SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Criminals Threaten to Erase Millions of iCloud Conntected Apple devices https://motherboard.vice.com/en_us/article/hackers-we-will-remotely-wipe-iphones-unless-apple-pays-ransom?utm_source=vicefbus Siemens Control Systems Affected by Fake Firmware https://dragos.com/blog/mimics/ GitHub Used for C&C http://blog.trendmicro.com/trendlabs-security-intelligence/winnti-abuses-github/ Adium IM Vulnerable...

Password Encrypted Word File Delivers Malware https://isc.sans.edu/forums/diary/Malspam+with+passwordprotected+Word+documents/22203/ Critical LastPass Vulnerability https://bugs.chromium.org/p/project-zero/issues/detail?id=1209 Nest Camera Bluetooth Vulnerability https://github.com/jasondoyle/Google-Nest-Cam-Bug-Disclosures/blob/master/README.md

CISCO Releases Advisory With Details Regarding CMP Vulnerability https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp Pwn2Own Contest Leads to Exploits Against All Browsers (and VM!) https://www.zerodayinitiative.com/blog/2017/3/17/the-results-pwn2own-2017-day-three Git Moving Away From SHA1 (likely to SHA3) https://news.ycombinator.com/item?id=13906804 Proxy...

An Example of a Multiple States Dropper https://isc.sans.edu/forums/diary/Example+of+Multiple+Stages+Dropper/22197/ Real-World Wiretaping Attacks Against ZRTP https://www.ibr.cs.tu-bs.de/papers/schuermann-popets2017.pdf Authenticating Against MySQL Server Using a Hashed Password https://github.com/cyrus-and/mysql-unsha1

Certain Ubiquity Equipment Vulnerable to CSRF/Code Execution https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170316-0_Ubiquiti_Networks_authenticated_command_injection_v10.txt Proton Mac OS RAT https://www.cybersixgill.com/proton-a-new-mac-os-rat/ Linux Kernel n_hdlc Privilege Escalation http://seclists.org/oss-sec/2017/q1/569 VMWare Copy/Paste Exploit Fixed https://www.vm...

Twitter App "Twitter Counter" Compromise Leads to Unauthorized Tweets From a Large Number of Accounts https://twitter.com/thecounter Telegram and WhatsApp Image Vulnerability http://blog.checkpoint.com/2017/03/15/check-point-discloses-vulnerability-whatsapp-telegram/ RSA Panel Webcast https://cc.readytalk.com/registration/#/?meeting=6oowksc223hm&campaign=ijmt1z8qsc1q

Microsoft's Double Patch Tuesday https://isc.sans.edu/forums/diary/February+and+March+Microsoft+Patch+Tuesday/22185/

Creating SHA3 Hashes with sigs.py https://isc.sans.edu/forums/diary/New+tool+sigspy/22181/ Canada Revenue Agency Website Attacked / Down over Struts2 http://www.cbc.ca/news/politics/cra-internet-vulnerability-government-1.4022591 Webkit Exploit Adobted to Nintendo Switch https://www.youtube.com/watch?v=xkdPjbaLngE Analysis of Outdated Javascript Libraries on the Web http://www.ccs.neu.edu/home/ars...

Issues With Out Of Date Geo Location Databases https://isc.sans.edu/forums/diary/The+Side+Effect+of+GeoIP+Filters/22173/ Recovering Mobile Device PINs via Thermal Images http://www.mkhamis.com/data/papers/abdelrahman2017chi.pdf Unmasking Randomized MAC Addresses https://arxiv.org/abs/1703.02874v1 Mobile Phone Supply Chain Attacks http://blog.checkpoint.com/2017/03/10/preinstalled-malware-targeting...

Struts 2 Update https://isc.sans.edu/forums/diary/Critical+Apache+Struts+2+Vulnerability+Patch+Now/22169/ Exploits Against Haraka Mail Server https://github.com/outflanknl/Exploits/blob/master/harakiri-CVE-2016-1000282.py Android Password Stealing Apps http://www.welivesecurity.com/2017/03/09/new-instagram-credentials-stealers-discovered-google-play/ Drupal Services Module Vulnerability and Exploi...

Security Researches Target Nintendo Switch https://twitter.com/qlutoo https://www.youtube.com/watch?v=CwdDN1kA93Q&feature=youtu.be Dockerscan https://github.com/cr0hn/dockerscan 1 in 5 Websites still rely on SHA-1 Based Certificates http://www.theregister.co.uk/2017/03/08/sha1_certificate_survey/ Not All Malware Samples Are Complex https://isc.sans.edu/forums/diary/Not+All+Malware+Samples+Are+Comp...

CIA Leak (note that link lead directly to leaked documents) https://wikileaks.com/ciav7p1/ From Shamoon To Stonedrill: Evolution of Wipers Attacking Saudi Organziations https://securelist.com/files/2017/03/Report_Shamoon_StoneDrill_final.pdf WordPress Update https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/ Reading Secret Keys From SGX Enclaves https://arxiv.org/...

Typosquatting Against Santander Bank in Brazil With Phone Call Follow-up https://isc.sans.edu/forums/diary/A+very+convincing+Typosquatting+Social+Engineering+campaign+is+targeting+Santander+corporate+customers+in+Brazil/22157/ Post Mortem on 911 DDoS Attack https://www.wsj.com/articles/how-a-cyberattack-overwhelmed-the-911-system-1488554972 Nextcloud/Owncloud Scanner https://scan.nextcloud.com Wes...

How Your Pictures Affect Your Website Reputation https://isc.sans.edu/forums/diary/How+your+pictures+may+affect+your+website+reputation/22151/ De-Obuscating Padded Code https://isc.sans.edu/forums/diary/Another+example+of+maldoc+string+obfuscation+with+extra+bonus+UAC+bypass/22153/ FoxIT PDF Reader Vulnerability https://www.foxitsoftware.com/support/security-bulletins.php#content-2017 Applying SHA...

Business E-Mail Compromise and Sender Policy Framework Typos (SPF) https://isc.sans.edu/forums/diary/Phishing+for+Big+Money+Wire+Transfers+is+Still+Alive+and+Well+or+For+Want+of+Good+Punctuation+all+was+Lost/22141/ Android Developers Infected With Malware Publishing Malicious Apps http://researchcenter.paloaltonetworks.com/2017/03/unit42-google-play-apps-infected-malicious-iframes/ DBLTek GoIP Bac...

LDAP and STARTTLS https://isc.sans.edu/forums/diary/SSLTLS+on+port+389+Say+what/22135/ Wordpress NextGen Gallery Plugin SQL Injection Vulnerability https://blog.sucuri.net/2017/02/sql-injection-vulnerability-nextgen-gallery-wordpress.html Password Manager Insecurities https://team-sik.org/trent_portfolio/password-manager-apps/ Slack Insecure Cross Window Messaging https://labs.detectify.com/2017/0...

Amazon Cloud IPv4 Reuse Leads to Stray Requests https://isc.sans.edu/forums/diary/My+Catch+Of+4+Months+In+The+Amazon+IP+Address+Space/22129 Amazon S3 Outage https://isc.sans.edu/forums/diary/Amazon+S3+Outage/22131/ CloudPets Leaks Recordings https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/ ESET Antivirus Vulnerability Puts Macs at...

Google Chrome TLS 1.3 Update Causes Issues With Bluecoat https://bugs.chromium.org/p/chromium/issues/detail?id=694593 Windows 10 Will Implmenet "Gatekeeper" Like Technology https://twitter.com/vitorgrs/status/835674417602637824 Google Releases E2EMail Chrome Plugin https://security.googleblog.com/2017/02/e2email-research-project-has-left-nest_24.html Decrypting SCOM "RunAs" Credentials https://www...

Cloudflare Leaks Data https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/ IE/Edge Denial of Service https://bugs.chromium.org/p/project-zero/issues/detail?id=1011#c2 "Dynamite Phishing" https://isc.sans.edu/forums/diary/Dynamite+Phishing/22121/ Google Credentials Problems https://productforums.google.com/forum/#!category-topic/gmail/LOt2x1_c3KM

Researchers Find SHA1 Collision https://shattered.io/static/shattered.pdf Arrest Made in Deutsche Telekom DSL Modem Attack https://www.bleepingcomputer.com/news/security/uk-police-arrest-suspect-behind-mirai-malware-attacks-on-deutsche-telekom/

User Centric Mobile Device Security With Stethoscope http://techblog.netflix.com/2017/02/introducing-netflix-stethoscope.html Fingerprinting Firefox With Intermediate Certificates https://shiftordie.de/blog/2017/02/21/fingerprinting-firefox-users-with-cached-intermediate-ca-certificates-fiprinca/ JudasDNS Attack DNS Proxy https://github.com/mandatoryprogrammer/JudasDNS

Microsoft Releases Flash Patch From Skipped February Update https://technet.microsoft.com/en-us/library/security/MS17-005 Investigating Off-Premise Wireless Behaviour https://isc.sans.edu/forums/diary/Investigating+OffPremise+Wireless+Behaviour+or+I+Know+What+You+Connected+To/22089/ "Bugdrop" Steals Large Amount of Audio https://cyberx-labs.com/en/blog/operation-bugdrop-cyberx-discovers-large-scal...

Hardening Postfix Against FTP Relay Attacks https://isc.sans.edu/forums/diary/Hardening+Postfix+Against+FTP+Relay+Attacks/22086/ Kaspersky Examins Mobile Car Apps https://securelist.com/analysis/publications/77576/mobile-apps-and-stealing-a-connected-car/ Cars "Remember" Prior Owners http://money.cnn.com/2017/02/17/technology/used-car-hack-safety-location/ Xen Project Reconsidering Vulnerability D...

RTRBK: Router, Switch, Firewall Backups in Powershell https://isc.sans.edu/forums/diary/RTRBK+Router+Switch+Firewall+Backups+in+PowerShell+tool+drop/22079/ Windows EMF Imge 0-Day Memory Leak https://bugs.chromium.org/p/project-zero/issues/detail?id=992 Brazillian Traffic Ticket Malspam https://isc.sans.edu/forums/diary/Brazilian+malspam+sends+Autoitbased+malware/22081/ Using XXE To Send E-Mail htt...

AVM Private Key Leak Puts Cable Modems At Risk https://isc.sans.edu/forums/diary/AVM+Private+Key+Leak+Puts+Cable+Modems+Worldwide+At+Risk/22076/ OpenSSL Update https://isc.sans.edu/forums/diary/OpenSSL+110e+Update+No+need+to+panic+openssl/22074/ Microsoft Update Delayed https://blogs.technet.microsoft.com/msrc/2017/02/14/february-2017-security-update-release/ ANC Attack ASLR Bypass https://www.vus...