All images scavenged without permission

Patch Tuesday Aug 2017 – 51 vulnerabilities with 130 unique downloads Internet Explorer / Microsoft Edge / Remote Code Microsoft Windows / Remote Code Microsoft SharePoint / Spoofing Adobe Flash Player / Remote Code Microsoft SQL Server / Info Disclosure Out of Band Outlook Patch EternalSynergy Exploit (SMB again) Sources: https://portal.msrc.microsoft.com/en-us/security-guidance https://technet.microsoft.com/en-us/security/advisories No longer working http://technet.microsoft.com/en-us/security/bulletin/ms17-may out-of-band outlook patch https://urldefense.proofpoint.com/v2/url?u=https-3A__support.office.com_en-2Dus_article_Outlook-2Dknown-2Dissues-2Din-2Dthe-2DJune-2D2017-2Dsecurity-2Dupdates-2D3f6dbffd-2D8505-2D492d-2Db19f-2Db3b89369ed9b-3Fui-3Den-2DUS-26rs-3Den-2DUS-26ad-3DUS-26fromAR-3D1&d=DwMGaQ&c=koUnkbJ1zJj69I6eKjYdZA&r=kslvB9NsW4rDAjC49Xjx6NDyiHRvVKH0kv9NgFtfQUV9Fu1ImLXsK1oYCKKsaMdW&m=V2EFklVZMQc2V65IekCUao7ooWpdra5rIQlWlEJeOzs&s=WEXXy8OAl4Dj4CusjwEPj4CmST1UKvZwdjBrXodaVus&e= Microsoft plans to release security updates for the following versions of Outlook on July 18, 2017. stop with the SMB already https://www.bleepingcomputer.com/news/security/exploit-derived-from-eternalsynergy-upgraded-to-target-newer-windows-versions/

Holes / Patches Oracle Adobe Cisco FreeRadius gSOAP VMWare Apple 308 Fixes Adobe APSB17-23 Flash Player ( 2 CVE) APSB17-24 Acrobat / Reader ( 67 CVE) APSB17-26 Experience Manager ( 3 CVE) APSB17-27 Digital Editions ( 9 CVE) Cisco WebEx Extension FreeRadius 15 Vulns Identified gSOAP cameras VMWare VMSA-2017-0012 ( 1 CVE) VCenter VMSA-2017-0013 ( 4 CVE) VIX API Apple Wifi / Boot Camp 6.1 ( 1 CVE) tvOS 10.2.2 ( 38 CVE) iTunes 12.6.2 Windows ( 23 CVE) iCloud 6.2.2 Windows ( 22 CVE) Safari 10.1.2 ( 25 CVE) Security Update 2017-003 ( 37 CVE) iOS 10.3.3 ( 47 CVE) watchOS 3.2.3 ( 16 CVE) Sources: ## Oracle Patches http://www.oracle.com/technetwork/topics/security/alerts-086861.html Oracle 308 cve https://threatpost.com/oracle-releases-biggest-update-ever-308-vulnerabilities-patched/126910/ ##Adobe Patches https://helpx.adobe.com/security.html https://helpx.adobe.com/security/products/flash-player/apsb17-23.html https://helpx.adobe.com/security/products/acrobat/apsb17-24.html https://helpx.adobe.com/security/products/experience-manager/apsb17-26.html https://helpx.adobe.com/security/products/Digital-Editions/apsb17-27.html ##Apple patches http://support.apple.com/kb/HT1222 apple broadpwn https://threatpost.com/apple-patches-broadpwn-bug-in-ios-10-3-3/126955/ ##Cisco patches http://tools.cisco.com/security/center/home.x http://tools.cisco.com/security/center/viewAllSearch.x?currentPage=&sortType=d&recordsPerPage=100&searchkey=&filter=43&pageSize=100&pageNo=1 Cisco Webex extension https://threatpost.com/cisco-patches-another-critical-ormandy-bug-in-webex-extension/126879/ Freeradius https://threatpost.com/freeradius-update-patches-bugs-static-analysis-tools-missed/126872/ gSOAP vuln (cameras) https://www.wired.com/story/devils-ivy-iot-vulnerability ## VMWare http://www.vmware.com/security/advisories/ https://www.vmware.com/security/advisories/VMSA-2017-0012.html https://www.vmware.com/security/advisories/VMSA-2017-0013.html ## Android https://source.android.com/security/bulletin/index.html https://source.android.com/security/bulletin/2017-07-01

Hacking Half-baked WP takeovers tor bounty open to all Windows bounty announced safe cracking robot DEFCON - gun magnets BLACKHAT - cache attack DEFCON SMB 0-day docker as malware netflix api ddos Hacking Sources: Half-baked WP takeovers https://threatpost.com/attackers-using-automated-scans-to-takeover-wordpress-installs/126815/ tor bounty open to all https://threatpost.com/tor-project-opens-bounty-program-to-all-researchers/126937/ safe cracking robot https://www.wired.com/story/watch-robot-crack-safe DEFCON - gun magnets https://www.wired.com/story/smart-gun-fire-magnets BLACKHAT - cache attack https://threatpost.com/novel-attack-tricks-servers-to-cache-expose-personal-data/127014/ DEFCON SMB 0-day https://threatpost.com/windows-smb-zero-day-to-be-disclosed-during-def-con/126927/ docker as malware https://threatpost.com/attack-uses-docker-containers-to-hide-persist-plant-malware/126992/ netflix api ddos https://www.wired.com/story/netflix-ddos-attack windows bounty program https://blogs.technet.microsoft.com/msrc/2017/07/26/announcing-the-windows-bounty-program/

Corp ARM buys Simulity Rapid7 buys Komand (orchestration) Micheal Kors buys Jimmy Choo intel shutsdown wearables Adobe draws 2020 EOL line in sand intel discontinues arduino 101 foxxconn in wisconsin bitcoin split Mandiant analyst popped HotSpot Shield data Sources: ARM buys Simulity https://securityledger.com/2017/07/with-an-eye-on-iot-security-arm-buys-simulity-for-15m/ Rapid7 buys Komand (orchestration) https://www.rapid7.com/about/press-releases/rapid7-acquires-security-orchestration-and-automation-company-komand/ Micheal Kors buys Jimmy Choo https://risnews.com/michael-kors-snags-jimmy-choo-12-billion intel shutsdown wearables https://news.hitb.org/content/intel-shuts-down-group-working-wearables-and-fitness-trackers Adobe draws 2020 EOL line in sand https://news.hitb.org/content/adobe-finally-kills-flash-dead intel discontinues arduino 101 https://news.hitb.org/content/intel-discontinues-arduino-101-development-board-and-curie-module foxxconn in wisconsin https://www.wired.com/story/foxconn-wisconsin-us-tech-skills-gap bitcoin split http://www.businessinsider.com/bitcoin-price-fork-happens-2017-8?op=1 Mandiant analyst popped http://www.healthcareinfosecurity.com/hacker-group-31337-dumps-data-stolen-from-mandiant-analyst-a-10160 HotSpot Shield data https://news.hitb.org/content/ftc-must-scrutinize-hotspot-shield-over-alleged-traffic-interception-group-says Corp

Govt Dutch surveillence no cloud searches at the border alphabay takedown (and Hansa) 5yrs for citadel coder civil asset forfieture EFF Guide on Birde crossing and device wipe jersy privacy OCR reporting tool Nevada privacy notice malwaretechblog arrested IOT Cybersecurity Improvement act of 2017 Texas SB4 Sources: Dutch surveillence http://www.theregister.co.uk/2017/07/13/dutch_surveillance_law_revamp/ no cloud searches at the border https://www.eff.org/deeplinks/2017/07/cbp-responds-sen-wyden-border-agents-may-not-search-travelers-cloud-content alphabay takedown (and Hansa) https://www.wired.com/story/alphabay-takedown-dark-web-chaos 5yrs for citadel coder http://www.healthcareinfosecurity.com/russian-citadel-malware-developer-gets-5-year-sentence-a-10127 civil asset forfieture https://theintercept.com/2017/07/20/jeff-sessions-wants-to-make-legalized-theft-great-again/ EFF Guide on Birde crossing and device wipe https://www.eff.org/deeplinks/2017/07/crossing-us-border-heres-how-securely-wipe-your-computer jersy privacy https://www.huntonprivacyblog.com/2017/07/24/new-jersey-shopper-privacy-bill-signed-law/ OCR reporting tool https://www.huntonprivacyblog.com/2017/07/25/ocr-releases-improved-data-breach-reporting-tool/ Nevada privacy notice https://www.huntonprivacyblog.com/2017/07/27/nevada-enacts-website-privacy-notice-law/ malwaretechblog arrested https://motherboard.vice.com/en_us/article/ywp8k5/researcher-who-stopped-wannacry-ransomware-detained-in-us-after-def-con IOT Cybersecurity Improvement act of 2017 http://threatpost.com/legislation-proposed-to-secure-connected-iot-devices/127152/ Texas SB4 https://theintercept.com/2017/08/03/texas-police-say-sb4-is-damaging-public-safety-before-even-taking-effect/ Govt

Papers MS ebooks Car hacking workbench pt2 Car hacking workbench pt3 https://blogs.msdn.microsoft.com/mssmallbiz/2017/07/11/largest-free-microsoft-ebook-giveaway-im-giving-away-millions-of-free-microsoft-ebooks-again-including-windows-10-office-365-office-2016-power-bi-azure-windows-8-1-office-2013-sharepo/ http://ligman.me/2sZVmcG Car hacking workbench pt2 https://community.rapid7.com/community/transpo-security/blog/2017/07/17/building-a-car-hacking-development-workbench-part-2 Car hacking workbench pt3 https://community.rapid7.com/community/transpo-security/blog/2017/07/20/building-a-car-hacking-development-workbench-part-3 Papers Sources: MS ebooks https://blogs.msdn.microsoft.com/mssmallbiz/2017/07/11/largest-free-microsoft-ebook-giveaway-im-giving-away-millions-of-free-microsoft-ebooks-again-including-windows-10-office-365-office-2016-power-bi-azure-windows-8-1-office-2013-sharepo/ http://ligman.me/2sZVmcG Car hacking workbench pt2 https://community.rapid7.com/community/transpo-security/blog/2017/07/17/building-a-car-hacking-development-workbench-part-2 Car hacking workbench pt3 https://community.rapid7.com/community/transpo-security/blog/2017/07/20/building-a-car-hacking-development-workbench-part-3

employees OK with bio implants Metal is Terror employees OK with bio implants WTF Sources: Metal is terror https://www.eff.org/deeplinks/2017/07/payment-processors-are-profiling-heavy-metal-fans-terrorists employees OK with bio implants https://www.nytimes.com/2017/07/25/technology/microchips-wisconsin-company-employees.html?_r=0

Tools siemonster pyREBox yython sandbox Blackhat arsenal Luckystrike 2.0 evil macro generator fireEye FlareVM malware analysis anti-drone DefPloreX machine learning Tools Sources: https://siemonster.com/ pyREBox https://blogs.cisco.com/security/talos/pyrebox Blackhat arsenal http://feedproxy.google.com/~r/Toolswatch/~3/36pHpS866W8/ Luckystrike 2.0 https://curi0usjack.blogspot.com/2017/07/luckystrike-20-is-here.html fireEye FlareVM (malware analysis) https://www.fireeye.com/blog/threat-research/2017/07/flare-vm-the-windows-malware.html anti-drone https://www.wired.com/story/watch-anti-drone-weapons-test DefPloreX http://blog.trendmicro.com/trendlabs-security-intelligence/defplorex-machine-learning-toolkit-large-scale-ecrime-forensics/

BH - Palo Alto IOT honeypot BH - priveiw BH - top 20 BH - best of BH - Palo Alto IOT honeypot BH - Carwash smash DC - Queercon Badge DC - mr Robot Badge DC - badges DC - Tor Past Cons Sources: BH- priveiw https://threatpost.com/black-hat-usa-2017-preview/126984/ BH - top 20 http://www.healthcareinfosecurity.com/blogs/20-hot-sessions-black-hat-2017-p-2521 BH - best of https://www.wired.com/story/best-black-hat-defcon-talks DC - Queercon Badge https://blinkylights.ninja/blinky-lights/queercon-14-defcon-25-2017/ DC mr Robot Badge https://hackaday.io/project/18508-mr-robot-badge/log/64526-how-i-created-the-mr-robot-badge DC badges http://hackaday.com/2017/08/04/all-the-hardware-badges-of-def-con-25/ DC Tor https://threatpost.com/tor-developer-busts-myths-announces-new-features/127207/ palo iot honeypot https://researchcenter.paloaltonetworks.com/2017/07/palo-alto-networks-showcase-iot-honeypot-research-black-hat-2017/ https://infosec-conferences.com/ https://opensource.com/resources/conferences-and-events-monthly https://cfptime.org/ http://wikicfp.com/cfp/ BH - Carwash smash https://motherboard.vice.com/en_us/article/bjxe33/car-wash-hack-can-smash-vehicle-trap-passengers-douse-them-with-water

Future Cons SANS San Antonio 6-11 Aug ToorCon San Diego 28Aug – 3 Sep DerbyCon 20-24 Sep Rock Stars of Cybersecurity Technologies 26 Sep CactusCon 29-30 Sep Future Cons Sources: https://www.concise-courses.com/security/conferences-of-2017/ http://www.securitybsides.com/w/page/12194156/FrontPage

Where DHA @Dallas_Hackers TX2600 @dallas2600 The Lab.MS @TheLab_ms ( 1st Wednesday / Family Karaoke, Dallas ) TX2600 @dallas2600 ( 1st Fri / Wild Turkey 35&WalnutHill, Dallas ) The Lab.MS @TheLab_ms ( 2nd Saturday + random events / TheLab.ms, Plano ) ISSA Fort Worth @ISSAFortWorth ( 2nd Tuesday / location varies ) ?? Fort Worth Crypto Party ?? ( 2nd Tuesday ? / The Maker Spot, N. Richland Hills ) Hack Ft Worth @Hack_FtW ( 3rd-ish Tuesday / Buffalo West, Fort Worth) OWASP Dallas @OWASPDallas ( 3rd Tuesday / location varies ) Crypto Party DFW @CryptoPartyDFW ( 3rd Thursday / TheLab.ms, Plano ) North Texas Cyber Security Group @ntxcsg ( Last Thursday, Jakes, Frisco ) Dallas MakerSpace @dallasmakers ( Random events / Carrollton ) Sources: https://www.google.com/calendar/embed?src=c4ervam9s3ep79dtdjd1k9kgbk%40group.calendar.google.com&ctz=America/Chicago Where

Sources: All images scavenged without permission