SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Maldoc, PowerShell and BITS https://isc.sans.edu/forums/diary/Maldoc+PowerShell+BITS/25372/ Yet Another Critical Exim Flaw https://nvd.nist.gov/vuln/detail/CVE-2019-16928 CISCO Introduces Semianual Patch Day https://tools.cisco.com/security/center/viewErp.x?alertId=ERP-72547 Windows 2019 to make it easier to disable legacy TLS Versions https://www.microsoft.com/security/blog/2019/09/30/tls-version...

Polycom Scans https://isc.sans.edu/forums/diary/New+Scans+for+Polycom+Autoconfiguration+Files/25366/ Apple Security Details https://support.apple.com/en-us/HT201222 iOS Jailbreak https://github.com/axi0mX/ipwndfu

vBulletin Botnet https://twitter.com/bad_packets/status/1177256656322695168 Cisco Industrial Router Security Bulletin https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-ios-gos-auth Sniffle Bluetooth Sniffer https://github.com/nccgroup/sniffle Outlook on the web blocking more extensions https://techcommunity.microsoft.com/t5/Exchange-Team-Blog/Changes-to-File-T...

Malspam Pushing Quasar RAT https://isc.sans.edu/forums/diary/Malspam+pushing+Quasar+RAT/25354/ vBulletin 0-Day Exploit Update https://www.bleepingcomputer.com/news/security/vbulletin-zero-day-exploited-for-years-gets-unofficial-patch/ Fake Veteran Employment Site https://blog.talosintelligence.com/2019/09/tortoiseshell-fake-veterans.html

Remotewebaccess.com Domain in Certificate Transparency Logs https://isc.sans.edu/forums/diary/Huge+Amount+of+remotewebaccesscom+Sites+Found+in+Certificate+Transparency+Logs/25352/ Adobe Releases Emergency ColdFusion Patch https://blogs.adobe.com/psirt/?p=1789 Apple Releases Additional Updates for iOS/iPadOS https://support.apple.com/en-us/HT201222 vBulletin Vulnerability 0-Day Exploit Released htt...

Microsoft Releases Special Patch for Exploited Vulnerability in Internet Explorer https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1367 Cloudflare Adding "Bot Fight" option https://blog.cloudflare.com/cleaning-up-bad-bots/ iOS Bluetooth Access Feature https://www.theverge.com/2019/9/19/20867286/ios-13-bluetooth-permission-privacy-feature-apps Forcepoint VPN Update https:...

Popular Android Selfie Apps Act as Adware https://www.wandera.com/mobile-security/google-play-adware/ Wireshark Update https://www.wireshark.org/docs/relnotes/wireshark-3.0.5.html Harbor Privilege Escalation https://unit42.paloaltonetworks.com/critical-vulnerability-in-harbor-enables-privilege-escalation-from-zero-to-admin-cve-2019-16097/

Agent Tesla https://isc.sans.edu/forums/diary/Agent+Tesla+Trojan+Abusing+Corporate+Email+Accounts/25336/ Apple Updates https://support.apple.com/en-us/HT201222 https://developer.apple.com/documentation/safari_release_notes/safari_13_release_notes SAMBA 4.11 Released https://www.samba.org/samba/history/samba-4.11.0.html GitHub Security Updates https://github.blog/2019-09-18-securing-software-togeth...

Analyzing a Current Emotet Sample https://isc.sans.edu/forums/diary/Emotet+malspam+is+back/25330/ Windows Defender "Scan Now" Failed Bug Fix https://www.bleepingcomputer.com/news/microsoft/windows-defender-antivirus-scans-broken-after-new-update/ https://borncity.com/win/2019/09/18/defender-antimalware-version-4-18-1908-7-released/ QEMU Vulnerablity https://www.openwall.com/lists/oss-security/2019...

Investigating Gaps in Windows Event Logs https://isc.sans.edu/forums/diary/Investigating+Gaps+in+your+Windows+Event+Logs/25328/ SOHOpelesly Broken 2 https://www.securityevaluators.com/whitepaper/sohopelessly-broken-2/ HP Printer Privacy https://robertheaton.com/2019/09/15/hp-printers-send-data-on-what-you-print-back-to-hp/

Encrypted Sextortion https://isc.sans.edu/forums/diary/Encrypted+Sextortion+PDFs/25324/ SimJacker https://www.adaptivemobile.com/blog/simjacker-next-generation-spying-over-mobile LastPass Password Leak https://bugs.chromium.org/p/project-zero/issues/detail?id=1930 Microsoft Extends EoL For Exchange Server 2010 https://techcommunity.microsoft.com/t5/Exchange-Team-Blog/Microsoft-Extending-End-of-Sup...

Rig Exploit Kit Delivering VBScript https://isc.sans.edu/forums/diary/Rig+Exploit+Kit+Delivering+VBScript/25318/ Pentesters Arrested During Physical Access Pentest https://arstechnica.com/information-technology/2019/09/check-the-scope-pen-testers-nabbed-jailed-in-iowa-courthouse-break-in-attempt/ iOS Lock Screen Unlock Vulnerability https://www.theregister.co.uk/2019/09/12/apples_ios_lock_workarou...

Microsoft Patch Tuesday https://isc.sans.edu/forums/diary/Microsoft+September+2019+Patch+Tuesday/25310/ Adobe Patches https://helpx.adobe.com/security.html Intel SSH Side Channel Vulnerability https://www.vusec.net/projects/netcat/ https://www.cs.vu.nl/~herbertb/download/papers/netcat_sp20.pdf

Firefox to Enable DNS over HTTPs by Default in September https://blog.mozilla.org/futurereleases/2019/09/06/whats-next-in-making-dns-over-https-the-default/ Telegram Fixes Privacy Bug https://www.inputzero.io/2019/09/telegram-privacy-fails-again.html PsiXBot Uses DoH https://www.proofpoint.com/us/threat-insight/post/psixbot-now-using-google-dns-over-https-and-possible-new-sexploitation-module

Unidentified Scanning Activity Likely Associated with Mirai/Successors https://isc.sans.edu/forums/diary/Unidentified+Scanning+Activity/25304/ Bluekeep Exploit Now in Metasploit https://blog.rapid7.com/2019/09/06/initial-metasploit-exploit-module-for-bluekeep-cve-2019-0708/ How to Remove GMail Calendar Spam https://support.google.com/calendar/answer/6084018?co=GENIE.Platform%3DDesktop&hl=en Exim S...

Tricky Link Retrieves Trick Bot https://isc.sans.edu/forums/diary/Guest+Diary+Tricky+LNK+points+to+TrickBot/25290/ Supermicro Virtual USB Vulnerability https://eclypsium.com/2019/09/03/usbanywhere-bmc-vulnerability-opens-servers-to-remote-attack/ Facebook Free Basics Key Used to Sign Unrelated Android Apps https://www.androidpolice.com/2019/08/29/cryptographic-key-used-to-sign-one-of-facebooks-and...

Malware Installs Node.js https://isc.sans.edu/forums/diary/Malware+Dropping+a+Local+Nodejs+Instance/25284/ Dovecot and PigeonHole Vulnerability https://www.openwall.com/lists/oss-security/2019/08/28/3 Cloudflare Workers Spreading Malware https://medium.com/@marcelx/threat-actor-behind-astaroth-is-now-using-cloudflare-workers-to-bypass-your-security-solutions-2c658d08f4c

iOS Exploits in the Wild https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html Twitter CEO's Twitter Account Hijacked https://twitter.com/TwitterComms/status/1167528672523210752

Malware Samples Compiling Their Next Stage On PremiseMalware Compiling Itself; https://isc.sans.edu/forums/diary/Malware+Samples+Compiling+Their+Next+Stage+on+Premise/25278/ CERT-Bund Attempts to Notify Users of Vulnerable Home Automation Systems https://www.heise.de/security/meldung/CERT-Bund-warnt-vor-offenen-Smarthome-Systemen-4509977.html French Authorities Shut Down Coinminer Botnet https://d...

Open Redirects: A Small But Very Common Vulnerability https://isc.sans.edu/forums/diary/Guest+Diary+Open+Redirect+A+Small+But+Very+Common+Vulnerability/25276/ CamScanner Malicious Download Component https://securelist.com/dropper-in-google-play/92496/ Ares ADB Botnet https://www.wootcloud.com/blogs/ars_botnet.html Cisco REST API Container for IOS XE Authentication Bypass https://tools.cisco.com/se...

Is it "Safe" To Require TLS 1.2 for Email https://isc.sans.edu/forums/diary/Is+it+Safe+to+Require+TLS+12+for+EMail/25270/ Android Trojan Infects Tens of Thousands of Devices in 4 Months https://www.bleepingcomputer.com/news/security/android-trojan-infects-tens-of-thousands-of-devices-in-4-months/ LYCEUM Threat Group Targeting Middle East https://www.secureworks.com/blog/lyceum-takes-center-stage-i...

Apple Patches Jailbreak Vulnerability https://support.apple.com/en-us/HT210549 Scanning for Pulse Secure VPN Endpoints https://badpackets.net/over-14500-pulse-secure-vpn-endpoints-vulnerable-to-cve-2019-11510/ Emotet is Back https://www.bleepingcomputer.com/news/security/emotet-botnet-is-back-servers-active-across-the-world/

Simple Mimikatz And RDPWrapper Dropper https://isc.sans.edu/forums/diary/Simple+Mimikatz+RDPWrapper+Dropper/25262/ Malware Impersonating IRS https://www.irs.gov/newsroom/security-summit-warns-of-new-irs-impersonation-email-scam-reminds-taxpayers-the-irs-does-not-send-unsolicited-emails Instagram Phishing with 2FA Codes https://nakedsecurity.sophos.com/2019/08/23/instagram-phishing-uses-2fa-as-a-lu...

Steam Zero Days and Bug Bounty Controversy https://www.theregister.co.uk/2019/08/22/valve_bug_bounty_steam_u_turn/ bb-builder malicious npm Package https://blog.reversinglabs.com/blog/the-npm-package-that-walked-away-with-all-your-passwords Phishers Customize Branded Outlook 365 Login Pages https://www.bleepingcomputer.com/news/security/phishing-attacks-scrape-branded-microsoft-365-login-pages/

KAPE vs. Commando VM: Red vs. Blue https://isc.sans.edu/forums/diary/KAPE+Kroll+Artifact+Parser+and+Extractor/25258/ Attacks against Exposed Sphinx Servers https://www.bsi.bund.de/EN/Topics/IT-Crisis-Management/CERT-Bund/CERT-Reports/HOWTOs/Open-Sphinx-Server/open-Sphinx-server_node.html Cisco Patches https://tools.cisco.com/security/center/publicationListing.x?product=Cisco&sort=-day_sir&limit=50...