SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

When A Malicious Looking E-Mail Turns Out to be "just" spam https://isc.sans.edu/forums/diary/Sometimes+its+just+SPAM/22716/ Android iOS Intra-Library Collusion https://arxiv.org/abs/1708.03520 SonicSpy: Android Spyware Apps https://blog.lookout.com/sonicspy-spyware-threat-technical-research Checking For Breached Passwords in Active Directory https://jacksonvd.com/checking-for-breached-passwords-i...

Outlook Web Access Based Attacks https://isc.sans.edu/forums/diary/Outlook+Web+Access+based+attacks/22710/ The Good Phishing Email https://isc.sans.edu/forums/diary/The+Good+Phishing+Email/22712/ Git/CVS/Mercurial and others: ssh vulnerablity http://blog.recurity-labs.com/2017-08-10/scm-vulns Postgresql Vulnerablities https://bugzilla.redhat.com/show_bug.cgi?id=1477185

Maldoc Analysis With ViperMonkey https://isc.sans.edu/forums/diary/Maldoc+Analysis+with+ViperMonkey/22702/ Microsoft Joins Google/Mozilla in Banishing WoSign and StartCom From Trusted CA List https://blogs.technet.microsoft.com/mmpc/2017/08/08/microsoft-to-remove-wosign-and-startcom-certificates-in-windows-10/ SMS Touch App Leaking Messages https://www.zscaler.com/blogs/research/mobile-app-wall-sh...

DirectDefense Accuses Carbon Black of Data Leak https://www.carbonblack.com/2017/08/09/directdefense-incorrectly-asserts-architectural-flaw-in-cb-response/ https://www.directdefense.com/harvesting-cb-response-data-leaks-fun-profit/ Vulnerabilities in Solar Generation https://horusscenario.com Hunting Malicious npm Packages https://duo.com/blog/hunting-malicious-npm-packages

Microsoft Updates https://isc.sans.edu/forums/diary/Microsoft+Patch+Tuesday+August+2017/22694/ Adobe Updates https://helpx.adobe.com/security.html Android Patches https://source.android.com/security/bulletin/2017-08-01 How Are People Fooled By This? Email To Sign a Contract Provides Malware https://isc.sans.edu/forums/diary/How+are+people+fooled+by+this+Email+to+sign+a+contract+provides+malware+in...

PHPMyAdmin Scans https://isc.sans.edu/forums/diary/Increase+of+phpMyAdmin+scans/22688/ Hotspot Shield Leakes Private User Data https://cdt.org/files/2017/08/FTC-CDT-VPN-complaint-8-7-17.pdf Debian Turning Off Support for TLS 1.0/1.1 https://lists.debian.org/debian-devel-announce/2017/08/msg00004.html Ongoing Phishing Attacks Against Google Chrome Plugin Developers https://www.bleepingcomputer.com/...

Opengraph Used to Obfuscate Facebook Links https://isc.sans.edu/forums/diary/Use+of+the+Open+Graph+Protocol+to+Disguise+Malicious+Facebook+Links/22684/ Cerber Adding Bitcoin and Password Stealer to Crypto Ransomware http://blog.trendmicro.com/trendlabs-security-intelligence/cerber-ransomware-evolves-now-steals-bitcoin-wallets/ Symantec Selling Certificate Business To Digicert https://www.heise.de/...

Raspberry Pi Honeypot https://github.com/DShield-ISC/dshield Troy Hunt Releases Password List https://haveibeenpwned.com/Passwords Typosquatting npm Packages http://blog.npmjs.org/post/163723642530/crossenv-malware-on-the-npm-registry SEC503: Intrusion Detection in Depth Berlin (Oct 23rd-28th) https://www.sans.org/event/berlin-2017/course/intrusion-detection-in-depth

Attacking NoSQL Applications https://isc.sans.edu/forums/diary/Attacking+NoSQL+applications+part+2/22676/ Web Developer Chrome Toolbar Replaced with AdWare https://twitter.com/chrispederick Android Banking Trojans https://securelist.com/a-new-era-in-mobile-banking-trojans/79198/ Amazon Stops Selling Blu Smartphones http://www.zdnet.com/article/amazon-halts-blu-phone-sales-over-potential-security-i...

Detect SMB Versions with nmap https://isc.sans.edu/forums/diary/Rooting+Out+Hosts+that+Support+Older+Samba+Versions/22672/ CopyFish Google Chrome Extension Replaced by Adware https://a9t9.com/blog/chrome-extension-adware/ StartCom Applying to be Included in Mozilla SSL CAs again https://bugzilla.mozilla.org/show_bug.cgi?id=1311832#c12 McAffee Uses Mixed SSL/nonSSL Content For Online Malware Scan h...

MSFT Re-Releases June Outlook Update https://support.office.com/en-us/article/Outlook-known-issues-in-the-June-2017-security-updates-3f6dbffd-8505-492d-b19f-b3b89369ed9b?ui=en-US&rs=en-US&ad=US&fromAR=1 Iranian Hackers Use Social Media To Collect Data https://www.darkreading.com/attacks-breaches/iranian-hackers-ensnared-targets-via-phony-female-photographer/d/d-id/1329502?_mc=rss_x_drr_edt_aud_dr_...

SMBloris DoS Attack Locks Up Windows https://twitter.com/jennamagius/status/891434286212984832 https://isc.sans.edu/forums/diary/SMBLoris+the+new+SMB+flaw/22662/ Text Banking Attacks https://isc.sans.edu/forums/diary/Text+Banking+Scams/22666/ Nissan Leaf WiFi Vulnerability https://github.com/HackingThings/Publications/blob/cdb72df7c3feffd02593a31d67a34ae353b09114/2017/DC25_Driving%20down%20the%20r...

Targeting HTTP's Hidden Attack-Surface http://blog.portswigger.net/2017/07/cracking-lens-targeting-https-hidden.html Petya/Goldeneye Decrypter https://blog.malwarebytes.com/malwarebytes-news/2017/07/bye-bye-petya-decryptor-old-versions-released/ TinyPot, My Small Honeypot https://isc.sans.edu/forums/diary/TinyPot+My+Small+Honeypot/22654/ Shaun McCullough https://www.sans.org/reading-room/whitepape...

Malspam Pushing Emotet Malware https://isc.sans.edu/forums/diary/Malspam+pushing+Emotet+malware/22650/ Broadpwn Released http://blog.exodusintel.com/2017/07/26/broadpwn/ Microsoft Announces Windows 10 Bug Bounty https://blogs.technet.microsoft.com/msrc/2017/07/26/announcing-the-windows-bounty-program/ Custom Map Vulnearbilty in Valve Games https://oneupsecurity.com/research/remote-code-execution-i...

Adobe Announces End of Flash for 2020 https://blogs.adobe.com/conversations/2017/07/adobe-flash-update.html JA3 Hash To Fingerprint SSL/TLS Connections https://github.com/salesforce/ja3 https://engineering.salesforce.com/open-sourcing-ja3-92c9e53c3c41 New Wave of Apple iCloud Ransom Attacks https://www.heise.de/mac-and-i/meldung/Erneut-iCloud-Erpressungswelle-ueber-Meinen-Mac-suchen-und-Mein-iPhon...

Uber Drivers Targeted in Social Engineering Scam https://isc.sans.edu/forums/diary/Uber+drivers+new+threat+the+passenger/22626/ Mac Malware FruitFly2 https://motherboard.vice.com/en_us/article/zmv79w/mysterious-mac-malware-has-infected-hundreds-of-victims-for-years Exploit Released for Critical Netscaler SD WAN 9.1.2 Vulnerability http://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-6316

Malicious .iso Attachments https://isc.sans.edu/forums/diary/Malicious+iso+Attachments/22636/ Maldoc with .lnk File https://isc.sans.edu/forums/diary/Another+lnk+File/22640/ Large Ethereum Hack http://hackingdistributed.com/2017/07/22/deep-dive-parity-bug/

Symantec Sloppy Key Verification Leads To Revocation of Certificates https://blog.hboeck.de/archives/888-How-I-tricked-Symantec-with-a-Fake-Private-Key.html Gnome Thumbnailer Executes Code http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html

Bots Searching for Keys and Config Files https://isc.sans.edu/forums/diary/Bots+Searching+for+Keys+Config+Files/22630/ Apple Updates Everything https://support.apple.com/en-us/HT201222 Trend Micro Sees SambaCry Exploits http://blog.trendmicro.com/trendlabs-security-intelligence/linux-users-urged-update-new-threat-exploits-sambacry/ Google Increases Developer Scrutiny https://developers.googleblog....

Oracle Quarterly Critical Patch Update http://www.oracle.com/technetwork/security-advisory/cpujul2017verbose-3236625.html Cisco WebEx Plugin Update https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170717-webex https://bugs.chromium.org/p/project-zero/issues/detail?id=1324&desc=2 Node. JS DoS Vulnerability https://nodejs.org/en/blog/vulnerability/july-2017-security-r...

SMS Phishing Asks Victims to Upload Picture of Token Card https://isc.sans.edu/forums/diary/SMS+Phishing+induces+victims+to+photograph+its+own+token+card/22616/ Critical FreeRADIUS Update https://guidovranken.wordpress.com/2017/07/17/11-remote-vulnerabilities-inc-2x-rce-in-freeradius-packet-parsers/ OS X Malware Installs Crypto Messenger Signal https://blog.checkpoint.com/2017/07/13/osxdok-refuses...

NemucodAES UPS Malspam https://isc.sans.edu/forums/diary/NemucodAES+and+the+malspam+that+distributes+it/22614/ Analyzing Malicious Office Document With LNK https://isc.sans.edu/forums/diary/Office+maldoc+lnk/22618/ Gandi Breach Leads to Domain Compromise https://news.gandi.net/en/2017/07/detailed-incident-report/ iSmart Alarm Vulnerabilities http://dojo.bullguard.com/blog/burglar-hacker-when-a-phy...

Malware Loads ffmpeg For Video Recording Features https://blog.malwarebytes.com/threat-analysis/2017/07/malware-abusing-ffmpeg/ Password Managers and Cloud Storage https://discussions.agilebits.com/discussion/76956/can-i-still-buy-standalone-license-for-the-1password-no-longer-being-marketed/p8 SAP Point of Sales Express Patch https://erpscan.com/press-center/blog/sap-cyber-threat-intelligence-rep...

Simple File Integrity Monitoring With Backup Scripts https://isc.sans.edu/forums/diary/Backup+Scripts+the+FIM+of+the+Poor/22606/ Ethereum Wallet Services Targeted By Scammers http://www.ibtimes.co.uk/ethereum-under-siege-scammers-make-700000-6-days-slack-reddit-phishing-attacks-1629866 MongoDB Security Surprises For Shared Hosting https://medium.com/@alexbyk/mongodb-at-shared-hosting-security-surp...

Microsoft Patch Tuesday https://isc.sans.edu/diary//22602 AT&T Cell Phone Takeover https://carpeaqua.com/2017/07/07/hack-the-planet/ Systemd Invalid Username Bug To Be Fixed https://github.com/systemd/systemd/pull/6300