SANS Stormcast: Daily Cyber Security News

Microsoft January 2024 Patch Tuesday https://isc.sans.edu/forums/diary/Microsoft+January+2024+Patch+Tuesday/30548/ Adobe Vulnerabilities https://helpx.adobe.com/security/products/substance3d_stager/apsb24-06.html CVE-2023-50916: Authentication Coercion Vulnerablity in Kyocera Device Manager https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-50916-authentication-coercion-vulne...

Microsoft January 2024 Patch Tuesday https://isc.sans.edu/forums/diary/Microsoft+January+2024+Patch+Tuesday/30548/ Adobe Vulnerabilities https://helpx.adobe.com/security/products/substance3d_stager/apsb24-06.html CVE-2023-50916: Authentication Coercion Vulnerablity in Kyocera Device Manager https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-50916-authentication-coercion-vulne...

What is That User Agent https://isc.sans.edu/diary/What%20is%20that%20User%20Agent%3F/30536 KyberSlash Vulnerability https://kyberslash.cr.yp.to/faq.html Netfilter DoS Vulnerability CVE-2024-0193 https://access.redhat.com/security/cve/CVE-2024-0193 Cacti Vulnerability https://github.com/Cacti/cacti/security/advisories/GHSA-pfh9-gwm6-86vp

What is That User Agent https://isc.sans.edu/diary/What%20is%20that%20User%20Agent%3F/30536 KyberSlash Vulnerability https://kyberslash.cr.yp.to/faq.html Netfilter DoS Vulnerability CVE-2024-0193 https://access.redhat.com/security/cve/CVE-2024-0193 Cacti Vulnerability https://github.com/Cacti/cacti/security/advisories/GHSA-pfh9-gwm6-86vp

Netstat But Better and in PowerShell https://isc.sans.edu/diary/Netstat%2C%20but%20Better%20and%20in%20PowerShell/30532 Double Phishing Submission https://isc.sans.edu/diary/Are%20you%20sure%20of%20your%20password%3F/30534 Suspicious Prometei Botnet Activity https://isc.sans.edu/diary/Suspicious%20Prometei%20Botnet%20Activity/30538 Spectral Blur Mac Malware https://g-les.github.io/yara/2024/01/03/...

Netstat But Better and in PowerShell https://isc.sans.edu/diary/Netstat%2C%20but%20Better%20and%20in%20PowerShell/30532 Double Phishing Submission https://isc.sans.edu/diary/Are%20you%20sure%20of%20your%20password%3F/30534 Suspicious Prometei Botnet Activity https://isc.sans.edu/diary/Suspicious%20Prometei%20Botnet%20Activity/30538 Spectral Blur Mac Malware https://g-les.github.io/yara/2024/01/03/...

Wireshark Updates https://isc.sans.edu/diary/Wireshark%20updates/30528 Android Updates https://source.android.com/docs/security/bulletin/2024-01-01 Ivanti Critical Vulnerability https://forums.ivanti.com/s/article/SA-2023-12-19-CVE-2023-39336?language=en_US Malicious PyPi Packages https://www.fortinet.com/blog/threat-research/malicious-pypi-packages-deploy-coinminer-on-linux-devices Everything npm...

Wireshark Updates https://isc.sans.edu/diary/Wireshark%20updates/30528 Android Updates https://source.android.com/docs/security/bulletin/2024-01-01 Ivanti Critical Vulnerability https://forums.ivanti.com/s/article/SA-2023-12-19-CVE-2023-39336?language=en_US Malicious PyPi Packages https://www.fortinet.com/blog/threat-research/malicious-pypi-packages-deploy-coinminer-on-linux-devices Everything npm...

Interesting large and small malspam attachments from 2023 https://isc.sans.edu/diary/Interesting%20large%20and%20small%20malspam%20attachments%20from%202023/30524 Orange Spain RIPE Account Compromise https://www.bleepingcomputer.com/news/security/hacker-hijacks-orange-spain-ripe-account-to-cause-bgp-havoc/ Bitwarden Heist https://blog.redteam-pentesting.de/2024/bitwarden-heist/ Apple iOS PoC Explo...

Interesting large and small malspam attachments from 2023 https://isc.sans.edu/diary/Interesting%20large%20and%20small%20malspam%20attachments%20from%202023/30524 Orange Spain RIPE Account Compromise https://www.bleepingcomputer.com/news/security/hacker-hijacks-orange-spain-ripe-account-to-cause-bgp-havoc/ Bitwarden Heist https://blog.redteam-pentesting.de/2024/bitwarden-heist/ Apple iOS PoC Explo...

Fingerprinting SSH Identification Strings https://isc.sans.edu/diary/Fingerprinting%20SSH%20Identification%20Strings/30520 Google OAUTH2 Exploited by Malware https://www.cloudsek.com/blog/compromising-google-accounts-malwares-exploiting-undocumented-oauth2-functionality-for-session-hijacking TsuKing DNS Amplification https://lixiang521.com/publication/ccs23/ccs23-xu-tsuking.pdf

Fingerprinting SSH Identification Strings https://isc.sans.edu/diary/Fingerprinting%20SSH%20Identification%20Strings/30520 Google OAUTH2 Exploited by Malware https://www.cloudsek.com/blog/compromising-google-accounts-malwares-exploiting-undocumented-oauth2-functionality-for-session-hijacking TsuKing DNS Amplification https://lixiang521.com/publication/ccs23/ccs23-xu-tsuking.pdf

Shall We Play a Game https://isc.sans.edu/diary/Shall+We+Play+a+Game/30510 Mailtrap.io Exfiltration https://isc.sans.edu/diary/Python%20Keylogger%20Using%20Mailtrap.io/30512 Pi Hole Docker https://isc.sans.edu/forums/diary/Pi-Hole%20Pi4%20Docker%20Deployment/30516/ Mirai Update https://isc.sans.edu/diary/Unveiling%20the%20Mirai%3A%20Insights%20into%20Recent%20DShield%20Honeypot%20Activity%20%5BGue...

Shall We Play a Game https://isc.sans.edu/diary/Shall+We+Play+a+Game/30510 Mailtrap.io Exfiltration https://isc.sans.edu/diary/Python%20Keylogger%20Using%20Mailtrap.io/30512 Pi Hole Docker https://isc.sans.edu/forums/diary/Pi-Hole%20Pi4%20Docker%20Deployment/30516/ Mirai Update https://isc.sans.edu/diary/Unveiling%20the%20Mirai%3A%20Insights%20into%20Recent%20DShield%20Honeypot%20Activity%20%5BGue...

Securing Web Servers https://isc.sans.edu/diary/How%20to%20Protect%20your%20Webserver%20from%20Directory%20Enumeration%20Attack%20%3F%20Apache2%20%5BGuest%20Diary%5D/30504 Chrome 0-Day (last one for the year?) https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_20.html Note that there will be no daily stormcast for the rest of the year. Returning January 2nd SANS Cloud...

Securing Web Servers https://isc.sans.edu/diary/How%20to%20Protect%20your%20Webserver%20from%20Directory%20Enumeration%20Attack%20%3F%20Apache2%20%5BGuest%20Diary%5D/30504 Chrome 0-Day (last one for the year?) https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_20.html Note that there will be no daily stormcast for the rest of the year. Returning January 2nd SANS Cloud...

Increase in Exploit Attempts for Atlassian Confluence Server (CVE-2023-22518) https://isc.sans.edu/diary/Increase%20in%20Exploit%20Attempts%20for%20Atlassian%20Confluence%20Server%20%28CVE-2023-22518%29/30502 Fake F5 BigIP Update https://www.bleepingcomputer.com/news/security/fake-f5-big-ip-zero-day-warning-emails-push-data-wipers/ Google OAUTH Problems https://trufflesecurity.com/blog/google-oaut...

Increase in Exploit Attempts for Atlassian Confluence Server (CVE-2023-22518) https://isc.sans.edu/diary/Increase%20in%20Exploit%20Attempts%20for%20Atlassian%20Confluence%20Server%20%28CVE-2023-22518%29/30502 Fake F5 BigIP Update https://www.bleepingcomputer.com/news/security/fake-f5-big-ip-zero-day-warning-emails-push-data-wipers/ Google OAUTH Problems https://trufflesecurity.com/blog/google-oaut...

What are they looking for? Scans for OpenID Connect Configuration https://isc.sans.edu/diary/What%20are%20they%20looking%20for%3F%20Scans%20for%20OpenID%20Connect%20Configuration%20%28Update%3A%20CitrixBleed%29/30498 Terrapin Attack Against SSH https://terrapin-attack.com/TerrapinAttack.pdf ALPHV/Blackcat Ransomware Disrupted and Decryptor Available https://www.justice.gov/opa/pr/justice-departmen...

What are they looking for? Scans for OpenID Connect Configuration https://isc.sans.edu/diary/What%20are%20they%20looking%20for%3F%20Scans%20for%20OpenID%20Connect%20Configuration%20%28Update%3A%20CitrixBleed%29/30498 Terrapin Attack Against SSH https://terrapin-attack.com/TerrapinAttack.pdf ALPHV/Blackcat Ransomware Disrupted and Decryptor Available https://www.justice.gov/opa/pr/justice-departmen...

SMTP Smuggling - Spoofing E-Mails Worldwide https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/ Ledger Supply Chain Attack https://www.ledger.com/blog/a-letter-from-ledger-chairman-ceo-pascal-gauthier-regarding-ledger-connect-kit-exploit December Windows 11 Patch Breacks Wi-Fi Connectivity https://www.bleepingcomputer.com/news/microsoft/decembers-windows-11-kb5033375-upd...

SMTP Smuggling - Spoofing E-Mails Worldwide https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/ Ledger Supply Chain Attack https://www.ledger.com/blog/a-letter-from-ledger-chairman-ceo-pascal-gauthier-regarding-ledger-connect-kit-exploit December Windows 11 Patch Breacks Wi-Fi Connectivity https://www.bleepingcomputer.com/news/microsoft/decembers-windows-11-kb5033375-upd...

An Example of a RocketMQ Exploit Scanner https://isc.sans.edu/diary/An%20Example%20of%20RocketMQ%20Exploit%20Scanner/30492 C# Payload Phoning to a Cobalt Strike Server https://isc.sans.edu/diary/CSharp%20Payload%20Phoning%20to%20a%20CobaltStrike%20Server/30490 3CX SQL Injection Vulnerability https://www.3cx.com/blog/news/sql-database-integration/ QNAP Viostor 0-Day Vulnerablity https://www.akamai....

An Example of a RocketMQ Exploit Scanner https://isc.sans.edu/diary/An%20Example%20of%20RocketMQ%20Exploit%20Scanner/30492 C# Payload Phoning to a Cobalt Strike Server https://isc.sans.edu/diary/CSharp%20Payload%20Phoning%20to%20a%20CobaltStrike%20Server/30490 3CX SQL Injection Vulnerability https://www.3cx.com/blog/news/sql-database-integration/ QNAP Viostor 0-Day Vulnerablity https://www.akamai....

T-shooting Terraform for DShield Honeypot in Azure https://isc.sans.edu/diary/T-shooting%20Terraform%20for%20DShield%20Honeypot%20in%20Azure%20%5BGuest%20Diary%5D/30484 Ubiquity Unifi Cameras Visible in Wrong Account https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misconfiguration/fe8d4479-e187-4471-bf95-b2799183ceb7 Zoom Vulnerabilities and VISS https://viss.zoom.com/specifications https:...