News

WiFi Still Remains a Good Attack Vector https://isc.sans.edu/forums/diary/WiFi+Still+Remains+a+Good+Attack+Vector/21583/ AVTECH IP Camera Vulnerabilities http://seclists.org/bugtraq/2016/Oct/26 SAP Patches 3 Year Old Bug in P4 https://erpscan.com/press-center/blog/sap-cyber-threat-intelligence-report-october-2016/ 1024 bit DSA Keys Factored https://eprint.iacr.org/2016/961.pdf

Microsoft and Adobe Patches https://isc.sans.edu/mspatchdays.html?viewday=2016-10-11 https://helpx.adobe.com/security/products/acrobat/apsb16-33.html http://www.minixforum.com/threads/neo-z64w-doesnt-start-anymore-after-windows-10-update-help.14122/ Review of Browsers SSL Failures https://docs.google.com/document/d/1b7lenmn5XO06QohaJzVffnJxjXjY1rD70wg34gfuxRo/edit#heading=h.w6vk76mv9e6n New Malware Targeting SWIFT Users http://www.symantec.com/connect/blogs/odinaff-new-trojan-used-high-level-financial-attacks

Radare's Rehash Utility CAn calculate File Entropy https://isc.sans.edu/forums/diary/Radare2+rahash2/21577/ Spoofing IPs Still works https://idea.popcount.org/2016-09-20-strange-loop---ip-spoofing/ EU Commission Plants IoT Labeling http://www.euractiv.com/section/innovation-industry/news/commission-plans-cybersecurity-rules-for-internet-connected-machines/

First Hurricane Matthew Phish Impersonating Stripe https://isc.sans.edu/forums/diary/First+Hurricane+Matthew+related+Phish/21571/ Samsung Galaxy S6 "KNOXOut" Vulnerability http://media.wix.com/ugd/4e84e6_668d564cc447434a9a8fda3c13a63f6a.pdf Windows 10 Anniversary Edition Improves IE 10 XSS Protection http://mksben.l0.cm/2016/10/xss-via-referrer.html

More Honeypot Fun https://isc.sans.edu/forums/diary/Checking+my+honeypot+day/21561/ OS X Webcam Exploit https://objective-see.com/products/oversight.html iOS 10 Private Browsing https://www.intaforensics.com/2016/09/30/ios-10-private-browsing-how-private-is-it/ Hacked Steam Accounts Used to Spread Malware http://www.bleepingcomputer.com/news/security/hacked-steam-accounts-spreading-remote-access-trojan/ Please Report Any Hurricane Matthew Related Malware/Scams https://isc.sans.edu/contact.html

Securing the Human Newsletter https://securingthehuman.sans.org/newsletters/ouch/issues/OUCH-201610_en.pdf "Security Fatigue" https://www.nist.gov/news-events/news/2016/10/security-fatigue-can-cause-computer-users-feel-hopeless-and-act-recklessly "Selfi Pay" Facial Recognition http://www.theregister.co.uk/2016/10/05/mastercard_selfie_pay/ "MarsJoke" Ransomware Decrypted https://threatpost.com/researchers-break-marsjoke-ransomware-encryption/121022/

SSL Requests to Non-SSL Web Servers https://isc.sans.edu/forums/diary/SSL+Requests+to+nonSSL+HTTP+Servers/21551/ Insulin Pump Vulnerablities https://community.rapid7.com/community/infosec/blog/2016/10/04/r7-2016-07-multiple-vulnerabilities-in-animas-onetouch-ping-insulin-pump SSH Konami Codes http://pen-testing.sans.org/blog/2015/11/10/protected-using-the-ssh-konami-code-ssh-control-sequences Cyber Security Awareness Month https://securingthehuman.sans.org/blog/2016/10/02/week01-kicking-off-ncsam/ OpenJPEG Flaw http://blog.talosintel.com/2016/09/vulnerability-spotlight-jpeg2000.html

Password Buddies https://isc.sans.edu/forums/diary/Password+Buddies+A+Better+Way+To+Reset+Passwords/21547/ iMessage Data Leakage http://rsmck.co.uk/blog/imessage-preview/ Exploiting HP Thin Client http://blog.malerisch.net/2016/10/pwning-thin-client-in-less-two-minutes2-cve2016-2246.html

The Short Life of a Vulnerable DVR Connected to the Internet https://isc.sans.edu/forums/diary/The+Short+Life+of+a+Vulnerable+DVR+Connected+to+the+Internet/21543/ Another Day, Another Malicious Behaviour https://isc.sans.edu/forums/diary/Another+Day+Another+Malicious+Behaviour/21539/ Capcom's Streetfighter V Anti Cheat Tool Allows Privilege Escalation https://twitter.com/TheWack0lian/status/779397840762245124/photo/1?ref_src=twsrc%5Etfw Apple Joins Mozilla In Distrusting WoSign https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/lWJ1zdUJPLI "Footprints" Browser Extension Demonstrate Unmasking User's Idendity https://footprints.stanford.edu

Turning the lights off with SNMP https://isc.sans.edu/forums/diary/SNMP+Pwn3ge/21533/ Yahoo! Anwers Used in Command and Control Networks http://researchcenter.paloaltonetworks.com/2016/09/unit42-confucius-says-malware-families-get-further-by-abusing-legitimate-websites/ Dlink Router Includes Stupid Simple UDP Backdoor https://pierrekim.github.io/blog/2016-09-28-dlink-dwr-932b-lte-routers-vulnerabilities.html Hikvision XXE Vulnerability https://medium.com/@iraklis/an-unlikely-xxe-in-hikvisions-remote-access-camera-cloud-d57faf99620f#.qukzihoew

Rig Exploit Kit Used to Spread Locky Ransomware https://isc.sans.edu/forums/diary/Rig+Exploit+Kit+from+the+Afraidgate+Campaign/21531/ Facebook Releases osquery for Windows https://blog.trailofbits.com/2016/09/27/windows-network-security-now-easier-with-osquery/ Update Cowrie and "New" Default Password used in Internet Wide Scans https://isc.sans.edu/ssh.html?pw=xc3511 BIND Name Server Update https://kb.isc.org/article/AA-01393/74/CVE-2016-2775%3A-A-query-name-which-is-too-long-can-cause-a-segmentation-fault-in-lwresd.html Various Cisco DoS Vulnerabilities https://tools.cisco.com/security/center/publicationListing.x?product=NonCisco#~Vulnerabilities

Back in Time Memory Forensics https://isc.sans.edu/forums/diary/Back+in+Time+Memory+Forensics/21527/ Cameras Responsible For Large DDoS Attacks https://twitter.com/olesovhcom/status/779297257199964160 Google Releases CSP Support Tools https://csp-evaluator.withgoogle.com https://chrome.google.com/webstore/detail/csp-mitigator Microsoft Launches "fuzzing-as-a-service" https://www.microsoft.com/en-us/springfield/

Decompiling P-Code https://isc.sans.edu/forums/diary/VBA+and+Pcode/21521/ Lenovo To Add FIDO Compliant Fingerprint Reader http://www.theregister.co.uk/2016/09/26/intel_and_lenovo_give_the_finger_to_passwords_with_fido/ More Details On Simpler Password Hasing in iOS 10 https://twitter.com/thorsheim/status/779207177416351744 Mozilla to Remove WoSign and StartCom From Trusted List https://docs.google.com/document/d/1C6BlmbeQfn4a9zydVi2UvjBGv6szuSB4sMYUcVrR8vQ/preview

Analyzing Malicious .PUB files https://isc.sans.edu/forums/diary/PUB+Analysis/21517/ iOS 10 Backup Passwords Easier to Crack http://blog.elcomsoft.com/2016/09/ios-10-security-weakness-discovered-backup-passwords-much-easier-to-break/ Windows 10 Certificate Pinning of Microsoft Domains http://hexatomium.github.io/2016/09/24/hidden-w10-pins/ IBM Geoblocking Fail For Australian Census http://www.aph.gov.au/DocumentStore.ashx?id=124f22ba-caaa-46ff-899d-7d96851fee3e&subId=414127 97% Of Fortune 1000 Companies Have Leaked Credentials http://info.digitalshadows.com/rs/457-XEY-671/images/CompromisedCredentials-LearnFromtheExposureoftheWorlds1000BiggestCompanies-Download.pdf

OpenSSL Security Update https://isc.sans.edu/forums/diary/OpenSSL+Update+Released/21509/ ATM Skimmer Prototypes To Collect Fingerprints https://securelist.com/files/2016/09/16_09_en.pdf Yahoo! Breach Leaks 500M User's Data https://yahoo.tumblr.com/post/150781911849/an-important-message-about-yahoo-user-security

Those never-ending waves of Locky Malspam https://isc.sans.edu/forums/diary/Those+neverending+waves+of+Locky+malspam/21505/ Windows Anti Malware Scan Interface (AMSI) http://www.labofapenetrationtester.com/2016/09/amsi.html Cloudflare Intorducing SSL Re-Write https://blog.cloudflare.com/opportunistic-encryption-bringing-http-2-to-the-unencrypted-web/ Australian Police Warns of Malicious USB Sticks https://www.vicpolicenews.com.au/news/harmful-usb-drives-found-in-letterboxes

MacOS Sierra and Safari 10 Released https://isc.sans.edu/forums/diary/Getting+Ready+for+macOS+Sierra+Upgrade+Securely/21465/ BackConnect BGP Hijacks http://research.dyn.com/2016/09/backconnects-suspicious-bgp-hijacks/ Metasploit Vulnerablity https://github.com/justinsteven/advisories/blob/master/2016_metasploit_rce_static_key_deserialization.md

Taking Over Facebook Pages http://arunsureshkumar.me/index.php/2016/09/16/facebook-page-takeover-zero-day-vulnerability/ Exchange Auto-Discovery Vulnerability http://www.theregister.co.uk/2016/09/19/ms_exchange_alleged_bug/ Spyware Apps Targeting Travelers Removed From Goolge App Store https://blog.lookout.com/blog/2016/09/16/embassy-spyware-google-play/ Firefox Will Patch HSTS Vulnerability https://threatpost.com/mozilla-patching-firefox-certificate-pinning-vulnerability/120694/ OpenSSL Patch Pre-Announcement https://mta.openssl.org/pipermail/openssl-announce/2016-September/000076.html

Cisco Issues Advisories for IKEv1 "heartbleed like" Vulnerability https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1 Intercepting OS X Passwords https://www.scriptjunkie.us/2016/09/intercepting-passwords-to-escalate-privileges-on-os-x/ Vulnerabilities Introduced By Converting 32 Bit to 64 Bit https://www.tu-braunschweig.de/Medien-DB/sec/pubs/2016-ccs.pdf HSTS Preload Database and Webservices https://hstspreload.com

Locky Ransomware Updates https://blog.avira.com/locky-ransomware-goes-autopilot/ https://blogs.forcepoint.com/security-labs/locky-distributor-uses-newly-released-quant-loader-sold-russian-underground https://isc.sans.edu/forums/diary/Is+2+out+of+3+good+enough+for+AntiMalware/21485/ Critical Update For Cisco WebEx Server https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160914-wem Dualtoy Malware Attacks iOS and Android http://researchcenter.paloaltonetworks.com/2016/09/dualtoy-new-windows-trojan-sideloads-risky-apps-to-android-and-ios-devices/ Certificate Pinning Issue in Firefox/Tor Browser https://hackernoon.com/tor-browser-exposed-anti-privacy-implantation-at-mass-scale-bd68e9eb1e95#.9jnte0u52