News

Obfuscated JavaScript Targeting Mobile Devices https://isc.sans.edu/forums/diary/Malicious+JavaScript+Targeting+Mobile+Browsers/23778/ Axis Camera Vulnerabilities https://blog.vdoo.com/2018/06/18/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/ Apple Caches Confidential Data on Unencrypted Drives https://wojciechregula.blog/your-encrypted-photos-in-macos-cache/ Andy Emulator Infected With CryptoMiner https://www.reddit.com/r/emulators/comments/8rj8g5/warning_andy_android_emulator_andyos_andyroid/

SMTP Strangeness - Possible C2 https://isc.sans.edu/forums/diary/SMTP+Strangeness+Possible+C2/23770/ Encrypted Office Documents https://isc.sans.edu/forums/diary/Encrypted+Office+Documents/23774/ Recent Port 8000 Scans https://www.bleepingcomputer.com/news/security/all-that-port-8000-traffic-this-week-yeah-thats-satori-looking-for-new-bots/ New Clipboard Cryptocoin Stealing Bot https://blog.360totalsecurity.com/en/new-cryptominer-hijacks-your-bitcoin-transaction-over-300000-computers-have-been-attacked/ WebUSB Weakness https://pwnaccelerator.github.io/2018/webusb-yubico-disclosure.html

Analyzing a Compromised Wordpress Site https://isc.sans.edu/forums/diary/A+Bunch+of+Compromized+Wordpress+Sites/23764/ Breacking Bluetooth Low Energy Smart Padlock https://www.pentestpartners.com/security-blog/totally-pwning-the-tapplock-smart-lock/ WIM Disk Image Vulnerability https://blog.talosintelligence.com/2018/06/vulnerability-spotlight-talos-2018-0545.html Extracting Timely Sign-In Data from Office 365 Logs https://www.sans.org/reading-room/whitepapers/logging/extracting-timely-sign-in-data-office-365-logs-38435

In Episode 69, Ben sits down with Laura Rogers from IW Mentor at SharePoint Conference 2018. Laura shares her experience with SharePoint Swoop and provides insights on the PowerApps landscape. Sponsors Office365AdminPortal.com - Providing admins the knowledge and tools to run Office 365 successfully Intelligink - We focus on the Read More

From MicroTik With Love: Yet Another Router Botnet? https://isc.sans.edu/forums/diary/From+Microtik+with+Love/23762/ Using Cortana To Compromise Windows 10 https://securingtomorrow.mcafee.com/mcafee-labs/want-to-break-into-a-locked-windows-10-device-ask-cortana-cve-2018-8140/ Compromised Docker Images https://kromtech.com/blog/security-center/cryptojacking-invades-cloud-how-modern-containerization-trend-is-exploited-by-attackers Lazy FPU Save/Restore Allows Malware Access to FPU https://access.redhat.com/solutions/3485131

Microsoft Patch Tuesday https://isc.sans.edu/forums/diary/Microsoft+June+2018+Patch+Tuesday/23758/ Apple Code Signing Verification Vulnerability https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/ Google Chrome Restricting Inline Extension Install https://blog.chromium.org/2018/06/improving-extension-transparency-for.html

More Malspam Pushing Lokibot https://isc.sans.edu/forums/diary/More+malspam+pushing+Lokibot/23754/ Ethereum JSON RPC Theft https://twitter.com/360Netlab/status/1006065566728085504 CryptoCurrency Miner Plays hide-and-seek https://www.bleepingcomputer.com/news/security/cryptocurrency-miner-plays-hide-and-seek-with-popular-games-and-tools/ Apple Outlaws Crypto Currency Miners in App Store https://developer.apple.com/app-store/review/guidelines/#hardware-compatibility FBI Arrests Suspect in BEC Investigation https://www.fbi.gov/news/stories/international-bec-takedown-061118

The Seven Properties of Highly Secure Devices https://www.microsoft.com/en-us/research/wp-content/uploads/2017/03/SevenPropertiesofHighlySecureDevices.pdf Finding Deserialisation Issues With Burp https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/june/finding-deserialisation-issues-has-never-been-easier-freddy-the-serialisation-killer/ FTC Starts Looking Into Cryptojacking https://www.consumer.ftc.gov/blog/2018/06/protecting-your-devices-cryptojacking Drupal Disputes Number of Vulnerable Sites https://groups.drupal.org/node/520149

Critical Adobe Flash Update https://helpx.adobe.com/security/products/flash-player/apsb18-19.html SuperMicro Firmware Vulnerability https://blog.eclypsium.com/2018/06/07/firmware-vulnerabilities-in-supermicro-systems/ FOSCAM Video Camera Vulnerabilities https://blog.vdoo.com/2018/06/06/vdoo-has-found-major-vulnerabilities-in-foscam-cameras/ Sofacy Update https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/ Automated Twitter Loot Collection https://isc.sans.edu/forums/diary/Automated+twitter+loot+collection/23743/

In Episode 68, Ben sits down with Bill Baer to talk about the latest announcements from SharePoint Conference 2018 and the SharePoint Virtual Summit! They touch on everything from the latest announcements with SharePoint spaces to the functionality and release timelines for SharePoint 2019. Sponsors Office365AdminPortal.com - Providing admins the Read More

VPNFilter Update https://blog.talosintelligence.com/2018/06/vpnfilter-update.html Prowli Botnet https://www.guardicore.com/2018/06/operation-prowli-traffic-manipulation-cryptocurrency-mining/ Cisco Security Bulletins https://tools.cisco.com/security/center/publicationListing.x F-Secure RAR Vulnerability https://www.f-secure.com/en/web/labs_global/fsc-2018-2 PCAP to Weblogs https://isc.sans.edu/forums/diary/Converting+PCAP+Web+Traffic+to+Apache+Log/23739/

Analysis of a Post Exploit Script Malicious Post-Exploitation Batch File Zip Slip Vulnerability https://snyk.io/research/zip-slip-vulnerability Redis Exploits https://www.incapsula.com/blog/report-75-of-open-redis-servers-are-infected.html Drupalgeddon 2 Update https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/

Running Only Signed Code. Does it work in Windows 10? https://isc.sans.edu/forums/diary/Digging+into+Authenticode+Certificates/23731/ Misconfigured G-Suite Mailing Lists https://www.kennasecurity.com/widespread-google-groups-misconfiguration-exposes-sensitive-information/ Microsoft Releases Open Source Post Quantum VPN https://github.com/Microsoft/PQCrypto-VPN

Apple Patches Everything https://isc.sans.edu/forums/diary/Apple+Security+Updates/23727/ VPNFilter Makes a Comeback https://jask.com/from-russia-with-love/ Reverse Analysis with Radare2 https://isc.sans.edu/forums/diary/Binary+analysis+with+Radare2/23723/ Pet Location Tracker Vulnerabilities https://threatpost.com/pet-trackers-open-to-mitm-attacks-interception/132291/

Safely Resetting Routers https://isc.sans.edu/forums/diary/Resetting+Your+Router+the+Paranoid+Right+Way/23719/ CSS mix-blend-mode Side Channel Attack https://www.evonide.com/side-channel-attacking-browsers-through-css3-features/ New ActiveX Exploit Seen in the Wild https://www.krcert.or.kr/data/secNoticeView.do?bulletin_writing_sequence=27263 Apple iMessage Security https://support.apple.com/en-us/HT202303 10 Year Old Vulnerability in Steam Discovered https://www.contextis.com/blog/frag-grenade-a-remote-code-execution-vulnerability-in-the-steam-client

In Episode 67, Ben and Scott are joined by Adam Harmetz where they discuss the latest updates and announcements from SharePoint Conference 2018, including SharePoint spaces, improvements to the Modern UI, SharePoint Lists, and AI. Sponsors Office365AdminPortal.com - Providing admins the knowledge and tools to run Office 365 successfully Intelligink Read More

Windows JScript Vulnerability https://www.zerodayinitiative.com/advisories/ZDI-18-534/ Two Git Vulnerabilities Patched https://marc.info/?l=git&m=152761328506724&w=2 https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/ SpamCannibal Blacklist Temporarily Marks All IPs as "Spam" https://twitter.com/GossiTheDog/status/1001778042400854016 QRadar Remote Code Execution https://blogs.securiteam.com/index.php/archives/3689

New DNS Features https://isc.sans.edu/forums/diary/DNS+is+Changing+Are+you+Ready/23711/ Apple Updates https://support.apple.com/en-us/HT201222 Scans For Misconfigured EOS Blockchain Nodes https://www.bleepingcomputer.com/news/security/misconfigured-eos-blockchain-nodes-under-attack/ NPM Bug Causes Update Failures / Application Crashes https://github.com/npm/npm/issues/20791#issuecomment-392648459 MnuBot Exfiltrates Data Via MSSQL https://securityintelligence.com/new-banking-trojan-mnubot-discovered-by-ibm-x-force-research/

In Episode 66, Ben and Scott are joined by Stephen Rose where they discuss the latest updates and announcements from SharePoint Conference 2018, including OneDrive for Business multi-geo support, improvements to the sharing experience, and reporting. Sponsors Office365AdminPortal.com - Providing admins the knowledge and tools to run Office 365 successfully Read More

Ultrasound Mobile Location Tracking https://isc.sans.edu/forums/diary/Do+you+hear+Laurel+or+Yanny+or+is+it+OnOff+Keying/23707/ Analyzing Malware Created with NSIS https://isc.sans.edu/forums/diary/Quick+analysis+of+malware+created+with+NSIS/23703/ Obfuscated Word Macro https://isc.sans.edu/forums/diary/Antivirus+Evasion+Easy+as+123/23701/ Z-Wave Attacks https://www.pentestpartners.com/security-blog/z-shave-exploiting-z-wave-downgrade-attacks/ https://www.silabs.com/community/blog.entry.html/2018/05/23/tl_dr_your_door_is-g1zC Electron Framework Protocol Handler Patch Bypass https://blog.doyensec.com/2018/05/24/electron-win-protocol-handler-bug-bypass.html