SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Fileless Excel Malware https://isc.sans.edu/forums/diary/Malicious+Excel+Delivering+Fileless+Payload/26232/ Windows Update Issues https://support.microsoft.com/en-us/help/4566779/usb-printer-port-missing-after-disconnecting-printer-while-windows-10 https://answers.microsoft.com/en-us/windows/forum/all/cumulative-updates-june-9th-2020/45a8a7f3-cb89-459e-acf1-32d9de15c099 Privnote.com Phishing https...

Anti-Debugging JavaScript Techniques https://isc.sans.edu/forums/diary/AntiDebugging+JavaScript+Techniques/26228/ Facebook Messenger Desktop App Vulnerability https://blog.reasonsecurity.com/2020/06/11/persistence-method-using-facebook-messenger-desktop-app/ Outlook Massmailing Macros https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/ STI Student Research: Dennis Taggard; Eb...

Job Application Themed Malspam Pushes ZLoader https://isc.sans.edu/forums/diary/Job+applicationthemed+malspam+pushes+ZLoader/26222/ More Expiring Root CAs https://scotthelme.co.uk/impending-doom-root-ca-expiring-legacy-clients/ Black Lives Matter Themed Malware https://www.bleepingcomputer.com/news/security/fake-black-lives-matter-voting-campaign-spreads-trickbot-malware/

Microsoft Patch Day https://isc.sans.edu/forums/diary/Microsoft+June+2020+Patch+Tuesday/26220/ SMBleed https://github.com/ZecOps/CVE-2020-1206-POC Adobe Patches https://helpx.adobe.com/security.html Intel Patch Day https://blogs.intel.com/technology/2020/06/ipas-security-advisories-for-june-2020/?linkId=100000012832617

Translating BASE64 Obfuscated Scripts https://isc.sans.edu/forums/diary/Translating+BASE64+Obfuscated+Scripts/26214/ Fake Ransomware Decryptor https://www.bleepingcomputer.com/news/security/fake-ransomware-decryptor-double-encrypts-desperate-victims-files/ GNUTLS TLS 1.3 Machine in the Middle https://gitlab.com/gnutls/gnutls/-/issues/1011 CallStranger UPNP Vulnerability https://callstranger.com/ S...

PHP FastCGI Attacks https://isc.sans.edu/forums/diary/Not+so+FastCGI/26208/ Protest Cybersecurity https://isc.sans.edu/forums/diary/Cyber+Security+for+Protests/26210/ uBlock Origin Blocks Portscans https://www.bleepingcomputer.com/news/security/ublock-origin-ad-blocker-now-blocks-port-scans-on-most-sites/ QNAP Vulnerability https://www.qnap.com/en/security-advisory/qsa-20-01

Anti-Debugging Technique Based on Memory Protection https://isc.sans.edu/forums/diary/AntiDebugging+Technique+based+on+Memory+Protection/26200/ Suspending Suspicious Domain Feed/Update to Researcher IP Feed https://isc.sans.edu/forums/diary/Suspending+Suspicious+Domain+Feed+Update+to+Researcher+IP+Feed/26204/ Bank Transaction Comments Used for Abusive Messages https://www.theregister.com/2020/06/0...

Polish Malspam Pushes ZLoader Malware https://isc.sans.edu/forums/diary/Polish+malspam+pushes+ZLoader+malware/26196/ Cisco Patches IP-in-IP Flaw https://securityaffairs.co/wordpress/104192/security/ip-in-ip-flaw-cisco.html Zoom Fixes Two Critical Flaws https://blog.talosintelligence.com/2020/06/vuln-spotlight-zoom-code-execution-june-2020.html Firefox Disables Automatic DNS over HTTPS Selection to...

Type 2 Strackstrings https://isc.sans.edu/forums/diary/Stackstrings+type+2/26192/ More Details About AddTrust External CA Root Expiration https://www.agwa.name/blog/post/fixing_the_addtrust_root_expiration VMWare Cloud Director Vulnerability and Exploit https://citadelo.com/en/blog/full-infrastructure-takeover-of-vmware-cloud-director-CVE-2020-3956/

Apple Patches Unc0ver https://support.apple.com/en-us/HT201222 Office 365 Adds Details About Malicious E-Mail Attachments https://www.microsoft.com/en-us/microsoft-365/roadmap?filters=&searchterms=64570 Impact of Research on Our Data https://isc.sans.edu/forums/diary/The+Impact+of+Researchers+on+Our+Data/26182/

Sectigo AddTrust CA Expired https://support.sectigo.com/articles/Knowledge/Sectigo-AddTrust-External-CA-Root-Expiring-May-30-2020 Critical Sign In With Apple Flaw https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-apple/ DABANGG: Refined Flush Based Cache Attacks https://www.cse.iitk.ac.in/users/biswap/DABANGG.pdf New Website Explaining FIDO https://loginwithfido.com/

USBFuzz Finds Numerous USB Flaws https://www.nebelwelt.net/files/20SEC3.pdf Cisco Products Vulnerable to Saltstack Vulnerability https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG Another Nail in the Coffin for SHA-1 https://eprint.iacr.org/2020/014.pdf STI Student: Andy Piazza; Qualifying Threat Actor Assessments https://www.sans.org/reading-room/whitepap...

Phishing With Google Cloud https://isc.sans.edu/forums/diary/Frankensteins+phishing+using+Google+Cloud+Storage/26174/ Trend Micro AntiVirus Blocked by Microsoft https://billdemirkapi.me/How-to-use-Trend-Micro-Rootkit-Remover-to-Install-a-Rootkit/ Netgear Nighthawk Firmware Update Vulnerability https://iot-lab-fh-ooe.github.io/netgear_update_vulnerability/

Where is SHA3 https://isc.sans.edu/forums/diary/Seriously+SHA3+where+art+thou/26170/ Apple Updates https://support.apple.com/en-us/HT201222 Google ZDI Releases Details Regarding Unpatched Windows Vulnerabilities https://www.zerodayinitiative.com/advisories/ZDI-20-666/ https://www.zerodayinitiative.com/advisories/ZDI-20-665/ https://www.zerodayinitiative.com/advisories/ZDI-20-663/ https://www.zerod...

Malicious PowerPoint Add-Ins Deliver Malware https://isc.sans.edu/forums/diary/AgentTesla+Delivered+via+a+Malicious+PowerPoint+AddIn/26162/ Virtual Machine Delivers Malware https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/ iOS Patch Analysis https://blog.zecops.com/vulnerabilities/hidden-demons-maildemon-patch-analysis-ios-13-4-5-beta-vs-i...

Malware Triage with FLOSS: API Calls Based Behavior https://isc.sans.edu/forums/diary/Malware+Triage+with+FLOSS+API+Calls+Based+Behavior/26156/ Verizon Breach Report https://enterprise.verizon.com/resources/reports/dbir/ Apple Updates https://support.apple.com/en-us/HT201222 Sophos Firewall Vulnerability Exploit https://news.sophos.com/en-us/2020/05/21/asnarok2/

IceID Malware Update https://isc.sans.edu/forums/diary/Microsoft+Word+document+with+malicious+macro+pushes+IcedID+Bokbot/26146/ NXNSAttack DNS Amplification https://www.nxnsattack.com/ https://en.blog.nic.cz/2020/05/19/nxnsattack-upgrade-resolvers-to-stop-new-kind-of-random-subdomain-attack/ Adobe Updates https://helpx.adobe.com/security.html

Spike of Scans for Port 62234 https://isc.sans.edu/forums/diary/What+is+up+on+Port+62234/26144/ Cisco Patches https://tools.cisco.com/security/center/publicationListing.x https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-info-disclose-9eJtycMB Google Chrome 83 Released https://chromereleases.googleblog.com/ QNAP Vulnerability Details Released https://medium.com/...

Antivirus & Multiple Detections https://isc.sans.edu/forums/diary/Antivirus+Multiple+Detections/26134/ Office 365 Returning Search Results from Other Organizations https://www.theregister.co.uk/2020/05/18/microsoft_office_365_internal_search_mixup/ MagicPairing Vulnerabilities https://arxiv.org/pdf/2005.07255.pdf BIAS: Bluetooth Impersonation AttackS https://francozappa.github.io/about-bias/

OWA Scans https://isc.sans.edu/forums/diary/Scanning+for+Outlook+Web+Access+OWA+Microsoft+Exchange+Control+Panel+ECP/26132/ Edison iOS E-Mail Client Leaks Data https://www.theverge.com/2020/5/16/21260967/edison-mail-update-ios-security-bug COMpfun Malware Uses Status Codes to Communicate https://securelist.com/compfun-http-status-based-trojan/96874/ PAN OS Patches https://securityaffairs.co/wordpr...

Rethinking Severity https://isc.sans.edu/forums/diary/Patch+Tuesday+Revisited+CVE20201048+isnt+as+Medium+as+MS+Would+Have+You+Believe/26124/ Top Exploited Vulnerabilities https://www.us-cert.gov/ncas/alerts/aa20-133a Zerodium Drops Payouts For iOS/Safari Exploits https://twitter.com/Zerodium/status/1260541578747064326?s=20 BigIP Edge Client Vulenrability https://support.f5.com/csp/article/K2034607...

Malspam with Links to ZIP Archives Pushes Dridex Malware https://isc.sans.edu/forums/diary/Malspam+with+links+to+zip+archives+pushes+Dridex+malware/26116/ Ramsay Cyber Espionage Toolkit https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/ Windows DNS over HTTPS Preview https://techcommunity.microsoft.com/t5/networking-blog/windows-insiders-can-now-test-dns-ov...

Microsoft Patch Tuesday https://isc.sans.edu/forums/diary/Microsoft+May+2020+Patch+Tuesday/26114/ Adobe Security Updates https://helpx.adobe.com/security.html Android Applications Expose Firebase Databases https://www.comparitech.com/blog/information-security/firebase-misconfiguration-report/#What_data_is_exposed More Magecart Sighted https://maxkersten.nl/2020/05/06/backtracking-magecart-infectio...

Excel 4 Macro Analysis: XLMMacroDeobfuscator https://isc.sans.edu/forums/diary/Excel+4+Macro+Analysis+XLMMacroDeobfuscator/26110/ LinkedIn Phish https://youtu.be/g0WHz6rikoc ThunderSpy Thunderbolt Attack https://thunderspy.io/ vBulletin Vulnerability https://nvd.nist.gov/vuln/detail/CVE-2020-12720 Mini-Netwars https://www.sans.org/mini-netwars

YARA 4.0.0 Released https://isc.sans.edu/forums/diary/YARA+v400+BASE64+Strings/26106/ VMWare Patches vRealize to Address Saltstack Vulnerabilities https://www.vmware.com/security/advisories/VMSA-2020-0009.html Samsung Paches Android RCE Vulnerabilities https://bugs.chromium.org/p/project-zero/issues/detail?id=2002 https://security.samsungmobile.com/securityUpdate.smsb MacOS 2FA Application Trojan...