SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Binary Analysis With Jupyter and Radare2 https://isc.sans.edu/forums/diary/Binary+Analysis+with+Jupyter+and+Radare2/24748/ IMAP Brute Forcing against Cloud Accounts https://www.proofpoint.com/us/threat-insight/post/threat-actors-leverage-credential-dumps-phishing-and-legacy-email-protocols Google Allows GSuite Users to Disable SMS/Voice Authentication https://gsuiteupdates.googleblog.com/2019/03/more-control-over-2-step-verification-security-phone-sms.html Sniffing Bitlocker Keys from TPM https://pulsesecurity.co.nz/articles/TPM-sniffing

Analyzing ZIP Files in Ghydra https://isc.sans.edu/forums/diary/Tip+Ghidra+ZIP+Files/24732/ 64 Bit Certificate Serial Number Revocation https://adamcaudill.com/2019/03/09/tls-64bit-ish-serial-numbers-mass-revocation/ Cisco Default Account Problem https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190313-cspcscv Intel Patches https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00185.html https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00191.html

Microsoft Patch Tuesday https://isc.sans.edu/forums/diary/Microsoft+March+2019+Patch+Tuesday/24742/ Adobe Updates https://helpx.adobe.com/security.html PSMiner https://blog.360totalsecurity.com/en/new-mining-worm-psminer-uses-multiple-high-risk-vulnerabilities-to-spread/ Automatic Certificate Managment Environment https://tools.ietf.org/html/rfc8555

DevOps Tool StackStorm Vulnerability https://quitten.github.io/StackStorm/ Developers Will Not Code Secure By Default https://net.cs.uni-bonn.de/fileadmin/user_upload/naiakshi/Naiakshina_Password_Study.pdf Gaming Industry Supply Chain Attack https://www.welivesecurity.com/2019/03/11/gaming-industry-scope-attackers-asia/

Reversing HTA Files https://isc.sans.edu/forums/diary/Quick+and+Dirty+Malicious+HTA+Analysis/24728/ Apache SOLR Patch https://issues.apache.org/jira/browse/SOLR-13301 Windows 7 + Google Chrome Exploit in the Wild https://security.googleblog.com/2019/03/disclosing-vulnerabilities-to-protect.html Vulnerable Car Alarms https://www.pentestpartners.com/security-blog/gone-in-six-seconds-exploiting-car-alarms/

RSA Panel Video https://www.rsaconference.com/videos/the-five-most-dangerous-new-attack-techniques-and-how-to-counter-them Disposable E-Mail Addresses https://isc.sans.edu/forums/diary/Keep+an+Eye+on+Disposable+Email+Addresses/24716/ NetApp Default Account Vulnerability https://security.netapp.com/advisory/ntap-20190305-0001/ Cisco NS-OS NX-API Privilege Escalation https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-NXAPI-cmdinj Slub Backdoor Users GitHub and Slack https://blog.trendmicro.com/trendlabs-security-intelligence/new-slub-backdoor-uses-github-communicates-via-slack/

More Resume Malspam. Now With Trickbot and EternalBlue https://isc.sans.edu/forums/diary/Malspam+with+passwordprotected+word+docs+still+pushing+IcedID+Bokbot+with+Trickbot/24708/ Cloudflare Deploys Rules to Protect Against Recent Drupal Exploit https://www.bleepingcomputer.com/news/security/cloudflare-deploys-firewall-rule-to-block-new-drupal-exploits/ Cisco DoS Vulnerability Activity Exploited https://www.pentestpartners.com/security-blog/cisco-rv130-its-2019-but-yet-strcpy/ MonitorKit uses macOS Game Engine to Analyze Security Events https://github.com/objective-see

Comcast Uses same "0000" PIN For All Number Porting Requests https://nakedsecurity.sophos.com/2019/03/05/comcast-security-nightmare-default-0000-pin-on-everybodys-account/ NSA Releases Ghidra Reverse Analysis Tool https://ghidra-sre.org/ Recent Google Chrome Vulnerability Being Exploited https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop.html?m=1 Android Monthly Security Bulletin https://source.android.com/security/bulletin/2019-03-01

MacOS Unpatched Privilge Escalation Vulnerability made Public https://bugs.chromium.org/p/project-zero/issues/detail?id=1726 Windows Exploit Suggester Next Generation Released https://github.com/bitsadmin/wesng Docker Vulnerability used for Crypto Miners https://www.imperva.com/blog/hundreds-of-vulnerable-docker-hosts-exploited-by-cryptocurrency-miners/ Russian GPS Jamming Exercises https://thebarentsobserver.com/en/security/2019/03/russian-military-officials-arrive-oslo-norway-provides-facts-gps-jamming

Cisco Router Patch https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190227-rmi-cmd-ex Coldfusion Patch and Exploit https://www.carehart.org/blog/client/index.cfm/2019/3/1/urgent_CF_security_update_Part_1 Ransomware Impersonates Protonmail https://twitter.com/demonslay335/status/1097866931762282498 eBay Site Used for eBay Phish (article in German) https://www.heise.de/security/meldung/eBay-Phishing-auf-eBay-Seite-4324266.html