News

httpoxy Vulnerability https://isc.sans.edu/forums/diary/HTTP+Proxy+Header+Vulnerability+httpoxy/21271/ Apple Security Updates https://support.apple.com/en-us/HT201222 Toll Number Calling via Two Factor Authentication https://www.arneswinnen.net/2016/07/how-i-could-steal-money-from-instagram-google-and-microsoft/

More Python Malware Critical Juniper Vulnerability https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10755&actp=search MS16-053 Included in Neutrino Exploit Kit https://www.fireeye.com/blog/threat-research/2016/07/exploit_kits_quickly.html SSH Username Disclosure http://seclists.org/fulldisclosure/2016/Jul/51

The Power of Web Shells https://isc.sans.edu/forums/diary/The+Power+of+Web+Shells/21257/ Airtel India Intercepting Cloudflare Traffic https://medium.com/@karthikb351/airtel-is-sniffing-and-censoring-cloudflares-traffic-in-india-and-they-don-t-even-know-it-90935f7f6d98#.g78ucnpo6 WordPress SEO Pack Plugin Persistent Cross Site Scripting https://sumofpwn.nl/advisory/2016/persistent_cross_site_scripting_in_all_in_one_seo_pack_wordpress_plugin.html Github Releases synsanity SYN Flood Defense http://githubengineering.com/syn-flood-mitigation-with-synsanity/ MS16-094 Prevents Booting Linux On Microsoft Surface http://www.theregister.co.uk/2016/07/15/windows_fix_closes_rt_unlock_loophole/

Hunting for Malicious Files with MISP + OSSEC https://isc.sans.edu/forums/diary/Hunting+for+Malicious+Files+with+MISP+OSSEC/21251/ Drupal: Patch released today to fix a highly critical RCE in contributed modules https://isc.sans.edu/forums/diary/Drupal+Patch+released+today+to+fix+a+highly+critical+RCE+in+contributed+modules/21255/ Riffle anonymity network trying to compete with tor http://people.csail.mit.edu/devadas/pubs/riffle.pdf

Microsoft Patch Tuesday https://isc.sans.edu/forums/diary/Microsoft+Patch+Tuesday+Summary+for+July+2016/21249/ "Ranscam" Ransom Ware Deleted Data http://blog.talosintel.com/2016/07/ranscam.html

Hiding in White Text: Word Documents with Embedded Payloads https://isc.sans.edu/forums/diary/Hiding+in+White+Text+Word+Documents+with+Embedded+Payloads/21227/ Pokemon Go Requests "Full Access" to iOS User's Google Account http://adamreeve.tumblr.com/post/147120922009/pokemon-go-is-a-huge-security-risk Hacking Siri With Barely Audible Voice Commands https://security.cs.georgetown.edu/~tavish/hvc_usenix.pdf iOS Users Locked Out of Devices by Ransom Attacks http://www.csoonline.com/article/3093016/security/apple-devices-held-for-ransom-rumors-claim-40m-icloud-accounts-hacked.html Contact Form For Feedback https://isc.sans.edu/contact.html

Pentesters (and Attackers) Love Internet Connected Security Cameras! https://isc.sans.edu/forums/diary/Pentesters+and+Attackers+Love+Internet+Connected+Security+Cameras/21231/ Lessons Learned From Industrial Control Systems https://isc.sans.edu/forums/diary/Lessons+Learned+from+Industrial+Control+Systems/21243/ BMW Portal Insecurity http://www.vulnerability-lab.com/get_content.php?id=1736 http://www.vulnerability-lab.com/get_content.php?id=1737 Pokemon Go App Used To Rob Users https://regmedia.co.uk/2016/07/10/34798567498753.pdf Facebook Messenger End-to-End Encryption http://newsroom.fb.com/news/2016/07/messenger-starts-testing-end-to-end-encryption-with-secret-conversations/

Patchwork: Is it still "Advanced" if all you have to do is Copy/Paste? https://isc.sans.edu/forums/diary/Patchwork+Is+it+still+Advanced+if+all+you+have+to+do+is+CopyPaste/21235/ OUCH Newsletter https://securingthehuman.sans.org/resources/newsletters/ouch/2016#july2016 Discovering Malware in TLS Traffic http://arxiv.org/abs/1607.01639 TP-Link Uses tplinklogin.net Domain http://thehackernews.com/2016/07/tp-link-router-setting.html

CryptXXX Update https://isc.sans.edu/forums/diary/CryptXXX+ransomware+updated/21229/ Symantec Patches On the Way (but not fast) https://twitter.com/taviso?lang=en Android Adware/Malware https://blog.checkpoint.com/wp-content/uploads/2016/07/HummingBad-Research-report_FINAL-62916.pdf HP Updates Comware and VCX Routers https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05184351 Tracking Devices With Randomized Wifi MAC Addresses http://papers.mathyvanhoef.com/asiaccs2016.pdf

Apache Fixes Critical HTTP/2 TLS Authentication Flaw https://isc.sans.edu/forums/diary/Apache+Update+TLS+Certificate+Authentication+Bypass+with+HTTP2+CVE20164979/21223/ Gigabyte and HP Motherboards Affected by "ThinkPwn" UEFI Vulnerability https://twitter.com/al3xtjames UK Police Data Breaches https://www.bigbrotherwatch.org.uk/wp-content/uploads/2016/07/Safe-in-Police-Hands.pdf Mac Malware Uses Tor For C&C https://labs.bitdefender.com/2016/07/new-mac-backdoor-nukes-os-x-systems/ Front Door Intercom Backdoor http://www.synacktiv.ninja/ressources/NDH-Intercoms_presentation_Dudek.pdf wget arbitrary command line execution with redirects https://blogs.securiteam.com/index.php/archives/2701

Change in patterns for the pseudoDarkleech Campaign https://isc.sans.edu/forums/diary/Change+in+patterns+for+the+pseudoDarkleech+campaign/21217/ Thinkpad SMS Arbitrary Code Execution Exploit https://github.com/Cr4sh/ThinkPwn SQLLite Temp File Vulnerability http://seclists.org/fulldisclosure/2016/Jul/0 AVG Publishes Mulit-Ransomware Decryption Tool http://now.avg.com/dont-pay-the-ransom-avg-releases-six-free-decryption-tools-to-retrieve-your-files/ Euro 2016 App Leaks User's Data http://wandera.com/downloads/Euro_Paper.pdf

Phishing Campaign with Blurred Images https://isc.sans.edu/forums/diary/Phishing+Campaign+with+Blurred+Images/21207/ FoxIT Patches PDF Reader Security Flaws https://www.foxitsoftware.com/support/security-bulletins.php#content-2016 Vulnerabilities in StartCom's API https://www.computest.nl/blog/startencrypt-considered-harmful-today/ Hummer Trojan Leads Android Malware http://www.cmcm.com/blog/en/security/2016-06-29/995.html

Critical Symantec AV Vulnerabilities http://googleprojectzero.blogspot.ca/2016/06/how-to-compromise-enterprise-endpoint.html Google "My Activity" https://myactivity.google.com/myactivity Hashcat/OCLHashcat 3.0 Released https://hashcat.net/forum/thread-5559.html Lenovo Thinkpad Firmware Reverse Analysis http://blog.cr4.sh/2016/06/exploring-and-exploiting-lenovo.html Linux Privilege Escalation Vulnerabilities http://www.openwall.com/lists/oss-security/2016/06/24/5

Odd User-Agents https://isc.sans.edu/forums/diary/What+is+your+most+unusual+UserAgent/21203/ ZimbraCrypt Ransomware http://www.bleepingcomputer.com/news/security/zimbra-ransomware-written-in-python-targets-zimbra-mail-store/ Hard Drives Still Not Wiped Before Selling Them on EBay http://www2.blancco.com/en-rs-leftovers-a-data-recovery-study PhotoLogin Option For LogmeOnce https://www.logmeonce.com/photologin/

Recent Fake DDOS Threats by "Armada Collective" https://blog.cloudflare.com/empty-ddos-threats-meet-the-armada-collective/ IRS Discontinues e-Filing Pins https://www.irs.gov/uac/irs-statement-on-the-electronic-filing-pin CCTV Cameras Still A Major Threat https://blog.sucuri.net/2016/06/large-cctv-botnet-leveraged-ddos-attacks.html

"Bart" Ransomware https://isc.sans.edu/forums/diary/Bart+a+new+Ransomware/21195/ Swagger Vulnerablity https://community.rapid7.com/community/infosec/blog/2016/06/23/r7-2016-06-remote-code-execution-via-swagger-parameter-injection-cve-2016-5641 "Enriched" Voter Database Leak https://mackeeper.com/blog/post/239-another-us-voter-database-leak

Uber Vulnerabliity Summary https://labs.integrity.pt/articles/uber-hacking-how-we-found-out-who-you-are-where-you-are-and-where-you-went/ Apple Intentially Left Kernel Decrypted https://techcrunch.com/2016/06/22/apple-unencrypted-kernel/ Wordpress Fixes Various Critical Vulnerabilities https://codex.wordpress.org/Version_4.5.3 Let's Encrypt Reaching 5 Million Issued Certificates https://letsencrypt.org/2016/06/22/https-progress-june-2016.html Necurs Botnet is Back https://www.proofpoint.com/us/threat-insight/post/necurs-botnet-returns-with-updated-locky-ransomware-in-tow

Deobfuscating Java Code https://isc.sans.edu/forums/diary/Security+through+obscurity+never+works/21187/ iOS 10 Beta Not Encrypted To Aid Bug Hunters https://www.technologyreview.com/s/601748/apple-opens-up-iphone-code-in-what-could-be-savvy-strategy-or-security-screwup/ Microsoft Updates SEAL http://research.microsoft.com/en-us/people/kilai/v2.0-beta.pdf Cisco Releases Pidgin Vulnerabilities http://blog.talosintel.com/2016/06/vulnerability-spotlight-pidgin.html Libarchive vulnerabilities http://blog.talosintel.com/2016/06/the-poisoned-archives.html

Apple Airport (and Time Capsule) Update https://support.apple.com/en-us/HT201222 StartCom Adding API For Free SSL Certificates https://support.apple.com/en-us/HT201222 BitCoin Phishing With Typo Squatting Domains http://blog.cyren.com/articles/2016-Q2_bitcoin-phishing-via-google-adwords.html Google Attempting to Simplify 2 Factor Authentication http://googleappsupdates.blogspot.co.uk/2016/06/new-settings-for-2-step-verification.html

Fake SWIFT Payment Notices Used in Malicious E-Mail Campaign https://isc.sans.edu/forums/diary/Ongoing+Spam+Campaign+Related+to+Swift/21177/ RedHat Fixes Various OpenSSL Integer Overflows https://github.com/openssl/openssl/commit/a004e72b95835136d3f1ea90517f706c24c03da7 JavaScript Ransom Ware http://www.bleepingcomputer.com/news/security/the-new-raa-ransomware-is-created-entirely-using-javascript/ Triada/Horde Mobile Malware Updates http://blog.checkpoint.com/2016/06/17/in-the-wild-mobile-malware-implements-new-features/