Tech News

Sonicwall Vulnerabilities https://psirt.global.sonicwall.com/vuln-list https://blog.scrt.ch/2020/02/11/sonicwall-sra-and-sma-vulnerabilties/ SQL Server RCE Exploit https://www.mdsec.co.uk/2020/02/cve-2020-0618-rce-in-sql-server-reporting-services-ssrs/ Ransomware in Switzerland https://www.melani.admin.ch/melani/en/home/dokumentation/newsletter/sicherheitsrisiko-durch-ransomware.html Peripheral Vulnerabilities in Windows and Linux https://eclypsium.com/2020/2/18/unsigned-peripheral-firmware/

Discovering Contents of Folders Without Permission https://isc.sans.edu/forums/diary/Discovering+contents+of+folders+in+Windows+without+permissions/25816/ Ring Enforces 2FA https://blog.ring.com/2020/02/18/extra-layers-of-security-and-control/ Iranian's finally discover VPN Vulnerabilities https://www.clearskysec.com/fox-kitten/ WordPress ThemeGrill Auth Bypass https://www.webarxsecurity.com/critical-issue-in-themegrill-demo-importer/

More about Curl on Windows https://isc.sans.edu/forums/diary/curl+and+SSPI/25812/ WHO Warns of Coronavirus Phishing https://www.who.int/about/communications/cyber-security DUO Security / Google Identify Malicous Chrome Extensions https://duo.com/labs/research/crxcavator-malvertising-2020

Keep an Eye on Command-Line Browsers https://isc.sans.edu/forums/diary/Keep+an+Eye+on+CommandLine+Browsers/25804/ Old Tricks in New Bots: KBOT https://securelist.com/kbot-sometimes-they-come-back/96157/ OpenSSH Now With Fido/U2F http://www.openssh.com/txt/release-8.2

Changes to Microsoft LDAP/AD And How to Cope with them https://isc.sans.edu/forums/diary/Authmageddon+deferred+but+not+averted+Microsoft+LDAP+Changes+now+slated+for+Q3Q4+2020/25800/ https://isc.sans.edu/forums/diary/March+Patch+Tuesday+is+Coming+the+LDAP+Changes+will+Change+Your+Life/25796/ SweynTooth BLE Vulnerabilities https://asset-group.github.io/disclosures/sweyntooth/ Symantec Endpoint Protection Multiple Issues https://support.symantec.com/us/en/article.SYMSA1505.html DNSSEC Root Key Signing Ceremony Delayed https://mm.icann.org/pipermail/root-dnssec-announce/2020/000121.html

In Episode 164, Ben and Scott dive in and discuss some new features that are coming to the Office 365 Admin Center and Azure Lighthouse that are going to make your life easier if you manage more than one tenant. Sponsors Skill Me Up – Only Skill Me Up provides the bridge Read More

Malspam Pushes Ursnif https://isc.sans.edu/forums/diary/Malpsam+pushes+Ursnif+through+Italian+language+Word+docs/25792/ Safe Documents in Office 365 Advanced Threat Protection https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-docs Wordpress GDPR Cookie Consent Plugin Vulnerability https://blog.nintechnet.com/wordpress-gdpr-cookie-consent-plugin-fixed-vulnerability/ Apple Joins Fido Alliance https://fidoalliance.org/members/ https://research.kudelskisecurity.com/2020/02/12/fido2-deep-dive-attestations-trust-model-and-security/

Microsoft Patch Tuesday https://isc.sans.edu/forums/diary/Microsoft+Patch+Tuesday+for+February+2020/25790/ Adobe Patches https://helpx.adobe.com/security.html Ransomware Abuses Out of Date Driver https://news.sophos.com/en-us/2020/02/06/living-off-another-land-ransomware-borrows-vulnerable-driver-to-remove-security-software/

Paypal Phish is Asking for Everything https://isc.sans.edu/forums/diary/Current+PayPal+phishing+campaign+or+give+me+all+your+personal+information/25786/ Dell SupportAssist Client Uncontrolled Search Patch Vulnerability https://www.dell.com/support/article/ro/ro/robsdt1/sln320101/dsa-2020-005-dell-supportassist-client-uncontrolled-search-path-vulnerability?lang=en Lock My PC Used By Support Scammers https://fspro.net/lock-pc/ https://www.bleepingcomputer.com/news/security/lock-my-pc-used-by-tech-support-scammers-dev-offers-free-recovery/ Insecure Docker Registries https://unit42.paloaltonetworks.com/leaked-docker-code/

Sandbox Detection Tricks and Nice Obfuscation in a Single VBScript https://isc.sans.edu/forums/diary/Sandbox+Detection+Tricks+Nice+Obfuscation+in+a+Single+VBScript/25780/ Emotet Spreads via Wifi https://www.binarydefense.com/emotet-evolves-with-new-wi-fi-spreader/ Exploit Available for sudo pwfeedback bug https://dylankatz.com/Analysis-of-CVE-2019-18634/ xiongmail/hisilicon Vulnerability https://censys.io/blog/probing-the-xiongmai-hisilicon-soc-vulnerability

Criticial Bluetooth Vulnerability in Android (CVE-2020-0022) https://insinuator.net/2020/02/critical-bluetooth-vulnerability-in-android-cve-2020-0022/ Wacom Tablets Reports Application Details to Google https://robertheaton.com/2020/02/05/wacom-drawing-tablets-track-name-of-every-application-you-open/ Bitbucket Delivers Malware https://www.cybereason.com/blog/the-hole-in-the-bucket-attackers-abuse-bitbucket-to-deliver-an-arsenal-of-malware Realtek HD Audio Driver Package DLL Preloading https://safebreach.com/Post/Realtek-HD-Audio-Driver-Package-DLL-Preloading-and-Potential-Abuses-CVE-2019-19705

In Episode 163, Ben and Scott dive in Power Platform and the PL-900 Power Platform Fundamentals exam. Along the way, they discuss what makes up Power Platform and how you can approach learning about Power Platform. Sponsors ShareGate - ShareGate's industry-leading products help IT professionals worldwide migrate their business to Read More

Fake Browser Updates installing NetSupport RAT https://isc.sans.edu/forums/diary/Fake+browser+update+pages+are+still+a+thing/25774/ Google Android Update https://source.android.com/security/bulletin/2020-02-01#Google-Play-system-updates 5 Cisco Vulnerabilities https://www.armis.com/cdpwn/

Google Chrome 80 Released https://www.chromium.org/updates/same-site https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html File Read Vulnerablity in WhatsApp https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html HiSilicon DVR Backdoor https://habr.com/en/post/486856/

Triple Encrypted AZORult Installer https://isc.sans.edu/forums/diary/Analysis+of+a+tripleencrypted+AZORult+downloader/25768/ New sudo Vulnerability (pwfeedback) https://www.sudo.ws/alerts/pwfeedback.html Teamviewer Password Storage https://whynotsecurity.com/blog/teamviewer/

Stego and Cryptominers (with video) https://isc.sans.edu/forums/diary/Video+Stego+Cryptominers/25764/ Corona Virus Phishing / Scams https://blog.knowbe4.com/heads-up-scam-of-the-week-coronavirus-phishing-attacks-in-the-wild?nCOV-2019-bc-index https://twitter.com/briankrebs/status/1223959185764896768 Google Open Sources Security Token Software https://security.googleblog.com/2020/01/say-hello-to-opensk-fully-open-source.html

Chrome Same-Site Cookie Change https://www.chromestatus.com/feature/5088147346030592 https://docs.microsoft.com/en-us/office365/troubleshoot/miscellaneous/chrome-behavior-affects-applications https://caniuse.com/#feat=same-site-cookie-attribute Avast Apology https://blog.avast.com/a-message-from-ceo-ondrej-vlcek Magento Update https://helpx.adobe.com/security/products/magento/apsb20-02.html

Malware Using Text from Impeachment News Coverage https://www.bleepingcomputer.com/news/security/malware-tries-to-trump-security-software-with-potus-impeachment/ Coronavirus Themed Malware Targets Japan with Emotet https://twitter.com/Cryptolaemus1/status/1222388971428294656 https://exchange.xforce.ibmcloud.com/collection/18f373debc38779065a26f1958dc260b abuse.ch Offers new "I got phished" service https://igotphished.abuse.ch/ OpenSMTPD RCE Vulnerability https://www.openwall.com/lists/oss-security/2020/01/28/3

In Episode 162, Ben and Scott discuss one of the latest bad moves out of Redmond - forcefully installing the Microsoft Search in Bing extension in Google Chrome. Sponsors Skill Me Up – Only Skill Me Up provides the bridge from fundamentals to certification paths to advanced skills to accelerate digital transformation Read More

Recent Emotet Infection installs Trickbot https://isc.sans.edu/forums/diary/Emotet+epoch+1+infection+with+Trickbot+gtag+mor84/25752/ Apple Updates https://support.apple.com/en-us/HT201222 Zoom Fixes Video Conferencing Brute Forcing Vulnerability https://www.theregister.co.uk/2020/01/28/zoom_eavesdrop_hack/ Intel Fixes Yet Another Information Leakage Flaw https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00329.html https://cacheoutattack.com/ Avast Anti Virus Selling User's Browsing Data https://www.vice.com/en_us/article/qjdkq7/avast-antivirus-sells-user-browsing-data-investigation