News

Protective Malicious Monero Crypto Coin Miners https://isc.sans.edu/forums/diary/The+Crypto+Miners+Fight+For+CPU+Cycles/23407/ memcached DDoS Attacks Ask For Ransom https://blogs.akamai.com/2018/03/memcached-now-with-extortion.html Cheap Android Trojans Come PreInstalled With Banking Malware https://news.drweb.com/show/?lng=en&i=11749&c=5 RedDrop Android Malware Installed via 3rd Party App Stores https://www.wandera.com/blog/reddrop-malware/

Censoring Images At Scale in #WeChat https://isc.sans.edu/forums/diary/Why+Does+Emperor+Xi+Dislike+Winnie+the+Pooh+and+Scrambled+Eggs/23395/ Trustico Update: Certificate Revocation List Monitor https://isc.sans.edu/crls.html Memcached Update: Github Attack https://githubengineering.com/ddos-incident-report/ http://powerofcommunity.net/poc2017/shengbao.pdf Microsoft Releases Intel Spectre Microcode Updates https://support.microsoft.com/en-us/help/4090007/intel-microcode-updates

52. That's quite a number. It's not the number of updates we have to talk about in this episode, but it is the number of episodes we've released. With that being said, Episode 52 is all about news for the month of February 2018. We have updates in Azure, the Read More

How Did This Memcache Thing Happen? https://isc.sans.edu/forums/diary/How+did+this+Memcache+thing+happen/23391/ Trustico TLS Certificate Revocation https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/wxX4Yv0E3Mk/QZt8UPhKAwAJ Flash on Its Way Out https://www.bleepingcomputer.com/news/security/google-chrome-flash-usage-declines-from-80-percent-in-2014-to-under-8-percent-today/ DNSSEC Is Getting Better But Still Struggeling http://www.theregister.co.uk/2018/02/28/dutch_name_authority_dnssec_validation_errors_can_be_eliminated/ Smart TV Firmware Flaws https://www.av-comparatives.org/wp-content/uploads/2018/02/avc_sigma_medion_201802.pdf

Memcached Servers Used in Reflective DDoS Attacks https://isc.sans.edu/forums/diary/Why+we+Dont+Deserve+the+Internet+Memcached+Reflected+DDoS+Attacks/23389/ Malspam Pushing Formbook Info Stealer https://isc.sans.edu/forums/diary/Malspam+pushing+Formbook+info+stealer/23387/ Various SAML Parsers Affected by Comment Parsing Vulnerability https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations

Enumerating S3 Buckets https://github.com/jordanpotti/AWSBucketDump Creating AWS Network Diagrams https://github.com/duo-labs/cloudmapper Selling Macs and "Find my Mac" Feature https://medium.com/@mulligan/how-i-sold-an-old-mac-and-unknowingly-tracked-its-location-for-over-3-years-9a35cd3ca4cf Apple Stopping Support for 1st Gen Apple TV and iTunes on Windows XP / Vista https://support.apple.com/en-us/HT208104

Retrieving Malware Over Tor On Windows (Update) https://isc.sans.edu/forums/diary/Retrieving+malware+over+Tor+on+Windows/23379/ Blackholing Advertising Sites with Pi-Hole https://isc.sans.edu/forums/diary/Blackhole+Advertising+Sites+with+Pihole/23377/ Taxslayer Consent Degree with FTC https://biglawbusiness.com/cybersecurity-enforcers-wake-up-to-unauthorized-computer-access-via-credential-stuffing/ Fortinet (OMG) Mirai https://www.fortinet.com/blog/threat-research/omg--mirai-based-bot-turns-iot-devices-into-proxy-servers.html

In Episode 51, Ben schools Scott on Microsoft 365. Introducing Microsoft 365 “A complete, intelligent solution, including Office 365, Windows 10, and Enterprise Mobility + Security, that empowers everyone to be creative and work together, securely.” Windows 10 Pro, Enterprise & Education Compare Windows 10 editions Windows 10 Enterprise E3 Read More

In Episode 50, Ben and Scott sit down with Waldek Mastykarz to talk about the Office 365 CLI - why it exists, how to get started, what's available today, and how to keep up-to-date as the project grows. https://aka.ms/o365cli Waldek's Blog About Waldek Waldek Mastykarz is a Product Owner at Read More

Ben and Scott are back again in Episode 49 with a recap of your Office 365 news for January 2018. This month it is all about Yammer, SharePoint Online, OneDrive for Business, and Azure Active Directory. Seen Counts in Yammer Manage Yammer users across their life cycle from Office 365 Read More

Adobe Flash 0-Day https://isc.sans.edu/forums/diary/Adobe+Flash+0Day+Used+Against+South+Korean+Targets/23301/ Adaptive Phishing Kit https://isc.sans.edu/forums/diary/Adaptive+Phishing+Kit/23299/ Crypto Miners "Payload of Choice" http://blog.talosintelligence.com/2018/01/malicious-xmr-mining.html Autosploit Links Shodan to Metasploit https://github.com/NullArray/AutoSploit

Episode 48 Scott and Ben jump back into Azure to discuss Azure Log Analytics: Change Tracking and Update Management.  As you start to move workloads into Azure IaaS, this is something you'll definitely want to take a look at for better management of your Azure servers. Preview: Update management, inventory, Read More

Tax Phishing Season Starts https://isc.sans.edu/forums/diary/Tax+Phishing+Time/23295/ Using FLIR In Incident Response https://isc.sans.edu/forums/diary/Using+FLIR+in+Incident+Response/23291/ Oracle MICROS POS Vulnerability https://erpscan.com/press-center/blog/oracle-micros-pos-breached/

DCShadow Attack https://www.dropbox.com/s/baypdb6glmvp0j9/Buehat%20IL%20v2.3.pdf https://blog.alsid.eu/dcshadow-explained-4510f52fc19d Cisco WebVPN Update https://isc.sans.edu/forums/diary/Cisco+ASA+WebVPN+Vulnerability/23289/ Reviving DDE Code Execution via OneNote https://posts.specterops.io/reviving-dde-using-onenote-and-excel-for-code-execution-d7226864caee

Lenovo Fingerprint Mananger Pro Vulnerability https://support.lenovo.com/us/en/product_security/len-15999 ClamAV Vulnerablities http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html https://blog.malwarebytes.com/malwarebytes-news/2018/01/important-web-blocking-ram-usage/ Malwarebytes Corrupted Update https://www.malwarebytes.com/pdf/WebProtectionFP.pdf Cisco Adaptive Security Appliance Remote Code Execution Vulnerability https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1 Web2Top Proxy onion.tor Appears to Steal Ransomware Payments https://www.proofpoint.com/us/threat-insight/post/double-dipping-diverting-ransomware-bitcoin-payments-onion-domains

Analyzing a Word Document Used in a Pentest https://isc.sans.edu/forums/diary/Is+this+a+pentest/23283/ Analyzing BITS Activity https://isc.sans.edu/forums/diary/Investigating+Microsoft+BITS+Activity/23281/ CryptoJacking on YouTube due to Malicious Ads https://blog.trendmicro.com/trendlabs-security-intelligence/malvertising-campaign-abuses-googles-doubleclick-to-deliver-cryptocurrency-miners/ Coincheck Hack Nets 400M USD https://coincheck.com/en/blog/4673 PHPBB Mirror Compromissed https://www.phpbb.com/community/viewtopic.php?f=14&t=2456896 Microsoft Disables Sepctre Variant 2 Patches https://support.microsoft.com/en-us/help/4078130/update-to-disable-mitigation-against-spectre-variant-2

Ransomware As a Service https://isc.sans.edu/forums/diary/Ransomware+as+a+Service/23277/ libcurl Vulnerability http://seclists.org/oss-sec/2018/q1/94 Hide 'N Seek IoT Botnet https://labs.bitdefender.com/2018/01/new-hide-n-seek-iot-botnet-using-custom-built-peer-to-peer-communication-spotted-in-the-wild/ Container Intrusions: Assessing the Efficacy of Intrusion Detection and Analysis Methods for Linux Container Environments https://www.sans.org/reading-room/whitepapers/detection/container-intrusions-assessing-efficacy-intrusion-detection-analysis-methods-linux-container-environments-38245

In Episode 47, Ben and Scott walk through Office 365 Advanced Threat Protection (ATP) and all of the ways it can help you improve your security posture in Office 365 for both Exchange Online and SharePoint Online (including OneDrive for Business and Microsoft Teams!). Office 365 Advanced Threat Protection - Marketing Read More

RTF Files For Hancitor Utilize Exploit for CVE-2017-11882 https://isc.sans.edu/forums/diary/RTF+files+for+Hancitor+utilize+exploit+for+CVE201711882/23271/ Electron Fixes Protocol Handlers Flaw https://electronjs.org/blog/protocol-handler-fix Xerox Workcenters Fudge Numbers http://www.dkriesel.com/en/blog/2013/0802_xerox-workcentres_are_switching_written_numbers_when_scanning? Tracking Users Using CSS https://github.com/jbtronics/CrookedStyleSheets

Apple Patches Everything, Again https://isc.sans.edu/forums/diary/Apple+Updates+Everything+Again/23269/ OpenSSL Introduces its Version of a "Patch Tuesday" https://www.openssl.org/blog/blog/2018/01/18/f2f-london/ "Rapid" Ransomware https://id-ransomware.blogspot.ru/2018/01/rapid-ransomware.html (Russian) https://www.bleepingcomputer.com/forums/t/667032/rapid-ransomware-rapid-paymeme-how-recovery-filestxt-support-topic/page-2