SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Cryptoanalysis of a Fully Homomorphic Encryption Scheme http://eprint.iacr.org/2016/775.pdf Recreating Android App Displays from Memory https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_saltaformaggio.pdf Various Router Exploits Released https://medium.com/@msuiche/shadow-brokers-nsa-exploits-of-the-week-3f7e17bdc216#.mnoyydmeu

Starting October 2016, Microsoft Will Use Montly Rollup Updates for Win 7/8.1 https://blogs.technet.microsoft.com/windowsitpro/2016/08/15/further-simplifying-servicing-model-for-windows-7-and-windows-8-1/ Updated Group Policies To Block Macros in Office 2013 https://isc.sans.edu/forums/diary/MS+Office+2013+New+Macro+Controls+Sorta/21371/ Bypassing Application Whitelisting using WinDbg http://www.e...

Most Android Devices Protected From Quadrooter By Default http://www.androidcentral.com/google-confirms-verify-apps-can-block-apps-quadrooter-exploits Dangers of IP Geolocation https://nakedsecurity.sophos.com/2016/08/11/couple-sue-over-ip-glitch-that-repeatedly-sent-feds-to-their-house/ Microsoft Secure Boot Key Bypass https://rol.im/securegoldenkeyboot/ (careful. highly annoying but harmless)

Bling Spoofing of TCP Connections CVE-2016-5696 http://www.cs.ucr.edu/~zhiyunq/pub/sec16_TCP_pure_offpath.pdf Fingerprinting TLS Using TShark https://isc.sans.edu/forums/diary/Profiling+SSL+Clients+with+tshark/21361/ Forensics Artifcats on iOS Messaging Apps https://isc.sans.edu/forums/diary/Looking+for+the+insider+Forensic+Artifacts+on+iOS+Messaging+App/21363/ Vulnerable VW Remote Keyless Unlock...

MSFT Patch Tuesday Summary https://isc.sans.edu/forums/diary/Microsoft+Patch+Tuesday+August+2016/21357/ Adobe Patch for Adobe Experience Manager https://helpx.adobe.com/security/products/experience-manager/apsb16-27.html Avast Anti Virus Conflict With Windows 10 Anniversary Update https://forum.avast.com/index.php?topic=189403.0

Using File Entropy to Identify "Ransomwared" Files https://isc.sans.edu/forums/diary/Using+File+Entropy+to+Identify+Ransomwared+Files/21351/ Bypassing Windows Digital Signatures https://www.blackhat.com/docs/us-16/materials/us-16-Nipravsky-Certificate-Bypass-Hiding-And-Executing-Malware-From-A-Digitally-Signed-Executable-wp.pdf Quadrooter Android Vulnerability http://blog.checkpoint.com/2016/08/07...

Analyzing Malicious RTF Files https://isc.sans.edu/forums/diary/rtfdump/21347/ Monitors Vulnerable To Remote Code Execution http://motherboard.vice.com/read/hackers-could-break-into-your-monitor-to-spy-on-you-and-manipulate-your-pixels Brute Forcing Encrypted Hard drive Protections https://www.blackhat.com/docs/us-16/materials/us-16-OFlynn-Brute-Forcing-Lockdown-Harddrive-PIN-Codes.pdf What is Usi...

Surge in Scans for Netis Router https://isc.sans.edu/forums/diary/Surge+in+Exploit+Attempts+for+Netis+Router+Backdoor+UDP53413/21337/ iPhone Thieves Use Targeted Phishing https://hackernoon.com/this-is-what-apple-should-tell-you-when-you-lose-your-iphone-8f07cf73cf82#.spgmbaejk NUUO/ReadyNAS Video Recorder Vulnerabilities https://raw.githubusercontent.com/pedrib/PoC/master/advisories/nuuo-nvr-vuln...

The Dark Side of Certificate Transparency https://isc.sans.edu/forums/diary/The+Dark+Side+of+Certificate+Transparency/21329/ Ouch Security Awareness Newsletter https://securingthehuman.sans.org/resources/newsletters/ouch/2016 HTTP/2 Vulnerabilities http://www.imperva.com/docs/Imperva_HII_HTTP2.pdf

Windows 10 Aniversary Update Feedback https://kc.mcafee.com/corporate/index?page=content&id=KB87536 Android Updates https://source.android.com/security/bulletin/2016-08-01.html Unlocking Murder Victim Phone With Printed Fingerprint http://msutoday.msu.edu/news/2016/accessing-a-murder-victims-smartphone-to-help-solve-a-crime/ signout.live.com remote code execution vulnerability http://www.kernelpic...

Are You Getting I-CANNED? https://isc.sans.edu/forums/diary/Are+you+getting+ICANNED/21323/ Windows 10 Anniversary Edition https://blogs.windows.com/windowsexperience/2016/06/29/windows-10-anniversary-update-available-august-2/ Pangu Jailbreak Leading To Compromised Accounts? https://www.reddit.com/r/jailbreak/comments/4v9cju/discussion_is_pangus_jailbreak_safe_an_hour_after/ https://twitter.com/Pa...

rtfobj Update https://isc.sans.edu/forums/diary/rtfobj/21317/ Comodo SSL Certificates Mixup https://thehackerblog.com/keeping-positive-obtaining-arbitrary-wildcard-ssl-certificates-from-comodo-via-dangling-markup-injection/index.html SwiftKey Keyboard May Leak Private Data to Other Users https://blog.swiftkey.com/important-information-relating-to-the-status-of-our-sync-services/ New Version of OPN...

Verifying SSL/TLS Certificates Manually https://isc.sans.edu/forums/diary/Verifying+SSLTLS+certificates+manually/21311/ LastPass Security Updates https://blog.lastpass.com/2016/07/lastpass-security-updates.html/ Android Linux Kernel Defenses https://security.googleblog.com/2016/07/protecting-android-with-more-linux.html Update to ISC Suspicious Domain List https://isc.sans.edu/suspicious_domains.h...

Linux Bot Analysis https://isc.sans.edu/forums/diary/Analyze+of+a+Linux+botnet+client+source+code/21305/ Critical XEN PV Guests Vulnerability https://isc.sans.edu/forums/diary/Critical+Xen+PV+guests+vulnerabilities/21307/ LastPass Vulnerability https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/ Chimera Ransomware Keys Leaked https://blog.malwarebytes.com/cybercri...

DNS Cmd and Ctrl via AAAA Records https://isc.sans.edu/forums/diary/Command+and+Control+Channels+Using+AAAA+DNS+Records/21301/ Microsoft Authenticator https://blogs.technet.microsoft.com/enterprisemobility/2016/07/25/microsoft-authenticator-coming-august-15th/ WPAD May Leak HTTPS URLs http://arstechnica.com/security/2016/07/new-attack-that-cripples-https-crypto-works-on-macs-windows-and-linux/ HOn...

Python Malware - Part 4 https://isc.sans.edu/forums/diary/Python+Malware+Part+4/21297/ Powerware Decrypter https://github.com/pan-unit42/public_tools/blob/master/powerware/powerware_decrypt.py No More Ransomware https://www.nomoreransom.org Pangu iOS 9.3.3 Jailbrake http://en.pangu.io Safe Skies TSA Keys Duplicated http://www.3ders.org/articles/20160725-hackers-create-3d-printed-tsa-safe-skies-mas...

NIST Digital Authentication Guide Preview https://github.com/usnistgov/800-63-3 Powerware Ransomware Spoofing Locky http://researchcenter.paloaltonetworks.com/2016/07/unit42-powerware-ransomware-spoofing-locky-malware-family/ SAP HANA Security Advisory http://www.onapsis.com/research/security-advisories Pokemon Go Forensics https://www.gillware.com/forensics/blog/mobile-forensics/oh-no-pokemon-go-...

A Practice ntds.dit File For Hash Extraction and Password Cracking https://isc.sans.edu/forums/diary/Practice+ntdsdit+File/21287/ Mozilla Further Reducing Flash Content https://blog.mozilla.org/futurereleases/2016/07/20/reducing-adobe-flash-usage-in-firefox/ Little Snitch Update https://www.obdev.at/products/littlesnitch/releasenotes.html PHP 7.0.9 / 5.6.24 Released (fixes httpoxy vulnerability) h...

Oracle Critical Patch Update http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html DNS Root Key Rotation http://schd.ws/hosted_files/icann562016/60/Matt%20Larson%20ICANN56%20KSK%20roll%20briefing.pdf Anti-Malware Codehooking Vulnerabilities http://breakingmalware.com/vulnerabilities/captain-hook-pirating-avs-bypass-exploit-mitigations/ More Details Regaring Apple's Image I/O...

Objective Systems ASN1C Compiler Creates Vulnerable Code https://github.com/programa-stic/security-advisories/tree/master/ObjSys/CVE-2016-5080 Office Maldoc Analysis https://isc.sans.edu/forums/diary/Office+Maldoc+Lets+Focus+on+the+VBA+Macros+Later/21275/ Defeating GMail's Malicious Macro Signatures https://warroom.securestate.com/bypassing-gmails-malicious-macro-signatures/

httpoxy Vulnerability https://isc.sans.edu/forums/diary/HTTP+Proxy+Header+Vulnerability+httpoxy/21271/ Apple Security Updates https://support.apple.com/en-us/HT201222 Toll Number Calling via Two Factor Authentication https://www.arneswinnen.net/2016/07/how-i-could-steal-money-from-instagram-google-and-microsoft/

More Python Malware Critical Juniper Vulnerability https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10755&actp=search MS16-053 Included in Neutrino Exploit Kit https://www.fireeye.com/blog/threat-research/2016/07/exploit_kits_quickly.html SSH Username Disclosure http://seclists.org/fulldisclosure/2016/Jul/51

The Power of Web Shells https://isc.sans.edu/forums/diary/The+Power+of+Web+Shells/21257/ Airtel India Intercepting Cloudflare Traffic https://medium.com/@karthikb351/airtel-is-sniffing-and-censoring-cloudflares-traffic-in-india-and-they-don-t-even-know-it-90935f7f6d98#.g78ucnpo6 WordPress SEO Pack Plugin Persistent Cross Site Scripting https://sumofpwn.nl/advisory/2016/persistent_cross_site_script...

Hunting for Malicious Files with MISP + OSSEC https://isc.sans.edu/forums/diary/Hunting+for+Malicious+Files+with+MISP+OSSEC/21251/ Drupal: Patch released today to fix a highly critical RCE in contributed modules https://isc.sans.edu/forums/diary/Drupal+Patch+released+today+to+fix+a+highly+critical+RCE+in+contributed+modules/21255/ Riffle anonymity network trying to compete with tor http://people.c...

Microsoft Patch Tuesday https://isc.sans.edu/forums/diary/Microsoft+Patch+Tuesday+Summary+for+July+2016/21249/ "Ranscam" Ransom Ware Deleted Data http://blog.talosintel.com/2016/07/ranscam.html