DoS Attack Turns off Heat for More then a Week http://www.hs.fi/kotimaa/a1478495966653 (finish only) DLink HNAP Vulnerability https://raw.githubusercontent.com/pedrib/PoC/master/advisories/dlink-hnap-login.txt PoC Exploits Available for Two MSFT Vulnerabilities https://github.com/tinysec/public/tree/master/CVE-2016-7255 https://g-laurent.blogspot.com/2016/11/ms16-137-lsass-remote-memory-corruption.html OpenSSL Patch Pre-Announced https://mta.openssl.org/pipermail/openssl-announce/2016-November/000085.html Hue Lightbulb Exploit/Worm http://iotworm.eyalro.net (Sophos labels this link as "Spam", but appears to be harmless)
Tesco Bank Limits Online Banking After Online Criminal Activity https://yourcommunity.tescobank.com/t5/News/Message-for-Current-Account-customers/td-p/6599 Belkin WeMo Devices Used To Attack Mobile Devices https://www.blackhat.com/eu-16/briefings/schedule/index.html#breaking-bhad-abusing-belkin-home-automation-devices-4640 Fake Retail Apps Flooding Apple App Store http://www.nytimes.com/2016/11/07/technology/more-iphone-fake-retail-apps-before-holidays.html?_r=0 Netflix Password Recovery via Phone Call Vulnerability https://slashcrypto.org/2016/11/07/Netflix/ Webcast: 8 Ways To Watch The Invisible: Analyzing Encrypted Network Traffic https://www.sans.org/webcasts/8-ways-watch-invisible-analyzing-encrypted-network-traffic-103277
Reconstruct Binaries Sent via Telnet https://isc.sans.edu/forums/diary/Extracting+Malware+Transmitted+Via+Telnet/21673/ Wix.com DOM Based XSS https://www.contrastsecurity.com/security-influencers/dom-xss-in-wix.com DNS Based Mail Security https://nccoe.nist.gov/projects/building_blocks/secured_email Web of Trust Plugin Released Anonymized User Data https://www.mywot.com/en/forum/70396--virus-spyware-do-not-install-uninstall-as-soon-as-possible
Exchange Web Service Two-Factor Authentication Bypass http://www.blackhillsinfosec.com/?p=5396 Barracuda DoS Disrupts Mail Delivery http://status.barracuda.com Targobank Looses Account Data After Maintenance http://www.spiegel.de/wirtschaft/service/targobank-kunden-fehlt-geld-auf-dem-konto-it-probleme-a-1119434.html (german only) Ouch! Security Awareness Newsletter http://securingthehuman.sans.org/newsletters/ouch/issues/OUCH-201611_en.pdf
Malvertising On Google AdWords Targeting macOS Users http://blog.cylance.com/malvertising-on-google-adwords-targeting-macos-users Microsoft Response to Google Privilege Escalation Disclosure https://blogs.technet.microsoft.com/mmpc/2016/11/01/our-commitment-to-our-customers-security/ Memcached Remote Code Execution Vulnerabilities http://blog.talosintel.com/2016/10/memcached-vulnerabilities.html SAP Vulnerability Details Released https://erpscan.com/press-center/blog/0-day-sap-vulnerability-published-heres-can/
snapshot.ps1 DFIR Capture https://isc.sans.edu/forums/diary/SEC505+DFIR+capture+script+snapshotps1/21659/ Predicting Domain Reputation http://www.icir.org/vern/papers/predator-ccs16.pdf Mozilla Removing Battery Status API For Privacy Reasons https://www.fxsitecompat.com/en-CA/docs/2016/battery-status-api-has-been-removed/ Windows Privilege Escalation 0-day Actively Exploited https://security.googleblog.com/2016/10/disclosing-vulnerabilities-to-protect.html
Small Changes to Ransomware E-Mails May Fool Some Mail Filters https://isc.sans.edu/forums/diary/Your+Bill+Is+Not+Overdue+today/21647/ Microsoft / Google Release Browser Updates to Address Flash Vulnerablity https://technet.microsoft.com/en-us/library/security/ms16-128.aspx https://googlechromereleases.blogspot.com Social Media "Support" Phishing https://www.proofpoint.com/us/corporate-blog/post/cybercriminals-spoof-every-major-bank-masquerade-branded-customer-service-twitter-accounts Path Traversal Vulnerablity in gnu tar https://sintonen.fi/advisories/tar-extract-pathname-bypass.proper.txt Podcast Survey https://dshield.typeform.com/to/lVgHr5
Adobe Releases Emergency Patch For Flash https://isc.sans.edu/forums/diary/Critical+Flash+Player+Update+APSB1636/21643/ Mobile Pwn2Own Writeup http://blog.trendmicro.com/results-mobile-pwn2own-2016/ Mozilla Will Stick With Blacklisting Startcom/WoSign https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/ Joomla Exploit Released https://medium.com/@showthread/joomla-3-6-4-account-creation-elevated-privileges-write-up-and-exploit-965d8fb46fa2#.b8gks1jar Google Spreadsheet Vulnerability https://www.rodneybeede.com/Google_Spreadsheet_Vuln_-_CSRF_and_JSON_Hijacking_allows_data_theft.html
Joomla Fixes Two Critical Vulnerablities; https://www.joomla.org/announcements/release-news/5678-joomla-3-6-4-released.html Letsencrypt Domain Verification Problem https://dan.enigmabridge.com/lets-encrypts-vulnerability-as-a-feature-authz-reuse-and-eternal-account-key/ New Locky Variants: Pumpkin Locky http://blog.talosintel.com/2016/10/pumpkin-locky.html Pagers still in use for Critical Infrastructure http://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/industrial-plant-beepers-leaking-secrets
ISC Briefing: Large DDoS Attack Against Dyn https://isc.sans.edu/forums/diary/ISC+Briefing+Large+DDoS+Attack+Against+Dyn/21627/ TCP Port 4786: Cisco Memory Leak Vulnerability https://isc.sans.edu/forums/diary/Request+for+Packets+TCP+4786+CVE20166385/21625/ Dirty Cow PoC Exploits Available https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs To register for today's SANS Technology Institute's Professional Lecture Series, pleaes e-mail [email protected]
Spam Delivered Via .ICS Files https://isc.sans.edu/forums/diary/Spam+Delivered+via+ICS+Files/21611/ Comodo OCR Errors Leads to SSL Certificate Verification Issues https://heise.de/-3354229 (german only) Oracle Quarterly Critical Patch Update http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Images Used to Exfiltrate CC Numbers From Web Stores https://blog.sucuri.net/2016/10/magento-credit-card-swiper-exports-image.html
SSL Client Hellos Soliciting SSH Banners from HAProxy https://isc.sans.edu/forums/diary/OpenSSH+Protocol+Mismatch+In+Response+to+SSL+Client+Hello/21609/ Dyre is Back as Trickbot http://www.threatgeek.com/2016/10/trickbot-the-dyre-connection.html How Stolen iPhones Are Unlocked https://www.linkedin.com/pulse/sin-card-how-criminals-unlocked-stolen-iphone-6s-renato-marinho?trk=pulse_spock-articles
Mozilla Users Reach 50% Https https://twitter.com/0xjosh/status/786971412959420424/photo/1 Retrieving LastPass Passwords From Memory https://techanarchy.net/2016/10/extracting-lastpass-site-credentials-from-memory/ Yahoo MITM Due To Weak Crossdomain.xml Configuration https://github.com/JordanMilne/YMail-Pineapple
PseudoDakrleech Uses Rig Exploit Kit to Spread Cerber https://isc.sans.edu/forums/diary/pseudoDarkleech+Rig+EK/21595/ Decoder.xls to Decode Word Malicious Macro https://isc.sans.edu/forums/diary/Analyzing+Office+Maldocs+With+Decoderxls/21601/ Auditing SSH Servers https://github.com/arthepsy/ssh-audit How Not To User HTML Purifier https://devwerks.net/blog/16/how-not-to-use-html-purifier/
