x

75% of people globally want unbiased news (Pew Research) but are concerned they're not getting that.

Get balanced coverage with Symby. See how stories are covered across diverse outlets and spot when one side covers a story the other skips.

PODCAST

SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Johannes B. Ullrich

A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter. You may submit questions and comments via our contact form at https://isc.sans.edu/contact.html .

news tech news

All Episodes

7:51

SANS Stormcast Wednesday, May 21st 2025: Researchers...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/21

Researchers Scanning the InternetA newish RFC, RFC 9511, suggests researchers identify themselves by adding strings to the traffic they send, or by operating web servers on machines from which the scan originates. We do offer lists of researchers and just added three new groups today https://isc.sans.edu/diary/Researchers%20Scanning%20the%20Internet/31964 Cloudy with a change of Hijacking: Forgotten DNS Records Organizations do not always remove unused CNAME records. An attacker may take

en-us

6:41

SANS Stormcast Tuesday, May 20th 2025: AutoIT Code...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/20

RAT Dropped By Two Layers of AutoIT Code Xavier explains how AutoIT was used to install a remote admin tool (RAT) and how to analyse such a tool https://isc.sans.edu/diary/RAT%20Dropped%20By%20Two%20Layers%20of%20AutoIT%20Code/31960 RVTools compromise confirmed Robware.net, the site behind the popular tool RVTools now confirmed that it was compromised. The site is currently offline. https://www.robware.net/readMore Trojaned Version of Keepass used to install info stealer and Cobalt Strike beacon

en-us

6:30

SANS Stormcast Monday, May 18th 2025: xorsearch...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/19

xorsearch.py: Python FunctionsDidier s xorsearch tool now supports python functions to filter output https://isc.sans.edu/diary/xorsearch.py%3A%20Python%20Functions/31858 Pwn2Own Berlin 2025 Last weeks Pwn2Own contest in Berlin allowed researchers to demonstrate a number of new exploits with a large focus on privilege escalation and virtual machine escape. https://www.zerodayinitiative.com/blog/2025/5/17/pwn2own-berlin-2025-day-three-results Senior US Officials Impersonated in Malicious Messaging

en-us

4:57

SANS Stormcast Friday, May 9th: SSH Exfil Tricks;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/09

No Internet Access: SSH to the RescueIf faced with restrictive outbound network access policies, a single inbound SSH connection can quickly be turned into a tunnel or a full-blown VPN https://isc.sans.edu/diary/No%20Internet%20Access%3F%20SSH%20to%20the%20Rescue!/31932 SAMSUNG magicINFO 9 Server Flaw Still exploitable The SAMSUNG magicINFO 9 Server Vulnerability we found being exploited last week is apparently still not completely patched, and current versions are vulnerable to the exploit

en-us

5:41

SANS Stormcast Thursday, May 8th: Modular Malware;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/05/08

Example of Modular MalwareXavier analyzes modular malware that downloads DLLs from GitHub if specific features are required. In particular, the webcam module is inspected in detail. https://isc.sans.edu/diary/Example%20of%20%22Modular%22%20Malware/31928 Sysaid XXE Vulnerabilities IT Service Management Software Sysaid patched a number of XXE vulnerabilities. Without authentication, an attacker is able to obtain confidential data and completely compromise the system. watchTowr published a

en-us

8:51

SANS Stormcast Wednesday, April 30th: SMS Attacks;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/04/30

More Scans for SMS Gateways and APIsAttackers are not just looking for SMS Gateways like the scans we reported on last week, but they are also actively scanning for other ways to use APIs and add on tools to send messages using other people s credentials. https://isc.sans.edu/diary/More%20Scans%20for%20SMS%20Gateways%20and%20APIs/31902 AirBorne: AirPlay Vulnerabilities Researchers at Oligo revealed over 20 weaknesses they found in Apple s implementation of the AirPlay protocol. These

en-us

7:37

SANS Stormcast Tuesday, April 29th: SRUM-DUMP 3;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/04/29

SRUM-DUMP Version 3: Uncovering Malware Activity in Forensics Mark Baggett released SRUM-DUMP Version 3. The tool simplifies data extraction from Widnows System Resource Usage Monitor (SRUM). This database logs how much resources software used for 30 days, and is invaluable to find out what software was executed when and if it sent or received network data. https://isc.sans.edu/diary/SRUM-DUMP%20Version%203%3A%20Uncovering%20Malware%20Activity%20in%20Forensics/31896 Novel Universal Bypass For

en-us

7:55

SANS Stormcast Monday, April 28th: Image...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/04/28

Example of a Payload Delivered Through SteganographyXavier and Didier published two diaries this weekend, building on each other. First, Xavier showed an example of an image being used to smuggle an executable past network defenses, and second, Didier showed how to use his tools to extract the binary. https://isc.sans.edu/diary/Example%20of%20a%20Payload%20Delivered%20Through%20Steganography/31892 SAP Netweaver Exploited CVE-2025-31324 An arbitrary file upload vulnerability in SAP s Netweaver

en-us

5:54

SANS Stormcast Wednesday Apr 16th: File Upload...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/04/16

Online Services Again Abused to Exfiltrate DataAttackers like to abuse free online services that can be used to exfiltrate data. From the originals , like pastebin, to past favorites like anonfiles.com. The latest example is gofile.io. As a defender, it is important to track these services to detect exfiltration early https://isc.sans.edu/diary/Online%20Services%20Again%20Abused%20to%20Exfiltrate%20Data/31862 OpenSSH 10.0 Released OpenSSH 10.0 was released. This release adds quantum-safe

en-us

5:35

SANS Stormcast Tuesday April 15th: xorsearch Update;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/04/15

xorsearch Update Diedier updated his "xorsearch" tool. It is now a python script, not a compiled binary, and supports Yara signatures. With Yara support also comes support for regular expressions. https://isc.sans.edu/diary/xorsearch.py%3A%20Searching%20With%20Regexes/31854 Shorter Lived Certificates The CA/Brower Forum passed an update to reduce the maximum livetime of certificates. The reduction will be implemented over the next four years. EFF also released an update to certbot introducing

en-us

7:07

SANS Stormcast Monday April 14th: Langlow AI Attacks;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/04/14

Exploit Attempts for Recent Langflow AI Vulnerability (CVE-2025-3248) After spotting individaul attempts to exploit the recent Langflow vulnerability late last weeks, we now see more systematic internet wide scans attempting to verify the vulnerability. https://isc.sans.edu/forums/diary/Exploit+Attempts+for+Recent+Langflow+AI+Vulnerability+CVE20253248/31850/ Fortinet Analysis of Threat Actor Activity Fortinet oberved recent vulnerablities in its devices being used to add a symlink to ease future

en-us

5:34

SANS Stormcast Friday April 11th: Network...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/04/11

Network InfraxploitOur undergraduate intern, Matthew Gorman, wrote up a walk through of CVE-2018-0171, an older Cisco vulnerability, that is still actively being exploited. For example, VOLT TYPHOON recently exploited this problem. https://isc.sans.edu/diary/Network+Infraxploit+Guest+Diary/31844 Windows Update Issues / Windows 10 Update Microsoft updated its "Release Health" notes with details regarding issues users experiences with Windows Hello, Citrix, and Roblox. Microsoft also released

en-us

6:18

SANS Stormcast Tuesday, April 8th:

SANS Internet Stormcenter Daily Cyber Security... ·

2025/04/08

XORsearch: Searching With RegexesDidier explains a workaround to use his tool XORsearch to search for regular expressions instead of simple strings. https://isc.sans.edu/diary/XORsearch%3A%20Searching%20With%20Regexes/31834 MCP Security Notification: Tool Poisoning Attacks Invariant labs summarized a critical weakness in the Model Context Protocol (MCP) that allows for "Tool Poisoning Attacks." Many major providers such as Anthropic and OpenAI, workflow automation systems like Zapier, and MCP

en-us

9:23

SANS Stormcast Thursday Apr 3rd: Juniper Password...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/04/03

Surge in Scans for Juniper t128 Default UserLasst week, we dedtect a significant surge in ssh scans for the username t128 . This user is used by Juniper s Session Smart Routing, a product they acquired from 128 Technologies which is the reason for the somewhat unusual username. https://isc.sans.edu/diary/Surge%20in%20Scans%20for%20Juniper%20%22t128%22%20Default%20User/31824 Vulnerable Verizon API Allowed for Access to Call Logs An API Verizon offered to users of its call filtering

en-us

7:18

SANS Stormcast Wednesday Mar 19th 2025: Python DLL...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/03/19

Python Bot Delivered Through DLL Side-LoadingA "normal", but vulnerable to DLL side-loading PDF reader may be used to launch additional exploit code https://isc.sans.edu/diary/Python%20Bot%20Delivered%20Through%20DLL%20Side-Loading/31778 Tomcat RCE Correction To exploit the Tomcat RCE I mentioned yesterday, two non-default configuration options must be selected by the victim. https://x.com/dkx02668274/status/1901893656316969308 SAML Roulette: The Hacker Always Wins This Portswigger blog

en-us

7:03

SANS Stormcast Tuesday Mar 18th 2025: Analyzing GUID...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/03/18

Static Analysis of GUID Encoded Shellcode Didier explains how to decode shell code embeded as GUIDs in malware, and how to feed the result to his tool 1768.py which will extract Cobal Strike configuration information from the code. https://isc.sans.edu/diary/Static%20Analysis%20of%20GUID%20Encoded%20Shellcode/31774 SAMLStorm: Critical Authentication Bypass in xml-crypto and Node.js libraries xml-crypto, a library use in Node.js applications to decode XML and support SAML, has found to parse

en-us

6:38

SANS Stormcast Monday March 17th: Mirai Makes...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/03/17

Mirai Bot Now Incorporating Malformed DrayTek Vigor Router Exploits One of the many versions of the Mirai botnet added some new exploit strings attempting to take advantage of an old DrayTek Vigor Router vulnerability, but they got the URL wrong. https://isc.sans.edu/diary/Mirai%20Bot%20now%20incroporating%20%28malformed%3F%29%20DrayTek%20Vigor%20Router%20Exploits/31770 Compromised GitHub Action The popular GitHub action tj-actions/changed-files was compromised and leaks credentials via the

en-us

6:07

SANS Stormcast: File Hashes in MSFT BI; Apache Camel...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/03/14

File Hashes Analysis with Power BI Guy explains in this diary how to analyze Cowrie honeypot file hashes using Microsoft's BI tool and what you may be able to discover using this tool. https://isc.sans.edu/diary/File%20Hashes%20Analysis%20with%20Power%20BI%20from%20Data%20Stored%20in%20DShield%20SIEM/31764 Apache Camel Vulnerability Apache released two patches for Camel in close succession. Initially, the vulnerability was only addressed for headers, but as Akamai discovered, it can also be

en-us

5:56

SANS Stormcast Thursday Mar 13th: Exploiting Login...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/03/13

Log4J Scans for VMWare Hyhbrid Cloud ExtensionsAn attacker is scanning various login pages, including the authentication feature in the VMWare HCX REST API for Log4j vulnerabilities. The attack submits the exploit string as username, hoping to trigger the vulnerability as Log4j logs the username https://isc.sans.edu/diary/Scans%20for%20VMWare%20Hybrid%20Cloud%20Extension%20%28HCX%29%20API%20(Log4j%20-%20not%20brute%20forcing)/31762 Patch Tuesday Fallout Yesterday's Apple patch may re-activate

en-us

7:54

SANS Stormcast Wednesday Mar 12th: Microsoft Patch...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/03/12

Microsoft Patch TuesdayMicrosoft Patched six already exploited vulnerabilities today. In addition, the patches included a critical patch for Microsoft's DNS server and about 50 additional patches. https://isc.sans.edu/diary/Microsoft%20Patch%20Tuesday%3A%20March%202025/31756 Apple Updates iOS/macOS Apple released an update to address a single, already exploited, vulnerability in WebKit. This vulnerability affects iOS, macOS and VisionOS. https://support.apple.com/en-us/100100 Expressif Response

en-us

2,083 results

Similar Podcasts

DW Noticias

DW

JIJI English News-時事通信英語ニュース-

時事通信社

Legal AF by MeidasTouch

MeidasTouch Network

Mark Levin Podcast

Cumulus Podcast Network

朝日新聞AJW 英語ニュース（The Asahi Shimbun Asia & Japan Watch）

朝日新聞ポッドキャスト