SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Spam Delivered Via .ICS Files https://isc.sans.edu/forums/diary/Spam+Delivered+via+ICS+Files/21611/ Comodo OCR Errors Leads to SSL Certificate Verification Issues https://heise.de/-3354229 (german only) Oracle Quarterly Critical Patch Update http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Images Used to Exfiltrate CC Numbers From Web Stores https://blog.sucuri.net/2016/10/magento-credit-card-swiper-exports-image.html

SSL Client Hellos Soliciting SSH Banners from HAProxy https://isc.sans.edu/forums/diary/OpenSSH+Protocol+Mismatch+In+Response+to+SSL+Client+Hello/21609/ Dyre is Back as Trickbot http://www.threatgeek.com/2016/10/trickbot-the-dyre-connection.html How Stolen iPhones Are Unlocked https://www.linkedin.com/pulse/sin-card-how-criminals-unlocked-stolen-iphone-6s-renato-marinho?trk=pulse_spock-articles

Mozilla Users Reach 50% Https https://twitter.com/0xjosh/status/786971412959420424/photo/1 Retrieving LastPass Passwords From Memory https://techanarchy.net/2016/10/extracting-lastpass-site-credentials-from-memory/ Yahoo MITM Due To Weak Crossdomain.xml Configuration https://github.com/JordanMilne/YMail-Pineapple

PseudoDakrleech Uses Rig Exploit Kit to Spread Cerber https://isc.sans.edu/forums/diary/pseudoDarkleech+Rig+EK/21595/ Decoder.xls to Decode Word Malicious Macro https://isc.sans.edu/forums/diary/Analyzing+Office+Maldocs+With+Decoderxls/21601/ Auditing SSH Servers https://github.com/arthepsy/ssh-audit How Not To User HTML Purifier https://devwerks.net/blog/16/how-not-to-use-html-purifier/

Mount Docker Filesystems with docker-mount.py https://isc.sans.edu/forums/diary/New+tool+dockermountpy/21589/ Global Sign OCSP Mess Up Invalidates Countless Certs https://downloads.globalsign.com/acton/fs/blocks/showLandingPage/a/2674/p/p-008f/t/page/fm/0 Cisco Releases LockyDump http://blog.talosintel.com/2016/10/lockydump.html Google Updates Chrome https://googlechromereleases.blogspot.com/2016/10/stable-channel-update-for-desktop.html DXXD Ransomware Infected un-mapped Shares http://www.bleepingcomputer.com/news/security/the-dxxd-ransomware-displays-legal-notice-before-users-login/

WiFi Still Remains a Good Attack Vector https://isc.sans.edu/forums/diary/WiFi+Still+Remains+a+Good+Attack+Vector/21583/ AVTECH IP Camera Vulnerabilities http://seclists.org/bugtraq/2016/Oct/26 SAP Patches 3 Year Old Bug in P4 https://erpscan.com/press-center/blog/sap-cyber-threat-intelligence-report-october-2016/ 1024 bit DSA Keys Factored https://eprint.iacr.org/2016/961.pdf

Microsoft and Adobe Patches https://isc.sans.edu/mspatchdays.html?viewday=2016-10-11 https://helpx.adobe.com/security/products/acrobat/apsb16-33.html http://www.minixforum.com/threads/neo-z64w-doesnt-start-anymore-after-windows-10-update-help.14122/ Review of Browsers SSL Failures https://docs.google.com/document/d/1b7lenmn5XO06QohaJzVffnJxjXjY1rD70wg34gfuxRo/edit#heading=h.w6vk76mv9e6n New Malware Targeting SWIFT Users http://www.symantec.com/connect/blogs/odinaff-new-trojan-used-high-level-financial-attacks

Radare's Rehash Utility CAn calculate File Entropy https://isc.sans.edu/forums/diary/Radare2+rahash2/21577/ Spoofing IPs Still works https://idea.popcount.org/2016-09-20-strange-loop---ip-spoofing/ EU Commission Plants IoT Labeling http://www.euractiv.com/section/innovation-industry/news/commission-plans-cybersecurity-rules-for-internet-connected-machines/

First Hurricane Matthew Phish Impersonating Stripe https://isc.sans.edu/forums/diary/First+Hurricane+Matthew+related+Phish/21571/ Samsung Galaxy S6 "KNOXOut" Vulnerability http://media.wix.com/ugd/4e84e6_668d564cc447434a9a8fda3c13a63f6a.pdf Windows 10 Anniversary Edition Improves IE 10 XSS Protection http://mksben.l0.cm/2016/10/xss-via-referrer.html

More Honeypot Fun https://isc.sans.edu/forums/diary/Checking+my+honeypot+day/21561/ OS X Webcam Exploit https://objective-see.com/products/oversight.html iOS 10 Private Browsing https://www.intaforensics.com/2016/09/30/ios-10-private-browsing-how-private-is-it/ Hacked Steam Accounts Used to Spread Malware http://www.bleepingcomputer.com/news/security/hacked-steam-accounts-spreading-remote-access-trojan/ Please Report Any Hurricane Matthew Related Malware/Scams https://isc.sans.edu/contact.html