+Patch+Tuesday/24186/ Adobe Updates https://helpx.adobe.com/security.html Magecart Infects "Shopper Approved" Plugin https://www.riskiq.com/blog/labs/magecart-shopper-approved/

In Episode 88, Scott sits down with Erica Toelle from RecordPoint where they discuss labeling and classification in Office 365, applying retention, and what to look for as you implement data governance with Office 365 and other SaaS services. Sponsors Mover.io - Scan, Plan, Migrate, Report. Migrations that don’t suck Read More

Apple Updates iOS and iCloud for Windows https://support.apple.com/en-ca/HT209162 https://support.apple.com/en-ca/HT209141 Intel Adds Spectre/Meltdown Mitigation to 9th Generation CPUs https://www.bleepingcomputer.com/news/security/spectre-and-meltdown-hardware-protection-added-to-intels-9th-gen-cpus/ Windows October Update File Deleting Issues https://support.microsoft.com/en-us/help/4464619/windows-10-update-history https://blogs.technet.microsoft.com/filecab/2018/08/30/9205/ macOS Code Signing Vulnerabilities https://www.virusbulletin.com/conference/vb2018/abstracts/code-signing-flaw-macos

WPA2 Karck Attack Update https://www.krackattacks.com/followup.html#overview Cisco Updates https://tools.cisco.com/security/center/publicationListing.x?product=Cisco&sort=-day_sir#~Vulnerabilities Seattle Police Tries to Stop SWATing https://www.seattle.gov/police/need-help/swatting git Vulnerability Fixed https://github.com/timwr/CVE-2017-1000117

Does the Chinese Military Manipulate Supermicro Motherboards? https://www.bloomberg.com/news/articles/2018-10-04/the-big-hack-amazon-apple-supermicro-and-beijing-respond Cloudflare IPFS Gateway Used For Phishing https://www.bleepingcomputer.com/news/security/phishing-attacks-distributed-through-cloudflares-ipfs-gateway/ DNSSEC Root Key Signing Key Rollover https://www.icann.org/resources/pages/ksk-rollover https://www.icann.org/news/blog/2018-ksk-rollover-operator-preparedness-survey

In Episode 87, Scott sits down for a cup of coffee with Paul Swider. They discuss the business case for blockchain, including use cases and Paul's work with healthcare institutions as well as how to get started with Azure Blockchain. Sponsors Mover.io - Scan, Plan, Migrate, Report. Migrations that don’t Read More

Identifying a Phisher https://isc.sans.edu/forums/diary/Identifying+a+phisher/24164/ Phishing via Azure Blob Storage https://www.netskope.com/blog/phishing-in-the-public-cloud Zoho Domains Used for Phishing and Keyloggers https://cofense.com/staggering-amount-stolen-data-heading-zoho-domains/ Dell iDRAC Exploit https://www.servethehome.com/idracula-vulnerability-impacts-millions-of-legacy-dell-emc-servers/

How to Write Yara Rules https://isc.sans.edu/forums/diary/Developing+YARA+Rules+a+Practical+Example/24158/ GhostDNS DNS Changer Malware https://blog.netlab.360.com/70-different-types-of-home-routers-all-together-100000-are-being-hijacked-by-ghostdns-en/ Foxit PDF Reader Vulnerabilities https://www.foxitsoftware.com/support/security-bulletins.php Apple Laptops Shipped With CPU in Manufacturing Mode http://blog.ptsecurity.com/2018/10/intel-me-manufacturing-mode-macbook.html

Update About Facebook Breach https://newsroom.fb.com/news/2018/09/security-update/ Adobe Acrobat/Reader Update https://helpx.adobe.com/security/products/acrobat/apsb18-30.html SMTP MTA Strict Transport Security (MTA-STS) https://www.rfc-editor.org/rfc/rfc8461.txt

Facebook Leaks more than 50 Million Accounts https://newsroom.fb.com/news/2018/09/security-update/ Telegram Leaks Local IP Address By Default https://www.inputzero.io/2018/09/bug-bounty-telegram-cve-2018-17780.html Site Tricks Users Into Subscribing to Browser Notifications https://www.bleepingcomputer.com/news/security/sites-trick-users-into-subscribing-to-browser-notification-spam/ DDE Code Injection https://isc.sans.edu/forums/diary/More+Excel+DDE+Code+Injection/24150/

In Episode 86, Ben and Scott come to you live from Microsoft Ignite in Orlando (or via the magic of delayed time travel up to a week later). In this episode, they discuss some of the new features that have been announced in Azure and where they will impact existing Read More

Enriching Radare2 and x64dbg malware analysis with statically decoded strings https://isc.sans.edu/forums/diary/Enriching+Radare2+and+x64dbg+malware+analysis+with+statically+decoded+strings/24146/ Weaknesses in Apple's Mobile Device Management https://duo.com/labs/research/mdm-me-maybe LoJax UEFI Rootkit https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group/

In Episode 85, Ben sits down to talk with Sean Bugler to talk about how Office 365 has been rolled out in a GCC tenant, including the trials and tribulations of maintaining an Office 365 tenant and building a vision for aligning Office 365 and other cloud services to the Read More

Emotet Malware Delivery Service Update https://isc.sans.edu/forums/diary/One+Emotet+infection+leads+to+three+followup+malware+infections/24140/ Fedora Crypto Policy Update Causes SSH Issues https://bugzilla.redhat.com/show_bug.cgi?id=1631970 Android Banking Trojan Impersonates QRecorder https://lukasstefanko.com/2018/09/banking-trojan-found-on-google-play-stole-10000-euros-from-victims.html Google Reverts Changes to Chrome https://www.blog.google/products/chrome/product-updates-based-your-feedback/amp/

Firefox Haveibeenpwned Monitor https://blog.mozilla.org/blog/2018/09/25/introducing-firefox-monitor-helping-people-take-control-after-a-data-breach/ Chrome 69 Privacy Issues https://www.bleepingcomputer.com/news/google/chrome-69-keeps-googles-cookies-after-you-clear-browser-data/ Cisco FragmentSmack Vulnerability https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180824-linux-ip-fragment Micorsoft Bitlocker Turns itself Off During Updates https://social.technet.microsoft.com/Forums/en-US/0e48536f-40ff-4046-bd08-ed4a39b4840f/bitlocker-automatically-suspending-during-updates?forum=win10itprosecurity

More Sextortion Emails https://isc.sans.edu/forums/diary/Sextortion+Spam+and+the+Infinite+Monkey+Theorem/24136/ MacOS 10.14 (Mojahve) Security Fixes https://support.apple.com/en-us/HT209139 Mojave Privacy Protection Bypass https://vimeo.com/291491984 Cloudflare Supporting Encrypted SNI https://blog.cloudflare.com/esni/

In Episode 84, Ben and Scott talk about the latest announcements from Microsoft Ignite 2018. There are so many things we could talk about, but we've focused on Office 365, the Microsoft security stack, and some of the newest services coming in Azure IaaS. Sponsors Mover.io - Scan, Plan, Migrate, Report. Read More

Odd DNS Requests from Firewalls https://isc.sans.edu/forums/diary/Suspicious+DNS+Requests+Issued+by+a+Firewall/24128/ Securing API Connections https://isc.sans.edu/forums/diary/The+danger+of+sending+information+for+API+consumption+without+adequate+security+measures/24130/ Microsoft JET Database 0day https://www.zerodayinitiative.com/advisories/ZDI-18-1075/ Western Digital Releases Patch for MyCloud Drives https://support.wdc.com/knowledgebase/answer.aspx?ID=25952&s Job Offers With Malware Attachment https://www.bleepingcomputer.com/news/security/malware-disguised-as-job-offers-distributed-on-freelance-sites/

Hunting for Suspicious Processes with OSSEC https://isc.sans.edu/forums/diary/Hunting+for+Suspicious+Processes+with+OSSEC/24122/ NSSLabs Sues Crowdstrike, Symantec, ESET https://www.nsslabs.com/blog/company/advancing-transparency-and-accountability-in-the-cybersecurity-industry/ Bitcoin Core Vulnerability https://motherboard.vice.com/amp/en_us/article/qvakp3/a-major-bug-in-bitcoin-software-could-have-crashed-the-currency?__twitter_impression=true WebAuthn Standard https://paragonie.com/blog/2018/08/security-concerns-surrounding-webauthn-don-t-implement-ecdaa-yet https://fidoalliance.org/