SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Ultrasonic Triggers for Cellphone Assistants. https://source.wustl.edu/2020/02/surfing-attack-hacks-siri-google-with-ultrasonic-waves/ Comparing Information Leakage from Different Browsers https://www.scss.tcd.ie/Doug. Leith/pubs/browser_privacy.pdf Cloud Snooper Attack https://news.sophos.com/en-us/2020/02/25/cloud-snooper-attack-bypasses-firewall-security-measures/

Kr00k WiFi Attack https://www.eset.com/int/kr00k/ Impersonating LTE Users https://imp4gt-attacks.net/ Zyxel RCE Vulnerablity https://www.kb.cert.org/vuls/id/498544/

Fraudulant Paypal Charges (links in German) https://twitter.com/iblueconnection/status/1232259071602044928 https://www.heise.de/security/meldung/Google-Pay-Luecke-in-virtuellen-Kreditkarten-erlaubt-unberechtigte-Abbuchungen-4667527.html https://stadt-bremerhaven.de/google-pay-virtuelle-paypal-kreditkarten-weisen-sicherheitsluecken-auf/ Chrome Update https://chromereleases.googleblog.com/2020/02/st...

ScrollToTextFragment Privacy Concerns in Google Chrome 80 https://github.com/WICG/ScrollToTextFragment/issues/76#issue-538137989 https://docs.google.com/document/d/1YHcl1-vE_ZnZ0kL2almeikAj2gkwCq8_5xwIae7PVik/edit#heading=h.uoiwg23pt0tx Another OpenSMTPD Vulnerability https://github.com/OpenSMTPD/OpenSMTPD/releases WhatsApp Group Invite Links in Search Engines https://twitter.com/JordanWildon/stat...

Old Style Excel Macro Malware https://isc.sans.edu/forums/diary/Maldoc+Excel+4+Macros+in+OOXML+Format/25830/ Simple But Efficient VBScript Obfuscation https://isc.sans.edu/forums/diary/Simple+but+Efficient+VBScript+Obfuscation/25828/ Let's Encrypt Beefs Up Validation https://letsencrypt.org/2020/02/19/multi-perspective-validation.html Google Play Store Joker / Clicken Malware https://research.chec...

Enumerating Who "Owns" a Workstation for IR https://isc.sans.edu/forums/diary/Whodat+Enumerating+Who+owns+a+Workstation+for+IR/25822/ Special Update for Adobe After Effects and Media Encoder https://helpx.adobe.com/security/products/after_effects/apsb20-09.html https://helpx.adobe.com/security/products/media-encoder/apsb20-10.html Cisco Updates https://tools.cisco.com/security/center/content/Cisco...

Sonicwall Vulnerabilities https://psirt.global.sonicwall.com/vuln-list https://blog.scrt.ch/2020/02/11/sonicwall-sra-and-sma-vulnerabilties/ SQL Server RCE Exploit https://www.mdsec.co.uk/2020/02/cve-2020-0618-rce-in-sql-server-reporting-services-ssrs/ Ransomware in Switzerland https://www.melani.admin.ch/melani/en/home/dokumentation/newsletter/sicherheitsrisiko-durch-ransomware.html Peripheral Vu...

Discovering Contents of Folders Without Permission https://isc.sans.edu/forums/diary/Discovering+contents+of+folders+in+Windows+without+permissions/25816/ Ring Enforces 2FA https://blog.ring.com/2020/02/18/extra-layers-of-security-and-control/ Iranian's finally discover VPN Vulnerabilities https://www.clearskysec.com/fox-kitten/ WordPress ThemeGrill Auth Bypass https://www.webarxsecurity.com/criti...

More about Curl on Windows https://isc.sans.edu/forums/diary/curl+and+SSPI/25812/ WHO Warns of Coronavirus Phishing https://www.who.int/about/communications/cyber-security DUO Security / Google Identify Malicous Chrome Extensions https://duo.com/labs/research/crxcavator-malvertising-2020

Keep an Eye on Command-Line Browsers https://isc.sans.edu/forums/diary/Keep+an+Eye+on+CommandLine+Browsers/25804/ Old Tricks in New Bots: KBOT https://securelist.com/kbot-sometimes-they-come-back/96157/ OpenSSH Now With Fido/U2F http://www.openssh.com/txt/release-8.2

Changes to Microsoft LDAP/AD And How to Cope with them https://isc.sans.edu/forums/diary/Authmageddon+deferred+but+not+averted+Microsoft+LDAP+Changes+now+slated+for+Q3Q4+2020/25800/ https://isc.sans.edu/forums/diary/March+Patch+Tuesday+is+Coming+the+LDAP+Changes+will+Change+Your+Life/25796/ SweynTooth BLE Vulnerabilities https://asset-group.github.io/disclosures/sweyntooth/ Symantec Endpoint Prote...

Malspam Pushes Ursnif https://isc.sans.edu/forums/diary/Malpsam+pushes+Ursnif+through+Italian+language+Word+docs/25792/ Safe Documents in Office 365 Advanced Threat Protection https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-docs Wordpress GDPR Cookie Consent Plugin Vulnerability https://blog.nintechnet.com/wordpress-gdpr-cookie-consent-plugin-fixed-vulnerability/ A...

Microsoft Patch Tuesday https://isc.sans.edu/forums/diary/Microsoft+Patch+Tuesday+for+February+2020/25790/ Adobe Patches https://helpx.adobe.com/security.html Ransomware Abuses Out of Date Driver https://news.sophos.com/en-us/2020/02/06/living-off-another-land-ransomware-borrows-vulnerable-driver-to-remove-security-software/

Paypal Phish is Asking for Everything https://isc.sans.edu/forums/diary/Current+PayPal+phishing+campaign+or+give+me+all+your+personal+information/25786/ Dell SupportAssist Client Uncontrolled Search Patch Vulnerability https://www.dell.com/support/article/ro/ro/robsdt1/sln320101/dsa-2020-005-dell-supportassist-client-uncontrolled-search-path-vulnerability?lang=en Lock My PC Used By Support Scammer...

Sandbox Detection Tricks and Nice Obfuscation in a Single VBScript https://isc.sans.edu/forums/diary/Sandbox+Detection+Tricks+Nice+Obfuscation+in+a+Single+VBScript/25780/ Emotet Spreads via Wifi https://www.binarydefense.com/emotet-evolves-with-new-wi-fi-spreader/ Exploit Available for sudo pwfeedback bug https://dylankatz.com/Analysis-of-CVE-2019-18634/ xiongmail/hisilicon Vulnerability https://c...

Criticial Bluetooth Vulnerability in Android (CVE-2020-0022) https://insinuator.net/2020/02/critical-bluetooth-vulnerability-in-android-cve-2020-0022/ Wacom Tablets Reports Application Details to Google https://robertheaton.com/2020/02/05/wacom-drawing-tablets-track-name-of-every-application-you-open/ Bitbucket Delivers Malware https://www.cybereason.com/blog/the-hole-in-the-bucket-attackers-abuse...

Fake Browser Updates installing NetSupport RAT https://isc.sans.edu/forums/diary/Fake+browser+update+pages+are+still+a+thing/25774/ Google Android Update https://source.android.com/security/bulletin/2020-02-01#Google-Play-system-updates 5 Cisco Vulnerabilities https://www.armis.com/cdpwn/

Google Chrome 80 Released https://www.chromium.org/updates/same-site https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html File Read Vulnerablity in WhatsApp https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html HiSilicon DVR Backdoor https://habr.com/en/post/486856/

Triple Encrypted AZORult Installer https://isc.sans.edu/forums/diary/Analysis+of+a+tripleencrypted+AZORult+downloader/25768/ New sudo Vulnerability (pwfeedback) https://www.sudo.ws/alerts/pwfeedback.html Teamviewer Password Storage https://whynotsecurity.com/blog/teamviewer/

Stego and Cryptominers (with video) https://isc.sans.edu/forums/diary/Video+Stego+Cryptominers/25764/ Corona Virus Phishing / Scams https://blog.knowbe4.com/heads-up-scam-of-the-week-coronavirus-phishing-attacks-in-the-wild?nCOV-2019-bc-index https://twitter.com/briankrebs/status/1223959185764896768 Google Open Sources Security Token Software https://security.googleblog.com/2020/01/say-hello-to-op...

Chrome Same-Site Cookie Change https://www.chromestatus.com/feature/5088147346030592 https://docs.microsoft.com/en-us/office365/troubleshoot/miscellaneous/chrome-behavior-affects-applications https://caniuse.com/#feat=same-site-cookie-attribute Avast Apology https://blog.avast.com/a-message-from-ceo-ondrej-vlcek Magento Update https://helpx.adobe.com/security/products/magento/apsb20-02.html

Malware Using Text from Impeachment News Coverage https://www.bleepingcomputer.com/news/security/malware-tries-to-trump-security-software-with-potus-impeachment/ Coronavirus Themed Malware Targets Japan with Emotet https://twitter.com/Cryptolaemus1/status/1222388971428294656 https://exchange.xforce.ibmcloud.com/collection/18f373debc38779065a26f1958dc260b abuse.ch Offers new "I got phished" service...

Recent Emotet Infection installs Trickbot https://isc.sans.edu/forums/diary/Emotet+epoch+1+infection+with+Trickbot+gtag+mor84/25752/ Apple Updates https://support.apple.com/en-us/HT201222 Zoom Fixes Video Conferencing Brute Forcing Vulnerability https://www.theregister.co.uk/2020/01/28/zoom_eavesdrop_hack/ Intel Fixes Yet Another Information Leakage Flaw https://www.intel.com/content/www/us/en/sec...

Coronavirus Preparedness and Associated Scams https://isc.sans.edu/forums/diary/Network+Security+Perspective+on+Coronavirus+Preparedness/25750/ RD Gateway RCE Exploit Demoed https://twitter.com/layle_ctf/status/1221514332049113095?s=12 Mitsubishi Electric Compromised via Trend Micro Vulnerability http://www.mitsubishielectric.co.jp/news/2020/0120-b.pdf https://www.zdnet.com/article/trend-micro-ant...

Citrix Releases ADC Updates For All Versions https://www.citrix.com/blogs/2020/01/24/citrix-releases-final-fixes-for-cve-2019-19781/ Temporary Windows 0-Day Fix Breaks Printers https://www.reddit.com/r/sysadmin/comments/etumy7/microsoft_ie_zeroday_fix_breaks_hp_printing/ Critical Vulnerabilitiesin GE Medical Devices https://www.us-cert.gov/ics/advisories/icsma-20-023-01