SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

A Recent MySQL Honeypot Compromise https://isc.sans.edu/forums/diary/MySQL+is+YourSQL/21117/ Team Viewer Improves Security http://www.teamviewer.com/en/company/press/teamviewer-launches-trusted-devices-and-data-integrity/ Black Shades Ransomware http://www.bleepingcomputer.com/news/security/black-shades-ransomware-encrypts-your-pc-and-taunts-security-researchers/ NTP Update http://support.ntp.org/...

Docker Containers Logging https://isc.sans.edu/forums/diary/Docker+Containers+Logging/21121/ Lenovo Suggests Uninstalling Accelerator Application https://support.lenovo.com/us/en/product_security/len_6718 Google Chrome Update http://googlechromereleases.blogspot.com/search/label/Stable%20updates MongoDB Injection http://blog.securelayer7.net/mongodb-security-injection-attacks-with-php/ Ouch! Newsl...

KeePass Insecure Update https://bogner.sh/2016/03/mitm-attack-against-keepass-2s-update-check/ Possible TeamViewer Breach http://www.theregister.co.uk/2016/06/01/teamviewer_mass_breach_report/ Windows 10 Exploit Offered For Sale https://www.trustwave.com/Resources/SpiderLabs-Blog/Zero-Day-Auction-for-the-Masses/?page=1&year=0&month=0 Intrusion Detection in Depth Minneapolis (July 18-23rd) https://...

Increase in Telnet Scans https://isc.sans.edu/forums/diary/Increase+in+Port+23+telnet+scanning/21115/ Bloatware Introducing Security Flaws in Laptops https://duo.com/blog/out-of-box-exploitation-a-security-analysis-of-oem-updaters Exploit Released for Unpatchable SCADA Controller https://www.exploit-db.com/exploits/37154/ Fail2Ban Adding IPv6 Support https://www.slightfuture.com/security/fail2ban-...

Hardcoded Password in Medical Software https://www.kb.cert.org/vuls/id/482135 Google Chorme Update http://googlechromereleases.blogspot.com.au/search/label/Stable%20updates PA DSS Update https://www.pcisecuritystandards.org/document_library JetPack WordPress Plugin XSS vulnerabilties https://jetpack.com/2016/05/27/jetpack-4-0-3-critical-security-update/ Tor Browser Fingerprinting Site https://tor....

Analysis of a Distributed Denial of Service Attack https://isc.sans.edu/forums/diary/Analysis+of+a+Distributed+Denial+of+Service+DDoS/21109/ Bluecoat CA http://www.theregister.co.uk/2016/05/27/blue_coat_ca_certs/ Google Requires Symantec CAs to Comply With Certificate Transparency https://cabforum.org/pipermail/public/2016-May/007573.html

Keeping an Eye on Tor Traffic https://isc.sans.edu/forums/diary/Keeping+an+Eye+on+Tor+Traffic/21103/ Next Generation Tor Passed First Test https://blog.torproject.org/blog/mission-montreal-building-next-generation-onion-services DDoS Prives Drop https://www.incapsula.com/blog/unmasking-ddos-for-hire-fiverr.html Older Microsoft Office Vulnerabilities Still Used by "APT" Actors https://securelist.co...

DNS Covert Channel Used in Targeted Attacks http://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/ Genius Web Annotation Serivce Is Removing Security Headers http://www.theverge.com/2016/5/25/11505454/news-genius-annotate-the-web-content-security-policy-vulnerability Canary Tokens For Windows Binaries http://blog.thinkst.com/2...

Verisign/US-Cert Warn of The Use of Local TLDs for WPAD http://www.verisign.com/assets/labs/MitM-Attack-by-Name-Collision-Cause-Analysis-and-WPAD-Vulnerability-Assessment-in-the-New-gTLD-Era.pdf Proposal To Use TLS for DNS https://www.rfc-editor.org/rfc/rfc7858.txt Azure Blacklists Common Password https://blogs.technet.microsoft.com/ad/2016/05/24/another-117m-leaked-usernames-and-passwords-new-bes...

Detailed Technical Report Released About Targeted Attack Against RUAG https://isc.sans.edu/forums/diary/Technical+Report+about+the+RUAG+attack/21091/ New Variation of PastJacking Exploit Affecting vim https://github.com/dxa4481/Pastejacking Xen qemu Patch Released to Limit Log File Size http://xenbits.xen.org/xsa/advisory-180.html

Missing MRU Registry Keys For Files Opened With Winzip https://isc.sans.edu/forums/diary/The+strange+case+of+WinZip+MRU+Registry+key/21087/ OWASP Asking for Top 10 Overhaul Input https://twitter.com/wichers/status/733855223832272896 Google is Updating the Safe Browsing API https://security.googleblog.com/2016/05/evolving-safe-browsing-api.html Facebook Sued Over Scanning Of Private Messages https:...

EITest Campaign Still Going Strong https://isc.sans.edu/forums/diary/EITest+campaign+still+going+strong/21081/ Android Malware Affecting Google Pay Acceptance http://www.theregister.co.uk/2016/05/19/android_pay_analysis/ OS 9.3 Restricts Use Of Fingerprint https://www.apple.com/business/docs/iOS_Security_Guide.pdf

Teslacrypt Shutting Down and Releasing Master Key http://www.bleepingcomputer.com/news/security/teslacrypt-shuts-down-and-releases-master-decryption-key/ Office 365 Risks https://www.skyhighnetworks.com/cloud-security-blog/7-charts-reveal-the-meteoric-rise-of-office-365/ LinkedIn Data Leaked From Past Breach https://twitter.com/troyhunt/status/732838759390191617 Google Discontinuing SSLv3/RC4 Supp...

Exploit for Recently Patched Cisco IKEv1/v2 Bufferoverflow Published https://isc.sans.edu/forums/diary/Exploit+Available+For+Cisco+IKEv1+and+IKEv2+Buffer+Overflow+Vulnerability/21065/ Symantec Antivirus Engine Malformed PE Header Parser Vulnerability https://isc.sans.edu/forums/diary/CVE20162208+Symantec+Antivirus+Engine+Malformed+PE+Header+Parser+Memory+Access+Violation/21069/ New CryptXXX Decryp...

419 Death Scams Still Going Around https://isc.sans.edu/forums/diary/An+oldie+but+a+goodie+419+Death+Scam/21061/ Apple Updates https://support.apple.com/en-us/HT201222 Flash Zero Day Details https://www.fireeye.com/blog/threat-research/2016/05/cve-2016-4117-flash-zero-day.html Google "HTML5 By Default" Draft https://docs.google.com/presentation/d/106_KLNJfwb9L-1hVVa4i29aw1YXUy9qFX-Ye4kvJj-4/edit#s...

Python Malware https://isc.sans.edu/forums/diary/Python+Malware+Part+1/21057/ Ubiquity AirOS Worm http://community.ubnt.com/t5/airMAX-General-Discussion/Virus-attack-URGENT-UBNT/td-p/1562940 Google Chrome Update http://www.theregister.co.uk/2016/05/13/google_crushes_five_vulns_with_patch_run_and_20k_in_bug_bounties/ More Banks Affected By Fake SWIFT Transactions http://www.nytimes.com/2016/05/13/b...

Adobe Flash Player Update Released https://helpx.adobe.com/security/products/flash-player/apsb16-15.html Microsoft Excel Phishing https://isc.sans.edu/forums/diary/Another+Day+Another+Wave+of+Phishing+Emails/21045/ Squid Proxy Bug Allows For Cache Poisoning http://bugs.squid-cache.org/show_bug.cgi?id=4501 Nation State Attackers May Exploit Firefox https://blog.mozilla.org/blog/2016/05/11/advanced-...

Exploited Flash Vulnerablity Patched Only For Windows https://helpx.adobe.com/security/products/flash-player/apsa16-02.html SAP Vulnerabilities Exploited https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applications Free Decryption Tool For CryptXXX No Longer Works https://www.proofpoint.com/us/threat-insight/post/cryptxxx2-ransomware-authors-strike-ba...

Windows Patch Tuesday https://isc.sans.edu/mspatchdays.html?viewday=2016-05-10 Adobe Patch Tuesday https://helpx.adobe.com/security.html

Network Forensics With DShell https://isc.sans.edu/forums/diary/Performing+network+forensics+with+Dshell+Part+1+Basic+usage/21035/ Aruba Vulnerabilities (and Patches) http://seclists.org/fulldisclosure/2016/May/19 Allwinner Android Device Debug Backdoor http://forum.armbian.com/index.php/topic/1108-security-alert-for-allwinner-sun8i-h3a83th8/ ImageTragick Flaw Being Exploited https://blog.cloudfla...

A Quick Introduction To Linux Capabilities https://isc.sans.edu/forums/diary/Guest+Diary+Linux+Capabilities+A+friend+and+foe/21031/ Review of TLS Proxy Security Issues http://users.encs.concordia.ca/~mmannan/publications/ssl-interception-ndss2016.pdf Ransomware Claims to Donate Proceeds To Charity https://heimdalsecurity.com/blog/security-alert-new-ransomware-donate-earnings-charity/

Large Number of Credentials Offered For Sale http://www.reuters.com/article/us-cyber-passwords-idUSKCN0XV1I6 Alphalocker: Affordable Ransom Ware https://blog.cylance.com/an-introduction-to-alphalocker JAKU Botnet https://www.forcepoint.com/sites/default/files/resources/files/report_jaku_analysis_of_botnet_campaign_en_0.pdf Juniper Update http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10...

Malicious Ads Seens On CBS TV Stations https://blog.malwarebytes.org/threat-analysis/2016/05/cbs-affiliated-television-stations-expose-visitors-to-angler-exploit-kit/ ImageMagick Vulnerability https://isc.sans.edu/forums/diary/ImageTragick+Another+Vulnerability+Another+Nickname/21023/ Fake DDoS Threats Continue http://www.actionfraud.police.uk/news/online-extortion-demands-affecting-businesses-apr...

OpenSSL Update Released https://isc.sans.edu/forums/diary/OpenSSL+Updates/21015/ Gerber Exploit Kit Installed By Neutrino EK https://isc.sans.edu/forums/diary/Neutrino+exploit+kit+sends+Cerber+ransomware/21017/ Image Magick Vulnerablity https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588 http://www.openwall.com/lists/oss-security/2016/05/03/18 Microsoft Will No Longer Consider S...

Fake Google Chrome Update Installs Malware on Android https://www.zscaler.com/blogs/research/android-infostealer-posing-fake-google-chrome-update Android May Security Bulletin https://source.android.com/security/bulletin/2016-05-01.html Google Chrome Update https://source.android.com/security/bulletin/2016-05-01.html Pwned List Got Pwned http://krebsonsecurity.com/2016/05/how-the-pwnedlist-got-pwn...