Sans Internet Storm Center Daily Network/cyber Security And Information Security Podcast

IceID Malware Update https://isc.sans.edu/forums/diary/Microsoft+Word+document+with+malicious+macro+pushes+IcedID+Bokbot/26146/ NXNSAttack DNS Amplification https://www.nxnsattack.com/ https://en.blog.nic.cz/2020/05/19/nxnsattack-upgrade-resolvers-to-stop-new-kind-of-random-subdomain-attack/ Adobe Updates https://helpx.adobe.com/security.html

Spike of Scans for Port 62234 https://isc.sans.edu/forums/diary/What+is+up+on+Port+62234/26144/ Cisco Patches https://tools.cisco.com/security/center/publicationListing.x https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-info-disclose-9eJtycMB Google Chrome 83 Released https://chromereleases.googleblog.com/ QNAP Vulnerability Details Released https://medium.com/bugbountywriteup/qnap-pre-auth-root-rce-affecting-450k-devices-on-the-internet-d55488d28a05 ISC YouTube Channel https://www.youtube.com/channel/UCfbOsqPmWg1H_34hTjKEW2A

Antivirus & Multiple Detections https://isc.sans.edu/forums/diary/Antivirus+Multiple+Detections/26134/ Office 365 Returning Search Results from Other Organizations https://www.theregister.co.uk/2020/05/18/microsoft_office_365_internal_search_mixup/ MagicPairing Vulnerabilities https://arxiv.org/pdf/2005.07255.pdf BIAS: Bluetooth Impersonation AttackS https://francozappa.github.io/about-bias/

OWA Scans https://isc.sans.edu/forums/diary/Scanning+for+Outlook+Web+Access+OWA+Microsoft+Exchange+Control+Panel+ECP/26132/ Edison iOS E-Mail Client Leaks Data https://www.theverge.com/2020/5/16/21260967/edison-mail-update-ios-security-bug COMpfun Malware Uses Status Codes to Communicate https://securelist.com/compfun-http-status-based-trojan/96874/ PAN OS Patches https://securityaffairs.co/wordpress/103265/security/palo-alto-networks-pan-os-flaws.html

Rethinking Severity https://isc.sans.edu/forums/diary/Patch+Tuesday+Revisited+CVE20201048+isnt+as+Medium+as+MS+Would+Have+You+Believe/26124/ Top Exploited Vulnerabilities https://www.us-cert.gov/ncas/alerts/aa20-133a Zerodium Drops Payouts For iOS/Safari Exploits https://twitter.com/Zerodium/status/1260541578747064326?s=20 BigIP Edge Client Vulenrability https://support.f5.com/csp/article/K20346072

Malspam with Links to ZIP Archives Pushes Dridex Malware https://isc.sans.edu/forums/diary/Malspam+with+links+to+zip+archives+pushes+Dridex+malware/26116/ Ramsay Cyber Espionage Toolkit https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/ Windows DNS over HTTPS Preview https://techcommunity.microsoft.com/t5/networking-blog/windows-insiders-can-now-test-dns-over-https/ba-p/1381282# ISC Handler Series (SANSFIRE) https://www.sans.org/event/sansfire-2020/bonus-sessions/

Microsoft Patch Tuesday https://isc.sans.edu/forums/diary/Microsoft+May+2020+Patch+Tuesday/26114/ Adobe Security Updates https://helpx.adobe.com/security.html Android Applications Expose Firebase Databases https://www.comparitech.com/blog/information-security/firebase-misconfiguration-report/#What_data_is_exposed More Magecart Sighted https://maxkersten.nl/2020/05/06/backtracking-magecart-infections/ Glitter vs. Thunderspy https://www.youtube.com/watch?v=vlK5rrlc44g

Excel 4 Macro Analysis: XLMMacroDeobfuscator https://isc.sans.edu/forums/diary/Excel+4+Macro+Analysis+XLMMacroDeobfuscator/26110/ LinkedIn Phish https://youtu.be/g0WHz6rikoc ThunderSpy Thunderbolt Attack https://thunderspy.io/ vBulletin Vulnerability https://nvd.nist.gov/vuln/detail/CVE-2020-12720 Mini-Netwars https://www.sans.org/mini-netwars

YARA 4.0.0 Released https://isc.sans.edu/forums/diary/YARA+v400+BASE64+Strings/26106/ VMWare Patches vRealize to Address Saltstack Vulnerabilities https://www.vmware.com/security/advisories/VMSA-2020-0009.html Samsung Paches Android RCE Vulnerabilities https://bugs.chromium.org/p/project-zero/issues/detail?id=2002 https://security.samsungmobile.com/securityUpdate.smsb MacOS 2FA Application Trojan https://blog.malwarebytes.com/threat-analysis/2020/05/new-mac-variant-of-lazarus-dacls-rat-distributed-via-trojanized-2fa-app/

Scanning With NMAP NSE Scripts https://isc.sans.edu/forums/diary/Scanning+with+nmaps+NSE+scripts/26096/ iOS Psychic Paper Vulerability https://siguza.github.io/psychicpaper/ World Password Day https://www.microsoft.com/security/blog/2020/05/07/protect-accounts-smarter-ways-sign-in-world-passwordless-day https://tails.boum.org/news/version_4.6/index.en.html Cisco Kerberos Bypass https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-asa-kerberos-bypass-96Gghe2sS

Keeping an Eye on Malicious Files Life Time https://isc.sans.edu/forums/diary/Keeping+an+Eye+on+Malicious+Files+Life+Time/26092/ Fake Crypto Wallet Chrome Extensions https://www.theregister.co.uk/2020/05/06/chrome_malicious_extensions/ Favicon Hides Credit Card Skimmer https://blog.malwarebytes.com/threat-analysis/2020/05/credit-card-skimmer-masquerades-as-favicon/ WebEx Phishing https://abnormalsecurity.com/blog/abnormal-attack-stories-cisco-webex-phishing/

Do Cloud Security Features Replace Pesonnel Security Capabilities? https://isc.sans.edu/forums/diary/Cloud+Security+Features+Dont+Replace+the+Need+for+Personnel+Security+Capabilities/26088/ Citrix ShareFile Storage Zones Controller Update https://support.citrix.com/article/CTX269106 Android Update https://source.android.com/security/bulletin/2020-05-01 Firefox Update https://www.mozilla.org/en-US/firefox/76.0/releasenotes/ Dell OS Recovery Image Insecure Inherited Permissions https://www.dell.com/support/article/de-de/sln321036/dsa-2020-059-dell-os-recovery-image-insecure-inherited-permissions-vulnerability?lang=en WordPress Update https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates

Exploring the Sysmon 11 File Deletion Protection https://isc.sans.edu/forums/diary/Sysmon+and+File+Deletion/26084/ Digicert CT Compromise https://groups.google.com/a/chromium.org/forum/#!topic/ct-policy/aKNbZuJzwfM WebLogic Flaw (new one..) Exploited in the Wild https://blogs.oracle.com/security/apply-april-2020-cpu

ZIP Files and AES https://isc.sans.edu/forums/diary/ZIP+AES/26080/ Saltstack Vulnerability Exploited in the Wild https://status.ghost.org/ Mobile Device Manager Compromise https://research.checkpoint.com/2020/first-seen-in-the-wild-mobile-as-attack-vector-using-mdm/

Collecting IOCs from IMAP Folder https://isc.sans.edu/forums/diary/Collecting+IOCs+from+IMAP+Folder/26070/ Attack Traffic on TCP Port 9673 https://isc.sans.edu/forums/diary/Attack+traffic+on+TCP+port+9673/26074/ Saltstack Authorization Bypass https://labs.f-secure.com/advisories/saltstack-authorization-bypass Mac Sandbox Escape https://lapcatsoftware.com/articles/sandbox-escape.html

Privacy Preserving Protocols to Trace Covid19 Exposure https://isc.sans.edu/forums/diary/Privacy+Preserving+Protocols+to+Trace+Covid19+Exposure/26066/ Google Chrome Update https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_27.html https://docs.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security Updated Version of Sysmon https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon https://techcommunity.microsoft.com/t5/sysinternals-blog/sysmon-v11-0-livekd-v5-63-process-explorer-v16-32-coreinfo-v3-5/ba-p/1345153 Shade Ransomware Keys Released https://github.com/shade-team/keys/blob/master/README.md Exploiting the Exploiters https://medium.com/@curtbraz/exploiting-the-exploiters-46fd0d620fd8

Agent Tesla Delivered by the Same Phishing Campagin for Over a Year https://isc.sans.edu/forums/diary/Agent+Tesla+delivered+by+the+same+phishing+campaign+for+over+a+year/26062/ VMWare ESXi Patch https://www.vmware.com/security/advisories/VMSA-2020-0008.html Microsoft Guidance For Ransomware Response https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/ Adobe Security Patches https://helpx.adobe.com/security.html

Powershell Payload Stored in a PSCredential Object https://isc.sans.edu/forums/diary/Powershell+Payload+Stored+in+a+PSCredential+Object/26058/ Microsoft Teams Account Takeover Bug https://www.cyberark.com/threat-research-blog/beware-of-the-gif-account-takeover-vulnerability-in-microsoft-teams/ USB Drives used to Spread Crypto Coin Mining Botnet https://www.welivesecurity.com/2020/04/23/eset-discovery-monero-mining-botnet-disrupted/

Malware Bazaar https://isc.sans.edu/forums/diary/MALWARE+Bazaar/26052/ CIRA Luanches Canadian Shield https://www.cira.ca/newsroom/canadian-shield/cira-launches-canadian-shield-provide-free-privacy-and-security-canadians Covid19 Tracing Protocols https://github.com/DP-3T/documents https://www.pepp-pt.org/content https://www.apple.com/covid19/contacttracing/ Sophos XG Firewall SQL Injection Vulnerablity Exploited https://community.sophos.com/kb/en-us/135412

GCC's New Security Analyzer Finds Flaw in OpenSSL https://developers.redhat.com/blog/2020/03/26/static-analysis-in-gcc-10/ IBM Spectrum Protect Server Stack Based Buffer Overflow https://www.ibm.com/support/pages/node/6195706 Possible Issues With Cummulative Windows Updates https://www.reddit.com/search/?q=KB4549951 Using a GPU as a Radio https://duo.com/labs/research/finding-radio-sidechannels Comparing Red Team Platforms https://redcanary.com/blog/comparing-red-team-platforms/