SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Odd DNS Requests from Firewalls https://isc.sans.edu/forums/diary/Suspicious+DNS+Requests+Issued+by+a+Firewall/24128/ Securing API Connections https://isc.sans.edu/forums/diary/The+danger+of+sending+information+for+API+consumption+without+adequate+security+measures/24130/ Microsoft JET Database 0day https://www.zerodayinitiative.com/advisories/ZDI-18-1075/ Western Digital Releases Patch for MyClou...

Hunting for Suspicious Processes with OSSEC https://isc.sans.edu/forums/diary/Hunting+for+Suspicious+Processes+with+OSSEC/24122/ NSSLabs Sues Crowdstrike, Symantec, ESET https://www.nsslabs.com/blog/company/advancing-transparency-and-accountability-in-the-cybersecurity-industry/ Bitcoin Core Vulnerability https://motherboard.vice.com/amp/en_us/article/qvakp3/a-major-bug-in-bitcoin-software-could-h...

Adobe Releases Special Patch for Acrobat and Reader https://helpx.adobe.com/security/products/acrobat/apsb18-34.html Akamai State of the Internet Report https://www.akamai.com/us/en/about/our-thinking/state-of-the-internet-report/global-state-of-the-internet-security-ddos-attack-reports.jsp Peekabo DVR Vulnerability https://www.tenable.com/blog/tenable-research-advisory-peekaboo-critical-vulnerabi...

Certificate Transparency Tools https://isc.sans.edu/forums/diary/Using+Certificate+Transparency+as+an+Attack+Defense+Tool/24114/ Kodi Malicious Add-Ons https://www.welivesecurity.com/2018/09/13/kodi-add-ons-launch-cryptomining-campaign/ Cloudflare Making DNSSEC Adoption Easier https://blog.cloudflare.com/automatically-provision-and-maintain-dnssec/ Western Digital MyCloud Unauthenticated Admin Acc...

Analyzing Office Docs https://isc.sans.edu/forums/diary/Dissecting+Malicious+MS+Office+Docs/24108/ Apple Updates Everything but macOS https://support.apple.com/en-us/HT201220 FBot Botnet https://blog.netlab.360.com/threat-alert-a-new-worm-fbot-cleaning-adbminer-is-using-a-blockchain-based-dns-en/ Related STI Paper: Botnet Reciliency via Private Blockchain (Jonathan Sweeny) https://www.sans.org/rea...

Reversing Visual Basic Shortcuts https://isc.sans.edu/forums/diary/2020+malware+vision/24104/ Not So Random User Agent https://isc.sans.edu/forums/diary/User+Agent+String+uatoolsrandom/24102/ Safari DoS https://gist.github.com/pwnsdx/ce64de2760996a6c432f06d612e33aea Webroot SecureAnywhere macOS Vulnerability https://www.trustwave.com/Resources/SpiderLabs-Blog/CVE-2018-16962--Webroot-SecureAnywhere...

Malicious MHT Files https://isc.sans.edu/forums/diary/Malware+Delivered+Through+MHT+Files/24096/ Improved Coldboot Attack https://blog.f-secure.com/cold-boot-attacks/ SAP Patches https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993

So What is Going on With IPv4 Fragments these Days? https://isc.sans.edu/forums/diary/So+What+is+Going+on+With+IPv4+Fragments+these+Days/24092/ Magacart Javascript Injection Attacks https://www.bleepingcomputer.com/news/security/feedify-service-compromised-with-magecart-information-stealing-script/ Bypassing CSP using Polyglot JPEGs https://portswigger.net/blog/bypassing-csp-using-polyglot-jpegs

Microsoft Patch Tuesday https://isc.sans.edu/forums/diary/Microsoft+September+Patch+Tuesday+Summary/24088/ Adobe Patches https://helpx.adobe.com/security.html Safari/Edge URL Bar Spoofing https://www.rafaybaloch.com/2018/09/apple-safari-microsoft-edge-browser.html Exploit Search Engine https://sploitus.com

"findstr" used to extract malware from LNK files https://isc.sans.edu/forums/diary/What+is+dikona+or+glirote3/24084/ Tor Browser Javascript Vulnerability https://www.bleepingcomputer.com/news/security/exploit-affecting-tor-browser-burned-in-a-tweet/ Trend Micro App Leaks Data / Removed from Appstore https://forums.malwarebytes.com/topic/217353-get-rid-of-open-any-files-rar-support/?tab=comments#co...

Crypto Mining in a Windows Headless Browser https://isc.sans.edu/forums/diary/Crypto+Mining+in+a+Windows+Headless+Browser/24078/ MacOS Adware Doctor Stealing Browser History https://twitter.com/privacyis1st/status/1031428304543395840 https://objective-see.com/blog/blog_0x37.html VPN Applications with Privilege Escalation Vulnerabilities https://blog.talosintelligence.com/2018/09/vulnerability-spot...

Malware Uses Powershell to Comple C# Code on the Fly https://isc.sans.edu/forums/diary/Malicious+PowerShell+Compiling+C+Code+on+the+Fly/24072/ Stealing WiFi Credentials in Google Chrome https://www.surecloud.com/sc-blog/wifi-hijacking DNS Spoofing and Certificate Authority Domain Validation https://www.theregister.co.uk/2018/09/06/boffins_break_cas_domain_validation/ Cisco Vulnerabilities https://...

MEGA Chrome Extension Replaced with Password Stealer https://serhack.me/articles/mega-chrome-extension-hacked Python Package Installer May Execute Code https://github.com/mschwager/0wned Windows Scheduler Exploit Used in the Wild https://www.welivesecurity.com/2018/09/05/powerpool-malware-exploits-zero-day-vulnerability/ Where Have All My Certificates Gone? https://isc.sans.edu/forums/diary/Where+...

Some More Interesting MicroTik Router Exploits https://blog.netlab.360.com/7500-mikrotik-routers-are-forwarding-owners-traffic-to-the-attackers-how-is-yours-en/ Exposed .git Directories https://lynt.cz/blog/global-scan-exposed-git SSL Certificates Expose Tor Servers https://www.bleepingcomputer.com/news/security/public-ip-addresses-of-tor-sites-exposed-via-ssl-certificates/

Reversing and Modifying the Medium Mobile App https://hackernoon.com/dont-publish-yet-reverse-engineering-the-medium-app-and-making-all-stories-in-it-free-48c8f2695687 Active Directory Leaks via Azure https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/ Google Restricts Tech Support Ads https://www.blog.google/products/ads/restricting-ads-third-party-tec...

OSX/MacOS and Dangerous of Custom URL Schemes https://objective-see.com/blog/blog_0x38.html Philips e-Alert Vulnerability https://ics-cert.us-cert.gov/advisories/ICSA-18-242-01

Cryptocoin Miners are More Popular Than Ever and Dominate in Attacks https://isc.sans.edu/forums/diary/Crypto+Mining+Is+More+Popular+Than+Ever/24050/ Cryptocoin Miners Deployed via Struts Vulnerability https://www.volexity.com/blog/2018/08/27/active-exploitation-of-new-apache-struts-vulnerability-cve-2018-11776-deploys-cryptocurrency-miner/ Mimecast Identifies Weaknesses in Existing EMail Filters...

More Octoprint Details https://isc.sans.edu/forums/diary/3D+Printers+in+The+Wild+What+Can+Go+Wrong/24044/ Packagist Remote Code Injection Vulnerability https://justi.cz/security/2018/08/28/packagist-org-rce.html More OpenSSH User Enumeration Issues http://seclists.org/oss-sec/2018/q3/180 Two new TPM Vulnerabilities https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-han.pdf

Microsoft Windows Task Scheduler Local Privilege Escalation Vulnerability https://www.kb.cert.org/vuls/id/906424 3D Printers Exposed to Internet https://isc.sans.edu/forums/diary/OctoPrint+3D+Web+Interfaces+EXPOSED+Port+5000+default/24038/ Firefox Nightly Built Removes Trust From Symantec Certificates https://bugzilla.mozilla.org/show_bug.cgi?id=1460062 https://bugzilla.mozilla.org/show_bug.cgi?id...

H-Worm Variant Notes Infection Date in Registry https://isc.sans.edu/forums/diary/When+was+this+machine+infected/24032/ CentOS / Ubuntu Turn Off Gnome "Bubblewrap" Sandbox https://www.bleepingcomputer.com/news/security/ubuntu-and-centos-are-undoing-a-gnome-security-feature/ Fortnite Android Arbitrary Code Install Vulnerability https://www.bleepingcomputer.com/news/security/ubuntu-and-centos-are-un...

Struts Exploits for CVE-2018-11776 on Github (there are more. just a sample) https://github.com/mazen160/struts-pwn_CVE-2018-11776 https://github.com/jiguang7/CVE-2018-11776 Publisher Malware https://isc.sans.edu/forums/diary/Microsoft+Publisher+Files+Delivering+Malware/24024/ https://isc.sans.edu/forums/diary/Microsoft+Publisher+malware+static+analysis/24026/ AT Commands https://atcommands.org/at...

Simple Phishing Through formcrafts.com https://isc.sans.edu/forums/diary/Simple+Phishing+Through+formcraftscom/24020/ Facebook's Onavo VPN removed from Apple AppStore https://www.wsj.com/articles/facebook-to-remove-data-security-app-from-apple-store-1534975340?mod=e2tw (paywall) https://medium.com/@chronic_9612/notes-on-analytics-and-tracking-in-onavo-protect-for-ios-904bdff346c0 Phishing False Al...

New Critical Apache Struts Vulnerability (CVE-2018-11776) https://semmle.com/news/apache-struts-CVE-2018-11776 https://cwiki.apache.org/confluence/display/WW/S2-057 Hardening Apache Struts With SELinux https://doublepulsar.com/hardening-apache-struts-with-selinux-db3a9cd1a10c?gi=f23fc884264a Ghostscript Code Execution Vulnerability https://bugs.chromium.org/p/project-zero/issues/detail?id=1640 Pho...

Malicious DDL Loaded Through AutoIT https://isc.sans.edu/forums/diary/Malicious+DLL+Loaded+Through+AutoIT/24008/ Traefik Fixes TLS Private Key Exposure https://github.com/containous/traefik/issues/3651 TLS Certificates Survive Domain Ownership https://insecure.design Intel Microcode License Update Causes Problems for Debian Linux https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906158#14

Regular Expression DDoS in Javascript http://mp.binaervarianz.de/ReDoS_TR_Dec2017.pdf OpenSSH User Enumeration Update https://isc.sans.edu/forums/diary/OpenSSH+user+enumeration+CVE201815473/24004 Turning (Page) Tables Exploit Technique https://cdn2.hubspot.net/hubfs/487909/Turning%20(Page)%20Tables_Slides.pdf