SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Mac-Robber Python Rewrite https://isc.sans.edu/forums/diary/New+tool+macrobberpy/22844/ Apache Tomcat Patch https://www.us-cert.gov/ncas/current-activity/2017/09/19/Apache-Releases-Security-Updates-Apache-Tomcat Apple Updates For iOS, Xcode, tvOS, watchOS and Safari https://support.apple.com/en-us/HT201222

CCleaner Compromise http://blog.talosintelligence.com/2017/09/avast-distributes-malware.html http://www.piriform.com/news/release-announcements/2017/9/18/security-notification-for-ccleaner-v5336162-and-ccleaner-cloud-v1073191-for-32-bit-windows-users Word INCLUDEPICTURE Feature Abuse https://securelist.com/an-undocumented-word-feature-abused-by-attackers/81899/ security.txt file https://www.ietf.o...

Bashware: Bypassing Windows Security via Linux (WSL) https://research.checkpoint.com/beware-bashware-new-method-malware-bypass-security-solutions/ Javascript Rogue Crypto Currency Miner https://www.welivesecurity.com/2017/09/14/cryptocurrency-web-mining-union-profit/ NodeJS Hash Table DoS https://medium.com/@ahmadbamieh/nodejs-constant-hashtables-seeds-vulnerability-f03bf70e3593 HTTPS Interception...

Another Webshell; Another Backdoor https://isc.sans.edu/forums/diary/Another+webshell+another+backdoor/22826/ D-Link Vulnerability https://pierrekim.github.io/blog/2017-09-08-dlink-850l-mydlink-cloud-0days-vulnerabilities.html Chrome To Label FTP As Insecure https://groups.google.com/a/chromium.org/forum/#!msg/security-dev/HknIAQwMoWo/xYyezYV5AAAJ More Google Play Store Malware https://blog.checkp...

No IPv6? Challenge Accepted https://isc.sans.edu/forums/diary/No+IPv6+Challenge+Accepted+Part+1/22820/ Exploiting CVE-2017-8759 https://www.mdsec.co.uk/2017/09/exploiting-cve-2017-8759-soap-wsdl-parser-code-injection/ Wordpress Plugin Found With Backdoor https://www.pluginvulnerabilities.com/2017/09/11/wordpress-poor-handling-of-plugin-security-exacerbates-malicious-takeover-of-display-widgets/

Microsoft Patch Tuesday https://www.fireeye.com/blog/threat-research/2017/09/zero-day-used-to-distribute-finspy.html https://technet.microsoft.com/security/advisories BlueBorne Bluetooth Vulnerability http://go.armis.com/hubfs/BlueBorne%20Technical%20White%20Paper.pdf

Cisco Struts Updates https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170909-struts2-rce Google Chrome Warning Users of Anti-Malware SSL Interception https://twitter.com/sashaperigo/status/906263091624591360 Machinelearning To Identify Malicious TLS Connections https://arxiv.org/pdf/1607.01639.pdf Comodo Breaking CAA Standard https://www.mail-archive.com/dev-securit...

Analyzing JPEG Files https://isc.sans.edu/forums/diary/Analyzing+JPEG+files/22806/ Auditing Windows With WINspect https://isc.sans.edu/forums/diary/Windows+Auditing+with+WINspect/22810/ Windows PSSetLoadImageNotifyRoutine Vulnerability https://breakingmalware.com/documentation/windows-pssetloadimagenotifyroutine-callbacks-good-bad-unclear-part-1/ IOTA Cryptocurrency Vulnerable Hash Function https:...

Yet Another Struts RCE Vulnerability https://struts.apache.org/docs/s2-053.html Equifax Compromise https://www.bloomberg.com/news/articles/2017-09-07/three-equifax-executives-sold-stock-before-revealing-cyber-hack Hash Extension Flaws https://isc.sans.edu/forums/diary/Modern+Web+Application+Penetration+Testing+Hash+Length+Extension+Attacks/22792/ Matt Hosburgh: Offensive Intrusion Analysis: Uncove...

Struts2 Metasploit Module https://github.com/rapid7/metasploit-framework/pull/8924/commits/5ea83fee5ee8c23ad95608b7e2022db5b48340ef Google Docs Table With Hacked MongoDB Databases https://docs.google.com/spreadsheets/d/1QonE9oeMOQHVh8heFIyeqrjfKEViL0poLnY8mAakKhM/edit#gid=1781677175 Bypassing Cloudflare https://rhinosecuritylabs.com/cloud-security/cloudflare-bypassing-cloud-security/

A Look Back At Nira and What's Next https://isc.sans.edu/forums/diary/The+Mirai+Botnet+A+Look+Back+and+Ahead+At+Whats+Next/22786/ New Struts Vulnerability and Patch https://isc.sans.edu/forums/diary/Struts+vulnerability+patch+released+by+apache+patch+now/22788 Mastercard Internet Gateway Service Flaw http://tinyhack.com/2017/09/05/mastercard-internet-gateway-service-hashing-design-flaw/ Mac OS X H...

Locky Ransom Ware is Back and This Time Pretents to Be a Font https://isc.sans.edu/forums/diary/Malspam+pushing+Locky+ransomware+tries+HoeflerText+notifications+for+Chrome+and+FireFox/22776/ When is a PDF Just a PDF? https://isc.sans.edu/forums/diary/It+is+a+resume+Part+1/22780/ Asterisk Vulnerable to RTPBleed https://github.com/EnableSecurity/advisories/tree/master/ES2017-04-asterisk-rtp-bleed Ar...

Is Remote Work Feasible in a SOC? https://isc.sans.edu/forums/diary/Remote+SOC+Workers+Concerns/22772/ Linux Random Number Generator Reviewed https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Studien/LinuxRNG/LinuxRNG_EN.pdf?__blob=publicationFile&v=5 Adobe Acrobat and Reader Security Patch https://blogs.adobe.com/psirt/?p=1484 Turning Speakers into Microphones https://www.usenix.o...

IoT Gear Affected by ConnMan Vulnerablity http://connmando.nri-secure.co.jp/index.html Trickbot Going After Coinbase https://blogs.forcepoint.com/security-labs/trickbot-goes-after-cryptocurrency Pacemakers Need Patch https://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm573669.htm Inaudible Voice Commands https://arxiv.org/pdf/1708.07238.pdf

Another Chrome Extension Banking Malware https://isc.sans.edu/forums/diary/Second+Google+Chrome+Extension+Banker+Malware+in+Two+Weeks/22766/ Vulnerable Docker VM https://www.notsosecure.com/vulnerable-docker-vm/ Large Spam E-Mail and Password List Discovered https://www.troyhunt.com/inside-the-massive-711-million-record-onliner-spambot-dump/

Survey of Recent DVR Attacks https://isc.sans.edu/forums/diary/An+Update+On+DVR+Malware+A+DVR+Torture+Chamber/22762/ Disabling Intel ME http://blog.ptsecurity.com/2017/08/disabling-intel-me.html Wire-X Takedown https://blogs.akamai.com/2017/08/the-wirex-botnet-an-example-of-cross-organizational-cooperation.html

Analyzing 7zip Malware https://isc.sans.edu/forums/diary/Malware+analysis+searching+for+dots/22758/ Worldwide DNS Manipulation Survey https://people.eecs.berkeley.edu/~pearce/papers/dns_usenix_2017.pdf Sophos Withdraws UTM Update https://community.sophos.com/products/unified-threat-management/b/utm-blog/posts/utm-up2date-9-503-released Crypto Currency Malware https://resources.netskope.com/h/i/361...

Critical HPE iLo Vulnerability http://h20565.www2.hpe.com/hpsc/doc/public/display?docId=hpesbhf03769en_us Facebook Messenger Spam Leads to Malware https://securelist.com/new-multi-platform-malwareadware-spreading-via-facebook-messenger/81590/ iOS 10.3.1 Kernel Exploit Released https://blog.zimperium.com/ziva-video-audio-ios-kernel-exploit/ Samsung Bricks Smart TVs With Update https://eu.community....

Malware Loading Avast Safe Zone Browser https://isc.sans.edu/forums/diary/Malicious+script+dropping+an+executable+signed+by+Avast/22748/ Ropemaker E-Mail Content https://www.mimecast.com/globalassets/documents/whitepapers/wp_the_ropemaker_email_exploit.pdf Cloud Based Accounts Increasingly a Target https://www.microsoft.com/en-us/security/intelligence-report More Malware Found At Ukraining Account...

Elcomsoft Releases Ability to Retrieve Apple Keychain from iCloud https://www.elcomsoft.com/eppb.html Mapping Rooms With Smart Speakers http://musicattacks.cs.washington.edu/activity-information-leakage.pdf Netcraft Identifies .fish Domain Used For Phishing https://news.netcraft.com/archives/2017/08/21/first-fishy-phishing-sites-sighted.html

Hackers Scam $ 500,000 From Enigma Digital Currency Investors http://www.theregister.co.uk/2017/08/21/enigma_digital_currency_investors_scammed/ Bitcoin Privacy Threats https://arxiv.org/abs/1708.04748 $500 iPhone PIN Brute Forcing Box https://www.youtube.com/watch?v=IXglwbyMydM SyncCrypt Bypasses Antivirus Filters With Images https://www.bleepingcomputer.com/news/security/synccrypt-ransomware-hid...

EngineBox Banking Malware https://isc.sans.edu/forums/diary/EngineBox+Malware+Supports+10+Brazilian+Banks/22736/ It's Not An Invoice https://isc.sans.edu/forums/diary/Its+Not+An+Invoice/22738/ iOS Secure Enclave Key Posted https://www.theiphonewiki.com/wiki/Greensburg_14G60_%28iPhone6,1%29 Vulnerabilities in FoxIT PDF Reader https://www.thezdi.com/blog/2017/8/17/busting-myths-in-foxit-reader

Maldoc with auto-updated link https://isc.sans.edu/forums/diary/Maldoc+with+autoupdated+link/22730/ Rowhammer is Back: SSD Memory Affected https://www.usenix.org/system/files/conference/woot17/woot17-paper-kurmus.pdf Nathaniel Quist: Active Defense in a Labyrinth of Deception https://www.sans.org/reading-room/whitepapers/ActiveDefense/active-defense-labyrinth-deception-37462

Analysis of a Paypal Phishing Kit https://isc.sans.edu/forums/diary/Analysis+of+a+Paypal+phishing+kit/22726/ ShadowPad Backdoor in NetSarang Equipment https://securelist.com/shadowpad-in-corporate-networks/81432/ Solving Captcha Audio Challenges http://uncaptcha.cs.umd.edu/papers/uncaptcha_woot17.pdf

Malspam Pushing Trickbot Banking Trojan https://isc.sans.edu/forums/diary/Malspam+pushing+Trickbot+banking+Trojan/22720/ Banker Google Chrome Extension Targeting Brazil https://isc.sans.edu/forums/diary/BankerGoogleChromeExtensiontargetingBrazil/22722/ DJI "Go" App May Be Using JSPatch To Modify Applications After Install https://www.rcgroups.com/forums/showpost.php?p=38096850&postcount=2713 Smart...