SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Proof Of Concept Exploit for Microsoft Edge Vulnerability CVE-2018-8495 https://leucosite.com/Microsoft-Edge-RCE/ Fake Mining Apps https://www.fortinet.com/blog/threat-research/fortinet-discovers-new-android-apps-that-mine-the-unminable.html Fake Google Photo App Turns out to be Ad-Clicker https://www.geeklatest.com/developer-tricks-microsoft-publishes-app-under-google-llc-name-in-windows-store/

Many Large Websites Affected by Branch.io XSS Flaw https://www.vpnmentor.com/blog/dom-xss-bug-affecting-tinder-shopify-yelp/ Medtronics Pacemakers Disable Remote Update https://www.medtronic.com/content/dam/medtronic-com/us-en/corporate/documents/REV-Medtronic-2090-Security-Bulletin_FNL.pdf IBM Updates WebSphere Update https://www-01.ibm.com/support/docview.wss?uid=swg22016254 Incomplete JET Database Patch https://blog.0patch.com/2018/10/patching-re-patching-and-meta-patching.html

New Campaign Using Old Equation Editor Vulnerability https://isc.sans.edu/forums/diary/New+Campaign+Using+Old+Equation+Editor+Vulnerability/24196/ Root Access Vulnerability in SONY Smart TVs https://www.fortinet.com/blog/threat-research/sony-smart-tv-exploit-inside-view-hijacking-your-living-room.html MicroTik RouterOS Vulnerablities https://github.com/tenable/routeros/blob/master/bug_hunting_in_routeros_derbycon_2018.pdf Reverse Analysis of WebAssembly https://www.forcepoint.com/blog/security-labs/manual-reverse-engineering-webassembly-static-code-analysis Firefox Delays Symantec Certificate Distrust https://www.theregister.co.uk/2018/10/11/firefox_symantec_certs_delay/

Remote Code Execution Vulnerability in WhatsApp https://bugs.chromium.org/p/project-zero/issues/detail?id=1654 Salesforce Releases hashh Library https://github.com/salesforce/hassh CVE-2018-8453 Details from Kaspersky https://securelist.com/cve-2018-8453-used-in-targeted-attacks/88151/ Juniper Patches https://kb.juniper.net/InfoCenter/index?page=content&channel=SECURITY_ADVISORIES Experian Vulnerability Could Have Leaked Credit Freeze PINs https://www.nerdwallet.com/blog/finance/security-flaw-at-experian-allows-easy-access-to-pin-to-unlock-credit-freeze/

Microsoft Patch Tuesday https://isc.sans.edu/forums/diary/October+2018+Microsoft+Patch+Tuesday/24186/ Adobe Updates https://helpx.adobe.com/security.html Magecart Infects "Shopper Approved" Plugin https://www.riskiq.com/blog/labs/magecart-shopper-approved/

Apple Updates iOS and iCloud for Windows https://support.apple.com/en-ca/HT209162 https://support.apple.com/en-ca/HT209141 Intel Adds Spectre/Meltdown Mitigation to 9th Generation CPUs https://www.bleepingcomputer.com/news/security/spectre-and-meltdown-hardware-protection-added-to-intels-9th-gen-cpus/ Windows October Update File Deleting Issues https://support.microsoft.com/en-us/help/4464619/windows-10-update-history https://blogs.technet.microsoft.com/filecab/2018/08/30/9205/ macOS Code Signing Vulnerabilities https://www.virusbulletin.com/conference/vb2018/abstracts/code-signing-flaw-macos

WPA2 Karck Attack Update https://www.krackattacks.com/followup.html#overview Cisco Updates https://tools.cisco.com/security/center/publicationListing.x?product=Cisco&sort=-day_sir#~Vulnerabilities Seattle Police Tries to Stop SWATing https://www.seattle.gov/police/need-help/swatting git Vulnerability Fixed https://github.com/timwr/CVE-2017-1000117

Does the Chinese Military Manipulate Supermicro Motherboards? https://www.bloomberg.com/news/articles/2018-10-04/the-big-hack-amazon-apple-supermicro-and-beijing-respond Cloudflare IPFS Gateway Used For Phishing https://www.bleepingcomputer.com/news/security/phishing-attacks-distributed-through-cloudflares-ipfs-gateway/ DNSSEC Root Key Signing Key Rollover https://www.icann.org/resources/pages/ksk-rollover https://www.icann.org/news/blog/2018-ksk-rollover-operator-preparedness-survey

Identifying a Phisher https://isc.sans.edu/forums/diary/Identifying+a+phisher/24164/ Phishing via Azure Blob Storage https://www.netskope.com/blog/phishing-in-the-public-cloud Zoho Domains Used for Phishing and Keyloggers https://cofense.com/staggering-amount-stolen-data-heading-zoho-domains/ Dell iDRAC Exploit https://www.servethehome.com/idracula-vulnerability-impacts-millions-of-legacy-dell-emc-servers/

How to Write Yara Rules https://isc.sans.edu/forums/diary/Developing+YARA+Rules+a+Practical+Example/24158/ GhostDNS DNS Changer Malware https://blog.netlab.360.com/70-different-types-of-home-routers-all-together-100000-are-being-hijacked-by-ghostdns-en/ Foxit PDF Reader Vulnerabilities https://www.foxitsoftware.com/support/security-bulletins.php Apple Laptops Shipped With CPU in Manufacturing Mode http://blog.ptsecurity.com/2018/10/intel-me-manufacturing-mode-macbook.html