All images scavenged without permission

PREVIOUS GNEWS All images scavenged without permission

Patch Tuesday Jun – 17 Patches – 6 Critical – 36 CVEs MS16-063 - Cumulative Security Update for Internet Explorer MS16-068 - Cumulative Security Update for Microsoft Edge MS16-069 - Cumulative Security Update for JScript and VBScript MS16-070 - Microsoft Office MS16-071 - Microsoft Windows DNS Server MS16-072 - Group Policy MS16-073 - Windows Kernel-Mode Drivers MS16-074 - Microsoft Graphics Component MS16-075 - Windows SMB Server MS16-076 - Netlogon MS16-077 - WPAD MS16-078 - Windows Diagnostic Hub MS16-079 - Microsoft Exchange Server MS16-080 - Microsoft Windows PDF MS16-081 - Active Directory MS16-082 - Microsoft Windows Search Component MS16-083 - Adobe Flash Player Sources: http://technet.microsoft.com/en-us/security/bulletin/ms16-jun

Patch Tuesday Jul – 11 Patches – 6 Critical – 40 CVEs MS16-084 - Cumulative Security Update for Internet Explorer MS16-085 - Cumulative Security Update for Microsoft Edge MS16-086 - Cumulative Security Update for JScript and VBScript MS16-087 - Security Update for Windows Print Spooler Components MS16-088 - Security Update for Microsoft Office MS16-089 - Security Update for Windows Secure Kernel Mode MS16-090 - Security Update for Windows Kernel-Mode Drivers MS16-091 - Security Update for .NET Framework MS16-092 - Security Update for Windows Kernel MS16-093 - Security Update for Adobe Flash Player MS16-094 - Security Update for Secure Boot MS16-072 breaks AD GPO Sources: http://technet.microsoft.com/en-us/security/bulletin/ms16-jul MS16-072 breaks AD GPO http://www.theregister.co.uk/2016/06/15/microsoft_fix_borks_group_policy/

Holes / Patches Oracle Adobe Apple VMWare Symantec Due 19 Jul Adobe APSB16-18 Flash ( 36 CVE) APSB16-19 DNG SDK ( 1 CVE) APSB16-20 Brackets ( 2 CVE) APSB16-21 Creative Cloud Desktop Application ( 2 CVE) APSB16-22 CloudFusion ( 1 CVE) APSB16-23 Air( 1 CVE) APSB16-24 XMP Toolkit for Java ( 1 CVE) APSB16-25 Flash ( 52 CVE) APSB16-26 Acrobat and Reader( 30 CVE) Apple AirPort Base Station Firmware 7.7.6 / 7.7.7 ( 1 CVE) IOS 10 App removal VMWare VMSA-2016-0007 ( 1 CVE) VMware NSX and vCNS info disclosure VMSA-2016-0008 ( 2 CVE) vRealize Log Insight, XSS VMSA-2016-0009 ( 1 CVE) vCenter Server, reflected XSS Symantec Packers and more Lenovo ThinkPwn (+ gigabyte) EUFI firmware vuln PDF vulns Chrome and Foxit Putty DLL hi-jacking Sources: ## Oracle Patches http://www.oracle.com/technetwork/topics/security/alerts-086861.html ##Adobe Patches https://helpx.adobe.com/security.html https://helpx.adobe.com/security/products/flash-player/apsb16-18.html https://helpx.adobe.com/security/products/dng-sdk/apsb16-19.html https://helpx.adobe.com/security/products/brackets/apsb16-20.html https://helpx.adobe.com/security/products/creative-cloud/apsb16-21.html https://helpx.adobe.com/security/products/coldfusion/apsb16-22.html https://helpx.adobe.com/security/products/air/apsb16-23.html https://helpx.adobe.com/security/products/xmpcore/apsb16-24.html https://helpx.adobe.com/security/products/flash-player/apsb16-25.html https://helpx.adobe.com/security/products/acrobat/apsb16-26.html ##Apple patches http://support.apple.com/kb/HT1222 ios10 app removal http://betanews.com/2016/06/13/remove-built-in-apps-ios-10/ ##Cisco patches http://tools.cisco.com/security/center/home.x http://tools.cisco.com/security/center/viewAllSearch.x?currentPage=&sortType=d&recordsPerPage=100&searchkey=&filter=43&pageSize=100&pageNo=1 ## VMWare http://www.vmware.com/security/advisories/ https://www.vmware.com/security/advisories/VMSA-2016-0007.html https://www.vmware.com/security/advisories/VMSA-2016-0008.html https://www.vmware.com/security/advisories/VMSA-2016-0009.html Symantec again Symantec vulnerable Again http://www.healthcareinfosecurity.com/second-symantec-anti-virus-bugfest-found-by-researcher-a-9232 patches https://www.us-cert.gov/ncas/current-activity/2016/06/29/Symantec-Releases-Security-Updates Lenovo ThinkPwn thinkpwn https://support.lenovo.com/us/en/solutions/LEN-8324 http://www.networkworld.com/article/3090999/firmware-exploit-can-defeat-new-windows-security-features-on-lenovo-thinkpads.html https://github.com/Cr4sh/ThinkPwn and now on MoBo https://threatpost.com/scope-of-thinkpwn-uefi-zero-day-expands/119027/ chrome pdf reader https://www.helpnetsecurity.com/2016/06/09/bug-chromes-pdf-reader/ foxit patches https://threatpost.com/foxit-patches-12-vulnerabilities-in-pdf-reader/118993/ putty ddl hijacking http://seclists.org/fulldisclosure/2016/Jul/9

Hacking powershell Malware... it is not just theoretical Godless android malware Malware via BITS googleplay auto-rooting malware IOT Camera botnet Ransomware on o365 conficker is dead, long live conficker Opensource 21 Bitcoin for machine payable web services MS FreeBSD Silent use by apps Hacking Sources: powershell Malware... it is not just theoretical http://www.pcmag.com/news/345266/russian-hackers-infiltrate-democratic-national-committee Godless android malware http://www.computerworld.com/article/3087003/security/new-android-malware-can-secretly-root-your-phone-and-install-programs.html#tk.rss_security Malware via BITS https://threatpost.com/windows-bits-notification-feature-used-to-deliver-malware/118555/ googleplay auto rooting malware https://threatpost.com/google-play-hit-with-rash-of-auto-rooting-malware/118938/ IOT Camera botnet https://threatpost.com/botnet-powered-by-25000-cctv-devices-uncovered/118948/ http://www.esecurityplanet.com/network-security/massive-iot-ddos-attack-leverages-25513-cctv-cameras.html Ransomware on o365 http://www.esecurityplanet.com/malware/massive-ransomware-attack-hits-microsoft-office-365-users.html conficker is dead, long live conficker https://threatpost.com/conficker-used-in-new-wave-of-hospital-iot-device-attacks/118985/ Opensource 21 Bitcoin for machine payable web services https://medium.com/@21/21-is-an-open-source-library-for-the-machine-payable-web-4f30d1437fde#.ybhp3u8sh MS FreeBSD https://news.hitb.org/content/microsoft-has-created-its-own-freebsd microphones http://www.makeuseof.com/tag/9-examples-smartphones-eavesdropping/

Corp MS to buy Linkedin MS to launch block chain as a service Symantec to buy BlueCoat Symantec expands car system protection offerings Ron Gula steps down (tenable CEO) CASB - Cisco to buy CloudLock avast buys avg (now with twice the nag windows) Fiat/Chrysler bug bounty program Siemens says don't use their stuff.... (on soft networks) Sources: MS to buy Linkedin http://appleinsider.com/articles/16/06/13/microsoft-buys-professional-social-networking-service-linkedin-for-262b MS to launch block chain as a service http://www.theregister.co.uk/2016/06/16/microsoft_blockchainasaservice_for_azure/ Symantec to buy BlueCoat http://www.healthcareinfosecurity.com/symantec-to-buy-blue-coat-for-465-billion-a-9192 Symantec expands car system protection offerings http://www.darkreading.com/iot/symantec-drives-into-automobile-security-/d/d-id/1325834 Ron Gula steps down (tenable CEO) http://www.darkreading.com/careers-and-people/tenable-network-security-ceo-steps-down/d/d-id/1325867?_mc=RSS_DR_EDT CASB - Cisco to buy CloudLock http://www.esecurityplanet.com/network-security/cisco-casb-tech-293m-purchase-cloudlock.html avast buys avg (now with twice the nag windows) http://www.darkreading.com/endpoint/avast-acquires-anti-virus-rival-avg-in-$13-billion-deal/d/d-id/1326199 Fiat/Chrysler bug bounty program https://bugcrowd.com/fca Siemens says don't use their stuff.... (on soft networks) http://www.theregister.co.uk/2016/06/16/dodgy_creds_found_in_siemens_ics_gear/ Corp

Corp Wendys breach bigger than thought (shocker) Acer customer CC# breach undisclosed hospital DB breached Omni hotels breached BMW vulnerable Hard Rock Vegas breached registrars are hard... tp-link losses update domain Sources: Wendys breach bigger than thought (shocker) https://finance.yahoo.com/news/wendys-unusual-credit-card-activity-211500646.html Acer customer CC# breach http://www.zdnet.com/article/acer-online-store-flaw-let-hackers-steal-a-years-worth-of-credit-cards/ undisclosed hospital DB breached http://www.tripwire.com/state-of-security/latest-security-news/hacker-selling-650k-healthcare-records-on-the-dark-web/ Omni hotels breached http://www.healthcareinfosecurity.com/omni-hotels-resorts-hit-by-hacker-a-9254 BMW vulnerable http://magazine.vulnerability-db.com/?q=articles/2016/07/07/bmw-core-web-portal-connecteddrive-exploitation-car-configurations Hard Rock Vegas breached http://www.wsj.com/article_email/hard-rock-las-vegas-reports-card-data-breach-1467052559-lMyQjAxMTA2MjM3MDMzNjA1Wj registrars are hard... tp-link losses update domain http://threatpost.com/top-router-maker--loses-control-over-configuration-domain/119072/ Corp

Govt Air force investigations deleted (crashed) IRS hacked again 154 mil voter data on unsecured couchdb ERAD money seizures Europe wants to pay per link One step closer to FOIA reform VA says computers don’t get the 4th NSA hacker talks everyone uses 3rd party email, Nato Gen. gmail hacked silk road agent under glass for more theft HIPAA bares its teeth we're all going to jail… password sharing falls under CFAA WEllness badness NC bill for blockchain currencies Fed Judge throws out Stingray evidence Sources: Air force investigations deleted (crashed) http://arstechnica.com/information-technology/2016/06/database-corruption-erases-100000-air-force-investigation-records/ irs hacked again https://nakedsecurity.sophos.com/2016/06/27/irs-hacked-again-say-goodbye-to-that-pin-system/?utm_source=dlvr.it&utm_medium=twitter 154 mil voter data on unsecured couchdb https://www.helpnetsecurity.com/2016/06/23/154-million-us-voter-records-exposed/ erad money seizures http://fusion.net/story/311781/cops-can-seize-money-from-prepaid-cards/ Europe wants to pay per link https://www.eff.org/deeplinks/2016/06/reject-europes-plans-tax-links-and-platforms One step closer to FOIA reform https://www.eff.org/deeplinks/2016/06/congress-passes-foia-reform-lawmakers VA says computers dont get the 4th https://www.eff.org/deeplinks/2016/06/federal-court-fourth-amendment-does-not-protect-your-home-computer NSA hacker talks https://theintercept.com/2016/06/28/he-was-a-hacker-for-the-nsa-and-he-was-willing-to-talk-i-was-willing-to-listen/ everyone uses 3rd party email https://theintercept.com/2016/07/01/nato-general-emails/ silk road agent under glass for more theft https://news.hitb.org/content/corrupt-agent-who-investigated-silk-road-suspected-another-700k-heist hipaa bares its teeth http://www.healthcareinfosecurity.com/first-business-associate-hipaa-penalty-announced-a-9238 we're all going to jail https://motherboard.vice.com/read/password-sharing-is-a-federal-crime Wellness badness https://www.eff.org/deeplinks/2016/07/new-eeoc-rules-allow-employers-pay-employees-health-information NC bill for blockchain currencies http://www.coindesk.com/north-carolina-governor-signs-bitcoin-bill-law/ No stingrays here http://www.rawstory.com/2016/07/federal-judge-throws-out-evidence-gathered-with-stingray-cell-phone-tracker/ Govt

Sin Report – Legitimate Bitcoin gaining ground Simplifying IoT: Connecting, Commissioning, and Controlling with Near Field Communication (NFC) http://nfc-forum.org/wp-content/uploads/2016/06/NFC_Forum_IoT_White_Paper_-v05.pdf Sin Report – Legitimate Bitcoin gaining ground http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2808762 Papers Sources: iot http://www.businesswire.com/news/home/20160629005267/en/Definitive-Internet-NFC-White-Paper-Published-NFC Simplifying IoT: Connecting, Commissioning, and Controlling with Near Field Communication (NFC) http://nfc-forum.org/wp-content/uploads/2016/06/NFC_Forum_IoT_White_Paper_-v05.pdf bitcoin for illegal trade is dropping to legitimate http://www.coindesk.com/bitcoin-economy-black-market-sin-report/ http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2808762

LightCyber report finds attackers use legitimate tools. 2nd BitCoin Halving WTF Sources: welcome to 1995 cpt obvious http://www.darkreading.com/attacks-breaches/legit-tools-helping-attackers-hide-malicious-activity-study-finds/d/d-id/1326105 http://lightcyber.com/cyber-weapons-report-network-traffic-analytics-reveals-attacker-tools/ bitcoin halflife http://news.hitb.org/content/halvening-means-bitcoin-mining-rewards-just-dropped-50-percent

Tools CANSPY (at BlackHat) Automotive Vuln Scanner TLS fingerprinting v1.0 SecuityTips for Signal VeraCrypt Trucrypt fork New anonymity scheme MIT onion network better than Tor Shard Leaked password checker Mr-Robot Mr. Robot themed "CTF" Tools Sources: Car scanner? http://www.darkreading.com/analytics/free-canspy-car-hacking-tool-on-tap/d/d-id/1326071?_mc=RSS_DR_EDT TLS fingerprinting v1.0 http://www.toolswatch.org/2016/06/tls-fingerprinting-v1-0-tls-tools/ SecTips for Signal https://theintercept.com/2016/07/02/security-tips-every-signal-user-should-know/ vera crypt http://www.esecurityplanet.com/open-source-security/how-to-encrypt-flash-drive-using-veracrypt.html MIT better than tor https://news.mit.edu/2016/stay-anonymous-online-0711 ?? leaked passwords ?? http://arstechnica.com/security/2016/07/password-reuse-tool-makes-it-easy-to-id-vulnerable-accounts-on-other-sites/ MR Robot themed "CTF" https://www.vulnhub.com/entry/mr-robot-1,151/

BlackHat – Vegas 30 Jul – 4 Aug SANS San Antonio – 18-23 Jul Hope 11 – NYC 22-24 Jul BlackHat – Vegas 30 Jul – 4 Aug BSidesLV – Vegas 2-3 Aug DefCon 24 – Vegas 4 – 7 Aug SANS Dallas – 8 – 13 Aug OWASP CFP Open – DC 11-14 Oct Future Cons Sources: https://www.concise-courses.com/security/conferences-of-2016/ http://www.securitybsides.com/w/page/12194156/FrontPage

National Information Security and Assurance Group DHA ( 1st Wednesday / Family Karaoke, dallas ) TX2600 ( 1st Fri / Wild Turkey 35&WalnutHill, dallas ) The Lab.MS ( 2nd Monday + random events / TheLab.ms, plano ) OWASP Dallas ( 3rd Tuesday / location varies ) Crypto Party ( 3rd Thursday / Improving Enterprises, addison ) National Information Security and Assurance Group ( 4th Thursday, Jakes, Frisco ) Dallas MakerSpace ( Random events / carrollton ) Sources: https://calendar.google.com/calendar/embed?src=OW1vaTQxMjl1OXBhOWk3NTc4ZmVrN2dtMWtAZ3JvdXAuY2FsZW5kYXIuZ29vZ2xlLmNvbQ

Sources: All images scavenged without permission