x

75% of people globally want unbiased news (Pew Research) but are concerned they're not getting that.

Get balanced coverage with Symby. See how stories are covered across diverse outlets and spot when one side covers a story the other skips.

PODCAST

SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Johannes B. Ullrich

A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter. You may submit questions and comments via our contact form at https://isc.sans.edu/contact.html .

news tech news

All Episodes

7:18

SANS Stormcast Wednesday Mar 19th 2025: Python DLL...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/03/19

Python Bot Delivered Through DLL Side-LoadingA "normal", but vulnerable to DLL side-loading PDF reader may be used to launch additional exploit code https://isc.sans.edu/diary/Python%20Bot%20Delivered%20Through%20DLL%20Side-Loading/31778 Tomcat RCE Correction To exploit the Tomcat RCE I mentioned yesterday, two non-default configuration options must be selected by the victim. https://x.com/dkx02668274/status/1901893656316969308 SAML Roulette: The Hacker Always Wins This Portswigger blog

en-us

7:03

SANS Stormcast Tuesday Mar 18th 2025: Analyzing GUID...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/03/18

Static Analysis of GUID Encoded Shellcode Didier explains how to decode shell code embeded as GUIDs in malware, and how to feed the result to his tool 1768.py which will extract Cobal Strike configuration information from the code. https://isc.sans.edu/diary/Static%20Analysis%20of%20GUID%20Encoded%20Shellcode/31774 SAMLStorm: Critical Authentication Bypass in xml-crypto and Node.js libraries xml-crypto, a library use in Node.js applications to decode XML and support SAML, has found to parse

en-us

6:38

SANS Stormcast Monday March 17th: Mirai Makes...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/03/17

Mirai Bot Now Incorporating Malformed DrayTek Vigor Router Exploits One of the many versions of the Mirai botnet added some new exploit strings attempting to take advantage of an old DrayTek Vigor Router vulnerability, but they got the URL wrong. https://isc.sans.edu/diary/Mirai%20Bot%20now%20incroporating%20%28malformed%3F%29%20DrayTek%20Vigor%20Router%20Exploits/31770 Compromised GitHub Action The popular GitHub action tj-actions/changed-files was compromised and leaks credentials via the

en-us

6:07

SANS Stormcast: File Hashes in MSFT BI; Apache Camel...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/03/14

File Hashes Analysis with Power BI Guy explains in this diary how to analyze Cowrie honeypot file hashes using Microsoft's BI tool and what you may be able to discover using this tool. https://isc.sans.edu/diary/File%20Hashes%20Analysis%20with%20Power%20BI%20from%20Data%20Stored%20in%20DShield%20SIEM/31764 Apache Camel Vulnerability Apache released two patches for Camel in close succession. Initially, the vulnerability was only addressed for headers, but as Akamai discovered, it can also be

en-us

5:56

SANS Stormcast Thursday Mar 13th: Exploiting Login...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/03/13

Log4J Scans for VMWare Hyhbrid Cloud ExtensionsAn attacker is scanning various login pages, including the authentication feature in the VMWare HCX REST API for Log4j vulnerabilities. The attack submits the exploit string as username, hoping to trigger the vulnerability as Log4j logs the username https://isc.sans.edu/diary/Scans%20for%20VMWare%20Hybrid%20Cloud%20Extension%20%28HCX%29%20API%20(Log4j%20-%20not%20brute%20forcing)/31762 Patch Tuesday Fallout Yesterday's Apple patch may re-activate

en-us

7:54

SANS Stormcast Wednesday Mar 12th: Microsoft Patch...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/03/12

Microsoft Patch TuesdayMicrosoft Patched six already exploited vulnerabilities today. In addition, the patches included a critical patch for Microsoft's DNS server and about 50 additional patches. https://isc.sans.edu/diary/Microsoft%20Patch%20Tuesday%3A%20March%202025/31756 Apple Updates iOS/macOS Apple released an update to address a single, already exploited, vulnerability in WebKit. This vulnerability affects iOS, macOS and VisionOS. https://support.apple.com/en-us/100100 Expressif Response

en-us

4:59

SANS Stormcast Tuesday Mar 11th: Shellcode as UUIDs;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/03/11

Shellcode Encoded in UUIDs Attackers are using UUIDs to encode Shellcode. The 128 Bit (or 16 Bytes) encoded in each UUID are converted to shell code to implement a cobalt strike beacon https://isc.sans.edu/diary/Shellcode%20Encoded%20in%20UUIDs/31752 Moxa CVE-2024-12297 Expanded to PT Switches Moxa in January first releast an update to address a fronted authorizaation logic disclosure vulnerability. It now updated the advisory and included the PT series switches as vulenrable.

en-us

6:45

SANS Stormcast: Webshells; Undocumented ESP32...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/03/10

Commonly Probed Webshell URLs Many attackers deploy web shells to gain a foothold on vulnerable web servers. These webshells can also be taken over by parasitic exploits. https://isc.sans.edu/diary/Commonly%20Probed%20Webshell%20URLs/31748 Undocumented ESP32 Commands A recent conference presentation by Tarlogic revealed several "backdoors" or undocumented features in the commonly used ESP32 Chipsets. Tarlogic also released a toolkit to make it easier to audit chipsets and find these hiddent

en-us

6:45

SANS Stormcast Thursday Mar 6th: DShield ELK...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/03/06

DShield Traffic Analysis using ELKThe "DShield SIEM" includes an ELK dashboard as part of the Honeypot. Learn how to find traffic of interest with this tool. https://isc.sans.edu/diary/DShield%20Traffic%20Analysis%20using%20ELK/31742 Zen and the Art of Microcode Hacking Google released details, including a proof of concept exploit, showing how to take advantage of the recently patched AMD microcode

en-us

6:11

SANS Stormcast Wednesday Mar 5th: SMTP Credential...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/03/05

Romanian Distillery Scanning for SMTP CredentialsA particular attacker expanded the scope of their leaked credential file scans. In addition to the usual ".env" style files, it is not looking for specific SMTP related credential files. https://isc.sans.edu/diary/Romanian%20Distillery%20Scanning%20for%20SMTP%20Credentials/31736 Tool Updates: mac-robber.py This update of mac-robber.py fixes issues with symlinks. https://isc.sans.edu/diary/Tool%20update%3A%20mac-robber.py/31738 CVE-2025-1723

en-us

6:17

SANS Stormcast Tuesday Mar 4th: Mark of the Web...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/03/04

Mark of the Web: Some Technical Details Windows implements the "Mark of the Web" (MotW) as an alternate data stream that contains not just the "zoneid" of where the file came from, but may include other data like the exact URL and referrer. https://isc.sans.edu/diary/Mark%20of%20the%20Web%3A%20Some%20Technical%20Details/31732 Havoc Sharepoint with Microsoft Graph API A recent phishing attack observed by Fortinet uses a simple HTML email to trick a user into copy pasting powershell into their

en-us

14:27

SANS Stormcast Friday Feb 28th: Njrat devtunnels.ms;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/02/28

Njrat Compaign Using Microsoft dev Tunnels:A recent version of the Njrat remote admin tool is taking advantage of Microsoft's developer tunnels (devtunnels.ms) as a command and control channel. https://isc.sans.edu/diary/Njrat%20Campaign%20Using%20Microsoft%20Dev%20Tunnels/31724 NrootTag Apple FindMy Abuse Malware could use a weakness in the keys used for Apple FindMy to abuse it to track victims. Updates were released with iOS 18.2, but to solve the issue the vast majority of Apple users must

en-us

6:10

SANS Stormcast Tuesday Feb 25th: Unfurl Updates;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/02/25

Unfurl Update ReleasedUnfurl released an Update fixing a few bugs and adding support to decode BlueSky URLs. https://isc.sans.edu/diary/Unfurl%20v2025.02%20released/31716 Google Confirms GMail To Ditch SMS Code Authentication Google no longer considers SMS authentication save enough for GMail. Instead, it pushes users to use Passkeys, or QR code based app authentication https://www.forbes.com/sites/daveywinder/2025/02/23/google-confirms-gmail-to-ditch-sms-code-authentication/ Beware of Paypal

en-us

5:20

SANS Stormcast Monday Feb 24th: sigs.py update;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/02/24

Tool Update: Sigs.py Jim updates sigs.py. The tool verifies hashes for files and automatically recognizes what hash is used. https://isc.sans.edu/diary/Tool%20update%3A%20sigs.py%20-%20added%20check%20mode/31706 Google Announcing Quantum Safe Digital Signatures in Cloud KMS Google announced the option to use quantum safe digital signatures for its cloud key management system. https://cloud.google.com/blog/products/identity-security/announcing-quantum-safe-digital-signatures-in-cloud-kms Windows

en-us

12:29

SANS Stormcast Friday Feb 21st: Kibana Queries;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/02/21

Using ES|QL In Kibana to Query DShield Honeypot Logs Using the "Elastic Search Piped Query Language" to query DShield honeypot logs https://isc.sans.edu/diary/Using%20ES%7CQL%20in%20Kibana%20to%20Queries%20DShield%20Honeypot%20Logs/31704 Mongoose Flaws Put MongoDB at risk The Object Direct Mapping library Mongoose suffers from an injection vulnerability leading to the potenitial of remote code exeuction in MongoDB https://www.theregister.com/2025/02/20/mongoose_flaws_mongodb/ U-Boot

en-us

6:22

SANS Internet Stormcast Feb 7th 2025: Unbreakable...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/02/07

The Unbreakable Multi-Layer Anti-Debugging SystemXavier found a nice Python script that included what it calls the "Unbreakable Multi-Layer Anti-Debugging System". Leave it up to Xavier to tear it appart for you. https://isc.sans.edu/diary/The%20Unbreakable%20Multi-Layer%20Anti-Debugging%20System/31658 Take my money: OCR crypto stealers in Google Play and App Store Malware using OCR on screen shots was available not just via Google Play, but also the Apple App Store.

en-us

5:40

SANS ISC Stormcast Jan 31st 2025: Old Netgear Vuln in...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/01/31

PCAPs or It Didn't Happen: Exposing an Old Netgear Vulnerability Still Active in 2025 [Guest Diary]https://isc.sans.edu/diary/PCAPs%20or%20It%20Didn%27t%20Happen%3A%20Exposing%20an%20Old%20Netgear%20Vulnerability%20Still%20Active%20in%202025%20%5BGuest%20Diary%5D/31638 RCE Vulnerablity in AI Development Platform Lightning AI Noma Security discovered a neat remote code execution vulnerability in Lightning AI. This vulnerability is exploitable by tricking a logged in user into clicking a simple

en-us

9:16

ISC StormCast for Wednesday, January 22nd, 2025

SANS Internet Stormcenter Daily Cyber Security... ·

2025/01/22

This episodes covers how Starlink users can be geolocated and how Cloudflare may help deanonymize users. The increased use of AI helpers leads to leaking data via careless prompts.Geolocation and Starlink https://isc.sans.edu/diary/Geolocation%20and%20Starlink/31612 Discover the potential geolocation risks associated with Starlink and how they might be exploited. This diary entry dives into new concerns for satellite internet users. Deanonymizing Users via Cloudflare

en-us

12:50

ISC StormCast for Friday, January 17th, 2025

SANS Internet Stormcenter Daily Cyber Security... ·

2025/01/17

In this episode, we explore the efficient storage of honeypot logs in databases, issues with Citrix's Session Recording Agent and Windows Update. Ivanti is having another interesting security event and our SANS.edu graduate student Rich Green talks about his research on Passkeys.Extracting Practical Observations from Impractical Datasets: A SANS Internet Storm Center diary entry discusses strategies for analyzing complex datasets to derive actionable

en-us

2,089 results

Similar Podcasts

DW Noticias

DW

JIJI English News-時事通信英語ニュース-

時事通信社

Legal AF by MeidasTouch

MeidasTouch Network

Mark Levin Podcast

Cumulus Podcast Network

朝日新聞AJW 英語ニュース（The Asahi Shimbun Asia & Japan Watch）

朝日新聞ポッドキャスト