Tech News

Safely Resetting Routers https://isc.sans.edu/forums/diary/Resetting+Your+Router+the+Paranoid+Right+Way/23719/ CSS mix-blend-mode Side Channel Attack https://www.evonide.com/side-channel-attacking-browsers-through-css3-features/ New ActiveX Exploit Seen in the Wild https://www.krcert.or.kr/data/secNoticeView.do?bulletin_writing_sequence=27263 Apple iMessage Security https://support.apple.com/en-us/HT202303 10 Year Old Vulnerability in Steam Discovered https://www.contextis.com/blog/frag-grenade-a-remote-code-execution-vulnerability-in-the-steam-client

In Episode 67, Ben and Scott are joined by Adam Harmetz where they discuss the latest updates and announcements from SharePoint Conference 2018, including SharePoint spaces, improvements to the Modern UI, SharePoint Lists, and AI. Sponsors Office365AdminPortal.com - Providing admins the knowledge and tools to run Office 365 successfully Intelligink Read More

Windows JScript Vulnerability https://www.zerodayinitiative.com/advisories/ZDI-18-534/ Two Git Vulnerabilities Patched https://marc.info/?l=git&m=152761328506724&w=2 https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/ SpamCannibal Blacklist Temporarily Marks All IPs as "Spam" https://twitter.com/GossiTheDog/status/1001778042400854016 QRadar Remote Code Execution https://blogs.securiteam.com/index.php/archives/3689

New DNS Features https://isc.sans.edu/forums/diary/DNS+is+Changing+Are+you+Ready/23711/ Apple Updates https://support.apple.com/en-us/HT201222 Scans For Misconfigured EOS Blockchain Nodes https://www.bleepingcomputer.com/news/security/misconfigured-eos-blockchain-nodes-under-attack/ NPM Bug Causes Update Failures / Application Crashes https://github.com/npm/npm/issues/20791#issuecomment-392648459 MnuBot Exfiltrates Data Via MSSQL https://securityintelligence.com/new-banking-trojan-mnubot-discovered-by-ibm-x-force-research/

In Episode 66, Ben and Scott are joined by Stephen Rose where they discuss the latest updates and announcements from SharePoint Conference 2018, including OneDrive for Business multi-geo support, improvements to the sharing experience, and reporting. Sponsors Office365AdminPortal.com - Providing admins the knowledge and tools to run Office 365 successfully Read More

Ultrasound Mobile Location Tracking https://isc.sans.edu/forums/diary/Do+you+hear+Laurel+or+Yanny+or+is+it+OnOff+Keying/23707/ Analyzing Malware Created with NSIS https://isc.sans.edu/forums/diary/Quick+analysis+of+malware+created+with+NSIS/23703/ Obfuscated Word Macro https://isc.sans.edu/forums/diary/Antivirus+Evasion+Easy+as+123/23701/ Z-Wave Attacks https://www.pentestpartners.com/security-blog/z-shave-exploiting-z-wave-downgrade-attacks/ https://www.silabs.com/community/blog.entry.html/2018/05/23/tl_dr_your_door_is-g1zC Electron Framework Protocol Handler Patch Bypass https://blog.doyensec.com/2018/05/24/electron-win-protocol-handler-bug-bypass.html

In Episode 65, Ben and Scott are joined by Mark Kashman where they discuss the latest updates and announcements from SharePoint Conference 2018. Sponsors Office365AdminPortal.com - Providing admins the knowledge and tools to run Office 365 successfully Intelligink - We focus on the Microsoft Cloud so you can focus on Read More

GDPR Going Into Effect May 25th https://en.wikipedia.org/wiki/General_Data_Protection_Regulation Bitcoin Gold Double Spent Attack https://forum.bitcoingold.org/t/double-spend-attack-on-exchanges/1362 Amazon Alexa Forwards Random Conversations https://www.kiro7.com/news/local/woman-says-her-amazon-device-recorded-private-conversation-sent-it-out-to-random-contact/755507974 Verge Crypto Coin Attacked Again https://www.bleepingcomputer.com/news/security/verge-cryptocurrency-network-falls-victim-to-same-attack-even-after-hard-fork/

In Episode 64, Ben and Scott lost the rails, found the rails, and then fell off of them again. Sponsors Office365AdminPortal.com - Providing admins the knowledge and tools to run Office 365 successfully Intelligink - We focus on the Microsoft Cloud so you can focus on your business Show Notes Read More

VPNFilter Malware Affecting Cisco Routers https://blog.talosintelligence.com/2018/05/VPNFilter.html DLink Vulnerabilities https://securelist.com/backdoors-in-d-links-backyard/85530/ Firefox Disabling "Spy APIs" and enabling 2FA https://www.fxsitecompat.com/en-CA/docs/2018/ambient-light-and-proximity-sensor-apis-have-been-disabled/

Malicious SYLK Files Used to Execute Code in Excel https://isc.sans.edu/forums/diary/Malware+Distributed+via+slk+Files/23687/ BMW Releases Patches for Several Cars https://keenlab.tencent.com/en/Experimental_Security_Assessment_of_BMW_Cars_by_KeenLab.pdf Mac Crypto Miners https://blog.malwarebytes.com/threat-analysis/mac-threat-analysis/2018/05/new-mac-cryptominer-uses-xmrig/ VMWare Spectre Updates https://www.vmware.com/security/advisories/VMSA-2018-0012.html

Spectre NG Patches https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180012 https://newsroom.intel.com/editorials/addressing-new-research-for-side-channel-analysis/ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180012 https://bugs.chromium.org/p/project-zero/issues/detail?id=1528 New "Moon" Variant http://blog.netlab.360.com/gpon-exploit-in-the-wild-iv-themoon-botnet-join-in-with-a-0day/ https://isc.sans.edu/forums/diary/Something+Wicked+this+way+comes/23681/ Extracting Keys From Windows ssh-agent https://blog.ropnop.com/extracting-ssh-private-keys-from-windows-10-ssh-agent/

Redis Cryptocoin Mining Worm https://isc.sans.edu/forums/diary/Anatomy+of+a+Redis+mining+worm/23673/ Evolving Chrome's Security Indicator https://blog.chromium.org/2018/05/evolving-chromes-security-indicators.html DrayTek CSRF 0-Day Exploited to Change DNS Servers https://www.draytek.co.uk/support/security-advisories/kb-advisory-csrf-and-dns-dhcp-web-attacks Rowhammer Remote Exploit https://www.cs.vu.nl/~herbertb/download/papers/throwhammer_atc18.pdf https://arxiv.org/abs/1805.04956

Claymore Miner Attack https://isc.sans.edu/diary/Insecure+Claymore+Miner+Management+API+Exploited+in+the+Wild/23665/ PCI DSS Version 3.2.1. Released https://isc.sans.edu/forums/diary/PCI+DSS+version+321+is+out/23667/ Keeper Releases Update https://keepersecurity.com/blog/2018/05/15/response-may-15-seclists-report/ Cisco Security Update https://tools.cisco.com/security/center/publicationListing.x

In Episode 63, Ben and Scott lament the end of life announcement for the integration of third-party audio conferencing providers (ACP) with Skype for Business. Sponsors Join Ben and Scott at SharePoint Conference North America. Register today at sharepointna.com with the code SHOAG and save $50 on your registration. Office365AdminPortal.com Read More

Critical DHCP Client Vulnerability in RedHat Enterprise Server 6/7 https://access.redhat.com/security/vulnerabilities/3442151 UPnP Misconfiguration DDoS Attack https://www.theregister.co.uk/2018/05/16/upnp_amplifies_ddos_attacks/ Ubuntu Snap Store Miner Incident Followup https://blog.ubuntu.com/2018/05/15/trust-and-security-in-the-snap-store iOS / Android "Zipper Down" Vulnerability https://zipperdown.org/

PDF Exploit (and Windows Priv. Escalation) Leaked https://www.welivesecurity.com/2018/05/15/tale-two-zero-days/ Possible Vulnerability in Keeper Password Manager http://seclists.org/fulldisclosure/2018/May/41 MyEtherWallet Phishing https://isc.sans.edu/forums/diary/Phishing+emails+for+fake+MyEtherWallet+login+page/23655/

PGP/SMIME efail Vulnerability https://efail.de Adobe PDF Reader / Acrobat Bulletins https://helpx.adobe.com/security/products/acrobat/apsb18-09.html

Odd njRat Like Scans Reversed C2 traffic from China Signal Vulnerability (Possibly in Electron, which affects Skype/Slack/others) https://twitter.com/ortegaalfredo/status/995017143002509313 Electron Vulnerability https://www.trustwave.com/Resources/SpiderLabs-Blog/CVE-2018-1000136---Electron-nodeIntegration-Bypass/ Cryptocoin Miner Found in Ubuntu Snap Store https://github.com/canonical-websites/snapcraft.io/issues/651

DNS Exfiltration in Windows https://isc.sans.edu/forums/diary/Exfiltrating+data+from+very+isolated+environments/23645/ Fake Electrun Wallet https://github.com/spesmilo/electrum-docs/blob/master/decompiling_guide.md Treasure Hunter PoS Malware Source Code Leaked https://www.flashpoint-intel.com/blog/treasurehunter-source-code-leaked/ More Malicious Chrome Extensions Spreading via Facebook https://blog.radware.com/security/2018/05/nigelthorn-malware-abuses-chrome-extensions/