SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

RCE Vulnerability in Dell Support Assist https://d4stiny.github.io/Remote-Code-Execution-on-most-Dell-computers/ Creston Multiple Vulnerabilities https://www.crestron.com/en-US/Security/Security_Advisories Polymorphic Skimmer Targeting 57 different Payment Gateways https://labs.sansec.io/2019/04/29/polymorphic-skimmer-57-payment-gateways/ More Attacks Against S/Mime and PGP Signed Email https://gi...

Sodinokibi Ransomware Exploits WebLogic Server Vulnerability https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html Facebook Leaking Sellers Exact Locations https://www.7elements.co.uk/resources/blog/facebooks-burglary-shopping-list/ Revive Adserver Deserialization Vulnerability https://www.revive-adserver.com/security/revive-sa-2019-001/ AutoMacTC: Automating Mac...

iLnkP2P Allows Access To Millions of Security Cameras https://hacked.camera Windows 10 Users Not Applying October Update https://reports.adduplex.com/#/r/2019-04 iFrame "Ransom Support" Attacks https://blog.trendmicro.com/trendlabs-security-intelligence/tech-support-scam-employs-new-trick-by-using-iframe-to-freeze-browsers/

WebLogic Update https://isc.sans.edu/diary.html?storyid=24890 Docker Hub Breach https://success.docker.com/article/docker-hub-user-notification

Unpatched Vulnerablity in WebLogic Exploited https://isc.sans.edu/forums/diary/Unpatched+Vulnerability+Alert+WebLogic+Zero+Day/24880/ Collecting Windows Service Accounts https://isc.sans.edu/forums/diary/Service+Accounts+Redux+Collecting+Service+Accounts+with+PowerShell/24882/ Confluence Vulnerablity Exploited by GandGrab https://blog.alertlogic.com/active-exploitation-of-confluence-vulnerability-...

Rooting Out Unwanted Domain Admins With Powershell https://isc.sans.edu/forums/diary/Where+have+all+the+Domain+Admins+gone+Rooting+out+Unwanted+Domain+Administrators/24874/ Mac OS X-Protect Now Covering Windows Malware https://twitter.com/patrickwardle/status/1120771284286103552 Wifi Finder Leaks Hotspot Passwords https://techcrunch.com/2019/04/22/hotspot-password-leak/ Github Hosting Phishing Pag...

Decoding Malicious VBA Office Document Without Source Code https://isc.sans.edu/forums/diary/Malicious+VBA+Office+Document+Without+Source+Code/24870/ More Updates on "ShadowHammer" Supply Chain Attack https://securelist.com/operation-shadowhammer-a-high-profile-supply-chain-attack/90380/ A Malicious Sight in Google Sites https://www.netskope.com/blog/malicious-google-sites

.rar Files Exploiting ACE Vulneraiblity CVE-2018-20250 https://isc.sans.edu/forums/diary/rar+Files+and+ACE+Exploit+CVE201820250/24864/ Malware Senders Become Younger and Less Sophisticated (in German) https://www.heise.de/security/meldung/Malware-Verteiler-werden-immer-juenger-infizieren-sich-oft-selbst-4403823.html McAfee Antivirus Affected by April Windows Update Crashes http://kc.mcafee.com/cor...

Analyzing UDF Files Using Python https://isc.sans.edu/forums/diary/Analyzing+UDF+Files+with+Python/24860/ HTML Ping To Be Adopted By All Major Browsers https://webkit.org/blog/8821/link-click-analytics-and-privacy/ Microsoft to Modify Edge User Agent for Some Sites https://www.onmsft.com/news/new-edge-insider-browser-can-change-user-agent-strings-based-on-what-website-youre-visiting French Governm...

Malware Delivered As a UDF .img file https://isc.sans.edu/forums/diary/Malware+Sample+Delivered+Through+UDF+Image/24854/ Facebook Stored Passwords in Plain Text https://newsroom.fb.com/news/2019/03/keeping-passwords-secure/ Iranian Statesponsored Malware and Data Leaked https://misterch0c.blogspot.com/2019/04/apt34-oilrig-leak.html Windows 8 Live Tiles Domain Takeover https://www.golem.de/news/sub...

DNS Hijacking by Sea Turtle https://blog.talosintelligence.com/2019/04/seaturtle.html Broadcom Wifi Driver Vulnerabilities https://www.kb.cert.org/vuls/id/166939/ NamPoHyu Virus Infects Samba Servers https://www.bleepingcomputer.com/news/security/nampohyu-virus-ransomware-targets-remote-samba-servers/ Increased Attacks on Confluence https://twitter.com/DFNCERT/status/1118468599230943233

PoC Exploit for Windows 10 DHCP Client Vulnerability CVE-2019-0726 (russian) https://habr.com/ru/company/pt/blog/448378/ Oracle April 2019 Critical Patch Update https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html WiPro Breached Via Phishing Attacks https://krebsonsecurity.com/2019/04/experts-breach-at-it-outsourcing-giant-wipro/ IDA and GHydra Part 2 (Strings And Parameter...

Common "False Positives" in DNS Query Logs https://isc.sans.edu/forums/diary/Odd+DNS+Requests+that+are+Normal/24844/ Adblock Plus Allows Filter List Providers to Inject Code in Pages https://armin.dev/blog/2019/04/adblock-plus-code-injection/ Executables in Polyglot DICOM Images https://github.com/d00rt/pedicom/blob/master/doc/Attacking_Digital_Imaging_and_Communication_in_Medicine_(DICOM)_file_fo...

Configuring MTA-STS https://isc.sans.edu/forums/diary/Configuring+MTASTS+and+TLS+Reporting+For+Your+Domain/24840/ How to Find Hidden Cameras in Your AirBNB https://isc.sans.edu/forums/diary/How+to+Find+Hidden+Cameras+in+your+AirBNB/24834/ Insecure Storage of VPN Credentials https://www.kb.cert.org/vuls/id/192371/ Microsoft Patch Problems https://support.microsoft.com/en-us/help/4493472/windows-7-u...

GMail Will Be Supporting MTA-STS and SMTP TLS Reporting https://tools.ietf.org/html/rfc8461 https://tools.ietf.org/html/rfc8460 https://www.zdnet.com/article/gmail-becomes-first-major-email-provider-to-support-mta-sts-and-tls-reporting/ Juniper Patch Fixes Static Password in Junos OS https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10923&actp=METADATA Uniden Commercial IP Camera Site Hos...

WPA3 Dragonblood Vulnerability http://papers.mathyvanhoef.com/dragonblood.pdf North Korean Trojan: HOPLIGHT https://www.us-cert.gov/ncas/analysis-reports/AR19-100A Gaza Cybergang Group1 "SneakyPastes" https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/

Microsoft and Adobe Patches https://isc.sans.edu/forums/diary/Microsoft+April+2019+Patch+Tuesday/24826/ https://helpx.adobe.com/security.html Fake "Food Poisoning" emails in Germany (in german) https://www.polizei-praevention.de/aktuelles/erneut-mails-mit-schadsoftware-gegen-gewerbetreibende-im-umlauf.html Vulnerability in Apache Axis https://rhinosecuritylabs.com/application-security/cve-2019-022...

GHidra vs. IDA https://isc.sans.edu/forums/diary/A+few+Ghidra+tips+for+IDA+users+part+1+the+decompilerunreachable+code/24822/ TrendMicro Patch https://success.trendmicro.com/solution/1122250 Dovecot Patch https://dovecot.org/list/dovecot-news/2019-March/000403.html Apache CVE-2019-0211 Exploit https://github.com/cfreal/exploits/tree/master/CVE-2019-0211-apache Using JavaScript in Exploits https://...

Fake Office 365 Invoices Spread Ransomware https://isc.sans.edu/forums/diary/Fake+Office+365+Payment+Information+Update/24818/ Malware Hiding in .well-known directory https://www.zscaler.com/blogs/research/abuse-hidden-well-known-directory-https-sites Altering CT Images to Manipulate Diagnosis https://arxiv.org/pdf/1901.03597.pdf QT Framework RCE Vulnerability https://www.zerodayinitiative.com/blo...

New Waves of Scans Detected By An Old Rule https://isc.sans.edu/forums/diary/New+Waves+of+Scans+Detected+by+an+Old+Rule/24812/ Xiaomi GuardApp Vulnerable to Man in the Middle https://blog.checkpoint.com/2019/04/04/xiaomi-vulnerability-when-security-is-not-what-it-seems/ Xwo Web Scanner Hunting for MongoDB https://www.alienvault.com/blogs/labs-research/xwo-a-python-based-bot-scanner Vulnerable Smar...

Ghidra tips for IDA users: Automatic Comments for API Call Parameters https://isc.sans.edu/forums/diary/A+few+Ghidra+tips+for+IDA+users+part+0+automatic+comments+for+API+call+parameters/24806/ Security Awareness Newsletter: Making Passwords Simple https://www.sans.org/security-awareness-training/resources/making-passwords-simple IRS Themed Phishing Emails https://www.proofpoint.com/us/threat-insig...

Compromised LaCie Drive Spread Fake AntiVirus https://isc.sans.edu/forums/diary/Fake+AV+is+Back+LaCie+Network+Drives+Used+to+Spread+Malware/24802/ Unpatched SOP Vulnerability in Internet Explorer/Edge https://thehackernews.com/2019/03/microsoft-edge-ie-zero-days.html Apache Fixes Privilege Escalation Flaw https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-0211 Verizon Users Phished...

Common "OpenAction" False Positive in PDFs Created by OpenOffice https://isc.sans.edu/forums/diary/Analysis+of+PDFs+Created+with+OpenOfficeLibreOffice/24798/ Android Monthly Update https://source.android.com/security/bulletin/2019-04-01#2019-04-01-details Malicious Android App Forwards Banking Calls to Attacker https://www.blackhat.com/asia-19/briefings/schedule/index.html#when-voice-phishing-met-...

Annotating Golang Binaries with Cutter and Jupyter https://isc.sans.edu/forums/diary/Annotating+Golang+binaries+with+Cutter+and+Jupyter/24790/ ASUS Targeted MAC Addresses Available for Download https://skylightcyber.com/2019/03/28/unleash-the-hash-shadowhammer-mac-list/ Weaponized Version of New Zealand Attack Manifesto https://bluehexagon.ai/blog/weaponized-version-of-new-zealand-terror-suspects-...

Creating Your Own Passive DNS Logs https://isc.sans.edu/forums/diary/Running+your+Own+Passive+DNS+Service/24784/ Incomplete Patch for Cisco RV320 Routers https://www.redteam-pentesting.de/en/advisories/rt-sa-2019-003/-cisco-rv320-unauthenticated-configuration-export https://www.redteam-pentesting.de/en/advisories/rt-sa-2019-004/-cisco-rv320-unauthenticated-diagnostic-data-retrieval TPLink Debug Po...