News

In Episode 61, Scott and Ben dive into a listener question on the various options for cloud-based file shares, including SharePoint Online and Azure Files. Sponsors Join Ben and Scott at SharePoint Conference North America. Register today at sharepointna.com with the code SHOAG and save $50 on your registration. Office365AdminPortal.com Read More

GPS Jamming Becoming More Common https://www.avweb.com/avwebflash/news/GPS-Jamming-Major-Threat-to-Drone-230749-1.html https://www.heise.de/newsticker/meldung/GPS-unter-Beschuss-Jamming-und-Spoofing-nehmen-zu-4038137.html Windows Command Line References https://isc.sans.edu/forums/diary/Windows+Commands+Reference+An+InfoSec+Must+Have/23613/ LoJack Laptop Anti-Theft Software "Phones Home" to Russia https://asert.arbornetworks.com/lojack-becomes-a-double-agent/ Google Maps Can Be Used as a URL Shortener https://nakedsecurity.sophos.com/2018/05/01/google-maps-open-redirect-flaw-abused-by-spammers/ Retrieving DVR Credentials via "Admin Cookie" https://github.com/ezelf/CVE-2018-9995_dvr_credentials

Creating Malicious Office Documents https://isc.sans.edu/forums/diary/Diving+into+a+Simple+Maldoc+Generator/23609/ Google (and Amazon) Disable Domain Fronting https://arstechnica.com/information-technology/2018/04/google-disables-domain-fronting-capability-used-to-evade-censors/ Google Chrome To Enforce Certificate Transparency https://groups.google.com/a/chromium.org/forum/#!msg/ct-policy/wHILiYf31DE/iMFmpMEkAQAJ

April WebLogic Patch Incomplete and Intense Scanning for WebLogic Under Way https://www.bleepingcomputer.com/news/security/hackers-scan-the-web-for-vulnerable-weblogic-servers-after-oracle-botches-patch/ Facex Worm Spreads Malicious Chrome Extensions via Facebook https://blog.trendmicro.com/trendlabs-security-intelligence/facexworm-targets-cryptocurrency-trading-platforms-abuses-facebook-messenger-for-propagation/ $15 DTV Transmitter as a SDR https://hackernoon.com/osmo-fl2k-a-15-dtv-transmitter-fm-radio-hijack-and-gps-spoofing-device-68ac08ba7d76

A Few Sample #Drupal Exploits including CVE-2018-7602 https://isc.sans.edu/forums/diary/More+Threat+Hunting+with+User+Agent+and+Drupal+Exploits/23597/ Triggering SMB Connections to Steal NTLM Credentials via PDFs https://research.checkpoint.com/ntlm-credentials-theft-via-pdf-files/ NTFS Crash DoS Exploit Published for Windwos 10 and 7 https://github.com/mtivadar/windows10_ntfs_crash_dos Apple HomeKit / Secure Element Problems https://www.youtube.com/watch?v=1CNAMgctAp0 Azucar Assessing Azure Security https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/april/introducing-azucar/

HP iLO Ransomware https://www.bleepingcomputer.com/news/security/ransomware-hits-hpe-ilo-remote-management-interfaces/ Total Meltdown Exploit Available https://blog.xpnsec.com/total-meltdown-cve-2018-1038/ WD My Cloud EX2 Access Control Bypass https://www.trustwave.com/Resources/SpiderLabs-Blog/WD-My-Cloud-EX2-Serves-Your-Files-to-Anyone/ Hyperoptic ZTE Home Router Hardcoded Account https://www.contextis.com/resources/advisories/hyperoptic-zte-home-routers

In Episode 60, Scott and Ben spend 30 minutes talking about a magical text box that runs in the cloud - Azure Cloud Shell. Sponsors Join Ben and Scott at SharePoint Conference North America. Register today at sharepointna.com with the code SHOAG and save $50 on your registration. Office365AdminPortal.com - Read More

New Drupal Remote Code Execution Vulnerability https://www.drupal.org/sa-core-2018-004 Malicious Network Traffic From /bin/bash https://isc.sans.edu/forums/diary/Malicious+Network+Traffic+From+binbash/23591/ Insecure Hotel Locks https://safeandsavvy.f-secure.com/2018/04/25/researchers-find-way-to-generate-master-keys-to-hotels/ Amazon Echo As Evesdropping Device (signin required) https://info.checkmarx.com/wp-alexa

In Episode 59, Ben and Scott dive into Azure Network Security and walk through the concept of an Azure Virtual Datacenter. Sponsors Join Ben and Scott at SharePoint Conference North America. Register today at sharepointna.com with the code SHOAG and save $50 on your registration. Office365AdminPortal.com - Providing admins the Read More

In Episode 58, Scott and Ben sat down (virtually) with Bill Baer to discuss SPC18! We reminisce about past SharePoint Conference and what Microsoft is bringing back from past conference and new aspects will be coming to SPC18 that you can forward to. Sponsors Join Ben and Scott at SharePoint Conference Read More

In Episode 57, Scott and Ben are back with your monthly dose of cloud news. This month, it's all about Azure and Office 365, including updates to Microsoft Teams, some exciting announcements around Azure resiliency, and much more. Sponsors Join Ben and Scott at SharePoint Conference North America. Register today Read More

In Episode 56, Ben learns all about Azure Security Center from Scott. Azure Security Center Azure Security Center Pricing What is Azure Security Center? Tutorial: Define and assess security policies Tutorial: Protect your resources with Azure Security Center Quickstart: Onboard your Azure subscription to Security Center Standard

In Episode 55, Ben and Scott break down Visio Online. Visio Online Compare Visio options Visio Online Service Description Visio Online: Frequently Asked Questions Supported scenarios for installing different versions of Office, Visio, and Project on the same computer Visio Viewer for iOS

In Episode 54, Scott and Ben are back with an interview with Brian Levenson (@brian_levenson), the Microsoft 365 US Government Product Marketing Manager. Announcing Microsoft 365 for US Government New Apps and Services in Office 365 US Government Office 365 US Government Service Description Office 365 Government Community Cloud Service Read More

Paying For Ransomware Often Fails to Recover Files https://cyber-edge.com/cdr/#about-this-report Microtik Router Malware Infects Sysadmin PCs https://s3-eu-west-1.amazonaws.com/khub-media/wp-content/uploads/sites/43/2018/03/09133534/The-Slingshot-APT_report_ENG_final.pdf CNNVD Held Back Vulnerabilities https://www.recordedfuture.com/chinese-mss-vulnerability-influence/ Keeper Exposes S3 Bucket http://www.zdnet.com/article/password-manager-maker-keeper-hit-by-another-security-snafu/ https://keepersecurity.com/blog/2018/03/10/keepers-response-zdnets-article-regarding-s3-bucket-configuration-issue/ Chip and Pin Clones https://www.kaspersky.com/blog/chip-n-pin-cloning/21502/

Apache Solr Vulnerability used to Install Cryptocoin Miner https://isc.sans.edu/forums/diary/Apache+SOLR+the+new+target+for+cryptominers/23425/ CRIMEB4NK IRC Bot https://isc.sans.edu/forums/diary/CRIMEB4NK+IRC+Bot/23423/ Cisco Patches https://tools.cisco.com/security/center/publicationListing.x Any.Run Malware Analysis Tool https://any.run

In Episode 53, Scott and Ben give a rundown of the latest updates and enhancements in Microsoft Teams. What’s new in Microsoft Teams – February update Collaborate securely with anyone in Microsoft Teams Intelligent Communications takes the next step with calling in Teams Quick start guide: Configuring Calling Plans in Read More

Ransomware News: GlobeImposter Gets A Facelift, GandCrab is Still Out there https://isc.sans.edu/forums/diary/Ransomware+news+GlobeImposter+gets+a+facelift+GandCrab+is+still+out+there/23417/ How to Break Encryption https://blog.malwarebytes.com/threat-analysis/2018/03/encryption-101-how-to-break-encryption/ Bypassing Adobe Flash Security Protections https://securingtomorrow.mcafee.com/mcafee-labs/hackers-bypassed-adobe-flash-protection-mechanism/ Hundreds of Bitcoin Mining Servers Stolen in Iceland https://www.theguardian.com/world/2018/mar/07/hundreds-of-bitcoin-mining-servers-stolen-in-iceland Several Android Mail Apps Send Password To Developer (article in German) https://www.kuketz-blog.de/mail-apps-zahlreiche-android-apps-uebermitteln-login-passwort/

Exploit for CVE-2018-6789 https://devco.re/blog/2018/03/06/exim-off-by-one-RCE-exploiting-CVE-2018-6789-en/ Microsoft Fixes USB Issues Introduced By February Patches https://support.microsoft.com/en-us/help/4090913/march5-2018kb4090913osbuild16299-251 123 Reg Looses Backups https://www.bleepingcomputer.com/news/business/123-reg-backup-snafu-causes-clients-to-lose-files-since-august-2017/ Android March Security Bulletin https://source.android.com/security/bulletin/2018-03-01#media-framework

Malicious Bash Script with Multiple Features https://isc.sans.edu/forums/diary/Malicious+Bash+Script+with+Multiple+Features/23411/ More Memcached DDoS Attacks https://www.arbornetworks.com/blog/asert/netscout-arbor-confirms-1-7-tbps-ddos-attack-terabit-attack-era-upon-us/ Spring Framework Vulnerability https://lgtm.com/blog/spring_data_rest_CVE-2017-8046 LTE Vulnerabilities http://homepage.divms.uiowa.edu/~comarhaider/publications/LTE_NDSS18_paper.pdf