SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Remotewebaccess.com Domain in Certificate Transparency Logs https://isc.sans.edu/forums/diary/Huge+Amount+of+remotewebaccesscom+Sites+Found+in+Certificate+Transparency+Logs/25352/ Adobe Releases Emergency ColdFusion Patch https://blogs.adobe.com/psirt/?p=1789 Apple Releases Additional Updates for iOS/iPadOS https://support.apple.com/en-us/HT201222 vBulletin Vulnerability 0-Day Exploit Released https://seclists.org/fulldisclosure/2019/Sep/31

Microsoft Releases Special Patch for Exploited Vulnerability in Internet Explorer https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1367 Cloudflare Adding "Bot Fight" option https://blog.cloudflare.com/cleaning-up-bad-bots/ iOS Bluetooth Access Feature https://www.theverge.com/2019/9/19/20867286/ios-13-bluetooth-permission-privacy-feature-apps Forcepoint VPN Update https://support.forcepoint.com/KBArticle?id=000017525

Popular Android Selfie Apps Act as Adware https://www.wandera.com/mobile-security/google-play-adware/ Wireshark Update https://www.wireshark.org/docs/relnotes/wireshark-3.0.5.html Harbor Privilege Escalation https://unit42.paloaltonetworks.com/critical-vulnerability-in-harbor-enables-privilege-escalation-from-zero-to-admin-cve-2019-16097/

Agent Tesla https://isc.sans.edu/forums/diary/Agent+Tesla+Trojan+Abusing+Corporate+Email+Accounts/25336/ Apple Updates https://support.apple.com/en-us/HT201222 https://developer.apple.com/documentation/safari_release_notes/safari_13_release_notes SAMBA 4.11 Released https://www.samba.org/samba/history/samba-4.11.0.html GitHub Security Updates https://github.blog/2019-09-18-securing-software-together/

Analyzing a Current Emotet Sample https://isc.sans.edu/forums/diary/Emotet+malspam+is+back/25330/ Windows Defender "Scan Now" Failed Bug Fix https://www.bleepingcomputer.com/news/microsoft/windows-defender-antivirus-scans-broken-after-new-update/ https://borncity.com/win/2019/09/18/defender-antimalware-version-4-18-1908-7-released/ QEMU Vulnerablity https://www.openwall.com/lists/oss-security/2019/09/17/1 VMWare Vulnerabilty https://blogs.vmware.com/security/2019/09/amd-display-driver-security-updates-address-cve-2019-5685.html New CWE Top 25 Released https://cwe.mitre.org/top25/archive/2019/2019_cwe_top25.html

Investigating Gaps in Windows Event Logs https://isc.sans.edu/forums/diary/Investigating+Gaps+in+your+Windows+Event+Logs/25328/ SOHOpelesly Broken 2 https://www.securityevaluators.com/whitepaper/sohopelessly-broken-2/ HP Printer Privacy https://robertheaton.com/2019/09/15/hp-printers-send-data-on-what-you-print-back-to-hp/

Encrypted Sextortion https://isc.sans.edu/forums/diary/Encrypted+Sextortion+PDFs/25324/ SimJacker https://www.adaptivemobile.com/blog/simjacker-next-generation-spying-over-mobile LastPass Password Leak https://bugs.chromium.org/p/project-zero/issues/detail?id=1930 Microsoft Extends EoL For Exchange Server 2010 https://techcommunity.microsoft.com/t5/Exchange-Team-Blog/Microsoft-Extending-End-of-Support-for-Exchange-Server-2010-to/ba-p/753591

Rig Exploit Kit Delivering VBScript https://isc.sans.edu/forums/diary/Rig+Exploit+Kit+Delivering+VBScript/25318/ Pentesters Arrested During Physical Access Pentest https://arstechnica.com/information-technology/2019/09/check-the-scope-pen-testers-nabbed-jailed-in-iowa-courthouse-break-in-attempt/ iOS Lock Screen Unlock Vulnerability https://www.theregister.co.uk/2019/09/12/apples_ios_lock_workaround/

Microsoft Patch Tuesday https://isc.sans.edu/forums/diary/Microsoft+September+2019+Patch+Tuesday/25310/ Adobe Patches https://helpx.adobe.com/security.html Intel SSH Side Channel Vulnerability https://www.vusec.net/projects/netcat/ https://www.cs.vu.nl/~herbertb/download/papers/netcat_sp20.pdf

Firefox to Enable DNS over HTTPs by Default in September https://blog.mozilla.org/futurereleases/2019/09/06/whats-next-in-making-dns-over-https-the-default/ Telegram Fixes Privacy Bug https://www.inputzero.io/2019/09/telegram-privacy-fails-again.html PsiXBot Uses DoH https://www.proofpoint.com/us/threat-insight/post/psixbot-now-using-google-dns-over-https-and-possible-new-sexploitation-module