SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

LDAP and STARTTLS https://isc.sans.edu/forums/diary/SSLTLS+on+port+389+Say+what/22135/ Wordpress NextGen Gallery Plugin SQL Injection Vulnerability https://blog.sucuri.net/2017/02/sql-injection-vulnerability-nextgen-gallery-wordpress.html Password Manager Insecurities https://team-sik.org/trent_portfolio/password-manager-apps/ Slack Insecure Cross Window Messaging https://labs.detectify.com/2017/02/28/hacking-slack-using-postmessage-and-websocket-reconnect-to-steal-your-precious-token/ Google Voice Recognition Used to Break Google ReCaptcha Audio Challenge https://east-ee.com/2017/02/28/rebreakcaptcha-breaking-googles-recaptcha-v2-using-google/

Amazon Cloud IPv4 Reuse Leads to Stray Requests https://isc.sans.edu/forums/diary/My+Catch+Of+4+Months+In+The+Amazon+IP+Address+Space/22129 Amazon S3 Outage https://isc.sans.edu/forums/diary/Amazon+S3+Outage/22131/ CloudPets Leaks Recordings https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/ ESET Antivirus Vulnerability Puts Macs at Risk http://seclists.org/fulldisclosure/2017/Feb/68 Analysis of a Simple PHP Backdoor https://isc.sans.edu/forums/diary/Analysis+of+a+Simple+PHP+Backdoor/22127/

Google Chrome TLS 1.3 Update Causes Issues With Bluecoat https://bugs.chromium.org/p/chromium/issues/detail?id=694593 Windows 10 Will Implmenet "Gatekeeper" Like Technology https://twitter.com/vitorgrs/status/835674417602637824 Google Releases E2EMail Chrome Plugin https://security.googleblog.com/2017/02/e2email-research-project-has-left-nest_24.html Decrypting SCOM "RunAs" Credentials https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2017/february/scomplicated-decrypting-scom-runas-credentials/

Cloudflare Leaks Data https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/ IE/Edge Denial of Service https://bugs.chromium.org/p/project-zero/issues/detail?id=1011#c2 "Dynamite Phishing" https://isc.sans.edu/forums/diary/Dynamite+Phishing/22121/ Google Credentials Problems https://productforums.google.com/forum/#!category-topic/gmail/LOt2x1_c3KM

Researchers Find SHA1 Collision https://shattered.io/static/shattered.pdf Arrest Made in Deutsche Telekom DSL Modem Attack https://www.bleepingcomputer.com/news/security/uk-police-arrest-suspect-behind-mirai-malware-attacks-on-deutsche-telekom/

User Centric Mobile Device Security With Stethoscope http://techblog.netflix.com/2017/02/introducing-netflix-stethoscope.html Fingerprinting Firefox With Intermediate Certificates https://shiftordie.de/blog/2017/02/21/fingerprinting-firefox-users-with-cached-intermediate-ca-certificates-fiprinca/ JudasDNS Attack DNS Proxy https://github.com/mandatoryprogrammer/JudasDNS

Microsoft Releases Flash Patch From Skipped February Update https://technet.microsoft.com/en-us/library/security/MS17-005 Investigating Off-Premise Wireless Behaviour https://isc.sans.edu/forums/diary/Investigating+OffPremise+Wireless+Behaviour+or+I+Know+What+You+Connected+To/22089/ "Bugdrop" Steals Large Amount of Audio https://cyberx-labs.com/en/blog/operation-bugdrop-cyberx-discovers-large-scale-cyber-reconnaissance-operation/

Hardening Postfix Against FTP Relay Attacks https://isc.sans.edu/forums/diary/Hardening+Postfix+Against+FTP+Relay+Attacks/22086/ Kaspersky Examins Mobile Car Apps https://securelist.com/analysis/publications/77576/mobile-apps-and-stealing-a-connected-car/ Cars "Remember" Prior Owners http://money.cnn.com/2017/02/17/technology/used-car-hack-safety-location/ Xen Project Reconsidering Vulnerability Disclosure Policy https://blog.xenproject.org/2017/02/14/request-for-comment-scope-of-vulnerabilities-for-which-xsas-are-issued/ Stagefright Vulnerability had minimal affect on Android Security https://www.rsaconference.com/speakers/adrian_ludwig

RTRBK: Router, Switch, Firewall Backups in Powershell https://isc.sans.edu/forums/diary/RTRBK+Router+Switch+Firewall+Backups+in+PowerShell+tool+drop/22079/ Windows EMF Imge 0-Day Memory Leak https://bugs.chromium.org/p/project-zero/issues/detail?id=992 Brazillian Traffic Ticket Malspam https://isc.sans.edu/forums/diary/Brazilian+malspam+sends+Autoitbased+malware/22081/ Using XXE To Send E-Mail https://shiftordie.de/blog/2017/02/18/smtp-over-xxe/

AVM Private Key Leak Puts Cable Modems At Risk https://isc.sans.edu/forums/diary/AVM+Private+Key+Leak+Puts+Cable+Modems+Worldwide+At+Risk/22076/ OpenSSL Update https://isc.sans.edu/forums/diary/OpenSSL+110e+Update+No+need+to+panic+openssl/22074/ Microsoft Update Delayed https://blogs.technet.microsoft.com/msrc/2017/02/14/february-2017-security-update-release/ ANC Attack ASLR Bypass https://www.vusec.net/projects/anc/