x

75% of people globally want unbiased news (Pew Research) but are concerned they're not getting that.

Get balanced coverage with Symby. See how stories are covered across diverse outlets and spot when one side covers a story the other skips.

PODCAST

SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Johannes B. Ullrich

A brief daily summary of what is important in information security. The podcast is published every weekday and designed to get you ready for the day with a brief, usually 5 minute long, summary of current network security related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Stormcenter. You may submit questions and comments via our contact form at https://isc.sans.edu/contact.html .

news tech news

All Episodes

4:59

SANS Stormcast Tuesday Mar 11th: Shellcode as UUIDs;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/03/11

Shellcode Encoded in UUIDs Attackers are using UUIDs to encode Shellcode. The 128 Bit (or 16 Bytes) encoded in each UUID are converted to shell code to implement a cobalt strike beacon https://isc.sans.edu/diary/Shellcode%20Encoded%20in%20UUIDs/31752 Moxa CVE-2024-12297 Expanded to PT Switches Moxa in January first releast an update to address a fronted authorizaation logic disclosure vulnerability. It now updated the advisory and included the PT series switches as vulenrable.

en-us

6:45

SANS Stormcast: Webshells; Undocumented ESP32...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/03/10

Commonly Probed Webshell URLs Many attackers deploy web shells to gain a foothold on vulnerable web servers. These webshells can also be taken over by parasitic exploits. https://isc.sans.edu/diary/Commonly%20Probed%20Webshell%20URLs/31748 Undocumented ESP32 Commands A recent conference presentation by Tarlogic revealed several "backdoors" or undocumented features in the commonly used ESP32 Chipsets. Tarlogic also released a toolkit to make it easier to audit chipsets and find these hiddent

en-us

6:45

SANS Stormcast Thursday Mar 6th: DShield ELK...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/03/06

DShield Traffic Analysis using ELKThe "DShield SIEM" includes an ELK dashboard as part of the Honeypot. Learn how to find traffic of interest with this tool. https://isc.sans.edu/diary/DShield%20Traffic%20Analysis%20using%20ELK/31742 Zen and the Art of Microcode Hacking Google released details, including a proof of concept exploit, showing how to take advantage of the recently patched AMD microcode

en-us

6:11

SANS Stormcast Wednesday Mar 5th: SMTP Credential...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/03/05

Romanian Distillery Scanning for SMTP CredentialsA particular attacker expanded the scope of their leaked credential file scans. In addition to the usual ".env" style files, it is not looking for specific SMTP related credential files. https://isc.sans.edu/diary/Romanian%20Distillery%20Scanning%20for%20SMTP%20Credentials/31736 Tool Updates: mac-robber.py This update of mac-robber.py fixes issues with symlinks. https://isc.sans.edu/diary/Tool%20update%3A%20mac-robber.py/31738 CVE-2025-1723

en-us

6:17

SANS Stormcast Tuesday Mar 4th: Mark of the Web...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/03/04

Mark of the Web: Some Technical Details Windows implements the "Mark of the Web" (MotW) as an alternate data stream that contains not just the "zoneid" of where the file came from, but may include other data like the exact URL and referrer. https://isc.sans.edu/diary/Mark%20of%20the%20Web%3A%20Some%20Technical%20Details/31732 Havoc Sharepoint with Microsoft Graph API A recent phishing attack observed by Fortinet uses a simple HTML email to trick a user into copy pasting powershell into their

en-us

14:27

SANS Stormcast Friday Feb 28th: Njrat devtunnels.ms;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/02/28

Njrat Compaign Using Microsoft dev Tunnels:A recent version of the Njrat remote admin tool is taking advantage of Microsoft's developer tunnels (devtunnels.ms) as a command and control channel. https://isc.sans.edu/diary/Njrat%20Campaign%20Using%20Microsoft%20Dev%20Tunnels/31724 NrootTag Apple FindMy Abuse Malware could use a weakness in the keys used for Apple FindMy to abuse it to track victims. Updates were released with iOS 18.2, but to solve the issue the vast majority of Apple users must

en-us

6:10

SANS Stormcast Tuesday Feb 25th: Unfurl Updates;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/02/25

Unfurl Update ReleasedUnfurl released an Update fixing a few bugs and adding support to decode BlueSky URLs. https://isc.sans.edu/diary/Unfurl%20v2025.02%20released/31716 Google Confirms GMail To Ditch SMS Code Authentication Google no longer considers SMS authentication save enough for GMail. Instead, it pushes users to use Passkeys, or QR code based app authentication https://www.forbes.com/sites/daveywinder/2025/02/23/google-confirms-gmail-to-ditch-sms-code-authentication/ Beware of Paypal

en-us

5:20

SANS Stormcast Monday Feb 24th: sigs.py update;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/02/24

Tool Update: Sigs.py Jim updates sigs.py. The tool verifies hashes for files and automatically recognizes what hash is used. https://isc.sans.edu/diary/Tool%20update%3A%20sigs.py%20-%20added%20check%20mode/31706 Google Announcing Quantum Safe Digital Signatures in Cloud KMS Google announced the option to use quantum safe digital signatures for its cloud key management system. https://cloud.google.com/blog/products/identity-security/announcing-quantum-safe-digital-signatures-in-cloud-kms Windows

en-us

12:29

SANS Stormcast Friday Feb 21st: Kibana Queries;...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/02/21

Using ES|QL In Kibana to Query DShield Honeypot Logs Using the "Elastic Search Piped Query Language" to query DShield honeypot logs https://isc.sans.edu/diary/Using%20ES%7CQL%20in%20Kibana%20to%20Queries%20DShield%20Honeypot%20Logs/31704 Mongoose Flaws Put MongoDB at risk The Object Direct Mapping library Mongoose suffers from an injection vulnerability leading to the potenitial of remote code exeuction in MongoDB https://www.theregister.com/2025/02/20/mongoose_flaws_mongodb/ U-Boot

en-us

6:22

SANS Internet Stormcast Feb 7th 2025: Unbreakable...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/02/07

The Unbreakable Multi-Layer Anti-Debugging SystemXavier found a nice Python script that included what it calls the "Unbreakable Multi-Layer Anti-Debugging System". Leave it up to Xavier to tear it appart for you. https://isc.sans.edu/diary/The%20Unbreakable%20Multi-Layer%20Anti-Debugging%20System/31658 Take my money: OCR crypto stealers in Google Play and App Store Malware using OCR on screen shots was available not just via Google Play, but also the Apple App Store.

en-us

5:40

SANS ISC Stormcast Jan 31st 2025: Old Netgear Vuln in...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/01/31

PCAPs or It Didn't Happen: Exposing an Old Netgear Vulnerability Still Active in 2025 [Guest Diary]https://isc.sans.edu/diary/PCAPs%20or%20It%20Didn%27t%20Happen%3A%20Exposing%20an%20Old%20Netgear%20Vulnerability%20Still%20Active%20in%202025%20%5BGuest%20Diary%5D/31638 RCE Vulnerablity in AI Development Platform Lightning AI Noma Security discovered a neat remote code execution vulnerability in Lightning AI. This vulnerability is exploitable by tricking a logged in user into clicking a simple

en-us

9:16

ISC StormCast for Wednesday, January 22nd, 2025

SANS Internet Stormcenter Daily Cyber Security... ·

2025/01/22

This episodes covers how Starlink users can be geolocated and how Cloudflare may help deanonymize users. The increased use of AI helpers leads to leaking data via careless prompts.Geolocation and Starlink https://isc.sans.edu/diary/Geolocation%20and%20Starlink/31612 Discover the potential geolocation risks associated with Starlink and how they might be exploited. This diary entry dives into new concerns for satellite internet users. Deanonymizing Users via Cloudflare

en-us

12:50

ISC StormCast for Friday, January 17th, 2025

SANS Internet Stormcenter Daily Cyber Security... ·

2025/01/17

In this episode, we explore the efficient storage of honeypot logs in databases, issues with Citrix's Session Recording Agent and Windows Update. Ivanti is having another interesting security event and our SANS.edu graduate student Rich Green talks about his research on Passkeys.Extracting Practical Observations from Impractical Datasets: A SANS Internet Storm Center diary entry discusses strategies for analyzing complex datasets to derive actionable

en-us

7:19

SANS ISC Stormcast: Cryptomining Malware, Fake PoC...

SANS Internet Stormcenter Daily Cyber Security... ·

2025/01/10

In this episode, we explore the following stories:"Examining Redtail: Analyzing a Sophisticated Cryptomining Malware and its Advanced Tactics" Overview of Redtail's multi-architecture cryptomining malware exploiting vulnerabilities and deploying persistence techniques. URL: Examining Redtail: Analyzing a Sophisticated Cryptomining Malware and its Advanced Tactics "Information Stealer Masquerades as LDAPNightmare PoC Exploit" A malware disguised as a PoC exploit targets users seeking to test

en-us

6:04

ISC StormCast for Thursday, January 9th, 2025

SANS Internet Stormcenter Daily Cyber Security... ·

2025/01/09

In this episode, we discuss critical vulnerabilities in Ivanti Connect Secure and Policy Secure, command injection risks in Aviatrix Network Controllers, and the risks posed by hijacked abandoned backdoors. Episode Links and Topics: More Governments Backdoors in Your Backdoors https://labs.watchtowr.com/more-governments-backdoors-in-your-backdoors/ Researchers reveal how expired domains linked to abandoned backdoors can be hijacked, exposing systems to further compromise. Security Update: Ivanti

en-us

6:39

ISC StormCast for Wednesday, January 8th, 2025

SANS Internet Stormcenter Daily Cyber Security... ·

2025/01/08

In this episode, we dive into active exploitation of a zero-day in SonicWall SSL-VPN, privilege escalation vulnerabilities in Moxa devices, and a BitLocker bypass in Windows 11. We also cover cryptocurrency mining malware hitting PHP servers and the White House's launch of the U.S. Cyber Trust Mark to secure connected devices. Episode Links and Topics: PacketCrypt Classic Cryptocurrency Miner on PHP

en-us

4:52

ISC StormCast for Tuesday, January 7th, 2025

SANS Internet Stormcenter Daily Cyber Security... ·

2025/01/07

In this episode of the SANS Internet Storm Center's Stormcast, we cover critical vulnerabilities affecting OpenSSH, BeyondTrust, and Nuclei, including the newly discovered "RegreSSHion" flaw and a bypass vulnerability in Nuclei. We also discuss how malware evasion techniques can impact analysis environments and highlight the dangers of fake exploits targeting researchers. Tune in for insights on patching, mitigation strategies, and staying ahead of emerging threats. Topics Covered: Make Malware

en-us

8:17

ISC StormCast for Monday, January 6th, 2025

SANS Internet Stormcenter Daily Cyber Security... ·

2025/01/06

In this episode of the SANS Internet Storm Center's Stormcast, we cover the latest cybersecurity threats and defenses, including Python-delivered malware, goodware hash sets, SSL/TLS protocol updates, and critical vulnerabilities in ASUS routers and Paessler PRTG. Stay informed and secure your systems! Full details and links to all stories: SwaetRAT via Python: https://isc.sans.edu/diary/SwaetRAT%20Delivery%20Through%20Python/31554 Goodware Hash Sets:

en-us

5:59

ISC StormCast for Friday, December 20th, 2024

SANS Internet Stormcenter Daily Cyber Security... ·

2024/12/20

PHPUnit and Androxgh0sthttps://isc.sans.edu/diary/Command%20Injection%20Exploit%20For%20PHPUnit%20before%204.8.28%20and%205.x%20before%205.6.3%20%5BGuest%20Diary%5D/31528 Mirai Attacks Session Smart Routers https://supportportal.juniper.net/s/article/2024-12-Reference-Advisory-Session-Smart-Router-Mirai-malware-found-on-systems-when-the-default-password-remains-unchanged?language=en_US FortiWLM Unauthenticated limited file read vulnerability https://fortiguard.fortinet.com/psirt/FG-IR-23-144

en-us

2,083 results

Similar Podcasts

DW Noticias

DW

JIJI English News-時事通信英語ニュース-

時事通信社

Legal AF by MeidasTouch

MeidasTouch Network

Mark Levin Podcast

Cumulus Podcast Network

朝日新聞AJW 英語ニュース（The Asahi Shimbun Asia & Japan Watch）

朝日新聞ポッドキャスト