SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Apple Re-Releases Rapid Security Update for iOS/MacOS https://support.apple.com/HT201224 Loader Activity For Formbook "QM18" https://isc.sans.edu/diary/Loader%20activity%20for%20Formbook%20%22QM18%22/30020 Adobe Patches https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html FortiOS/FortiProxy Stack Based Overflow https://www.fortiguard.com/psirt/FG-IR-23-183 Citrix Secure Access Client for Ubuntu https://support.citrix.com/article/CTX564169/citrix-secure-access-client-for-ubuntu-security-bulletin-for-cve202324492 Sonicwall Updates https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010

Microsoft Patch Tuesday https://isc.sans.edu/forums/diary/July%202023%20Microsoft%20Patch%20Update/30018/ https://blog.talosintelligence.com/old-certificate-new-signature/ Apple Withdraws Rapid Security Response Update https://support.apple.com/en-us/HT213827

Apple Rapid Security Update Patches Three Exploited Vulnerabilities https://isc.sans.edu/diary/Apple%20Rapid%20Security%20Update%20Patches%20Three%20Exploited%20Vulnerabilities/30012 Ubiquity Edgerouter and AirCube miniupnpd Heap Overflow https://ssd-disclosure.com/ssd-advisory-edgerouters-and-aircube-miniupnpd-heap-overflow/ Mozilla Restricting Extensions on Quarantined Domains https://support.mozilla.org/en-US/kb/quarantined-domains https://www.mozilla.org/en-US/firefox/115.0/releasenotes/ https://lapcatsoftware.com/articles/2023/7/1.html

DSSuite Didier Toolbox Cokcer Image Update https://isc.sans.edu/diary/DSSuite%20%28Didier%27s%20Toolbox%29%20Docker%20Image%20Update/30008 More MoveIT Flaws and new Service Pack https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023 Cisco Nexus 9000 Flaw https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aci-cloudsec-enc-Vs5Wn2sX

IDS Comparisons with DShield Honeypot Data https://isc.sans.edu/diary/IDS%20Comparisons%20with%20DShield%20Honeypot%20Data/30002 Truebot Exploits Netwrix Auditor https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-187a Stackrot Linux Priviledge Escalation Vulnerability https://www.openwall.com/lists/oss-security/2023/07/05/1 TeamsPhisher Exploit https://github.com/Octoberfest7/TeamsPhisher VMWare Update https://www.vmware.com/security/advisories/VMSA-2023-0015.html

DShield pfSense Client Update https://isc.sans.edu/diary/DShield%20pfSense%20Client%20Update/29994 Exposed Industrial Control Systems https://isc.sans.edu/diary/Controlling%20network%20access%20to%20ICS%20systems/30000 Analysis Method for Custom Encoding https://isc.sans.edu/diary/Analysis%20Method%20for%20Custom%20Encoding/29946 SNAPPY: Detecting Rogue WiFi Access Points https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/snappy-detecting-rogue-and-fake-80211-wireless-access-points-through-fingerprinting-beacon-management-frames/ RUSTBUCKET Mac Malware https://www.elastic.co/security-labs/DPRK-strikes-using-a-new-variant-of-rustbucket

GuLoader or BatLoader/Modiloader infection fro Remcos RAT https://isc.sans.edu/diary/GuLoader-%20or%20DBatLoader%20ModiLoader-style%20infection%20for%20Remcos%20RAT/29990 CVE-2023-26258 Remote Code Execution in Arcserve UDP Backup https://www.mdsec.co.uk/2023/06/cve-2023-26258-remote-code-execution-in-arcserve-udp-backup/ Sysmon Update https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon https://medium.com/@olafhartong/sysmon-15-0-file-executable-detected-40fd64349f36 Drone Security and Fault Injection Attacks https://labs.ioactive.com/2023/06/applying-fault-injection-to-firmware.html

Kazkhastan: The world's last SSLv2 Super Power https://isc.sans.edu/diary/Kazakhstan%20-%20the%20world%27s%20last%20SSLv2%20superpower...%20and%20a%20country%20with%20potentially%20vulnerable%20last-mile%20internet%20infrastructure/29988 npm manifest issues https://blog.vlt.sh/blog/the-massive-hole-in-the-npm-ecosystem Process Mockingjay: Echoing RWX In Userland To Achieve Code Execution https://www.securityjoes.com/post/process-mockingjay-echoing-rwx-in-userland-to-achieve-code-execution

The Importance of Malware Triage https://isc.sans.edu/diary/The+Importance+of+Malware+Triage/29984/ RowPress: Amplifying Read Disturbance in Modern DRAM Chips https://dl.acm.org/doi/abs/10.1145/3579371.3589063 Dell BIOS Updates https://www.dell.com/support/kbdoc/de-de/000214778/dsa-2023-174-dell-client-bios-security-update-for-an-out-of-bounds-write-vulnerability Google Chrome Update https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_26.html

BlackLotus Mitigation Guide https://media.defense.gov/2023/Jun/22/2003245723/-1/-1/0/CSI_BlackLotus_Mitigation_Guide.PDF Camaro Dragon Infects USB Drives as well as Network Drives https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/ Grafana Security Release https://grafana.com/blog/2023/06/22/grafana-security-release-for-cve-2023-3128/