Previous Gnews Do Not Poke It If It

Previous Gnews

Do Not Poke It If It Is Not Yours Do Not Brag About Questionable Activity Do Not Hack The Venue Not Legal Advice Everything Is Theoretical Use At Your Own Risk Not Responsible For Damages Mileage May Vary Trust No One Verify Everything Do Your Own Research Create Your Own Opinion Communicate Share Learn Enjoy

Patch Tuesday Feb – 77 CVE / 61 KB Articles • • • • Reports of 6 Critical Adobe Flash Player Internet Explorer, *active exploit Microsoft Edge Microsoft Windows Microsoft Office and Microsoft Office Services and Web Apps Chakra. Core. NET Framework Microsoft Exchange Server Microsoft Visual Studio Azure Io. T SDK Microsoft Dynamics Team Foundation Server Visual Studio Code • 3 out-of-band patches, Team Foundation Server / Skype for Business 2015 • Exchange 0 -day, api and Write. Dacl • Cortana / Search separation? • Vulnerable RDP Clients

Holes / Patches • Oracle – – • • Small Business Switched, ab ( 1 CVE ) SD-WAN v. Container, ce ( 1 CVE ) Multiple vulns, ce Identicard – • APSB 19 -03 Experience Mgr Forms, xss ( 1 CVE ) APSB 19 -06 Flash Player, id ( 1 CVE ) APSB 19 -07 Acrobat & Reader, ce ( 71 CVE ) APSB 19 -09 Experience Mgr, xss ( 2 CVE ) APSB 19 -10 Cold. Fusion, ce ( 2 CVE ) APSB 19 -11 Creative Cloud Destop, pe ( 1 CVE ) Juniper – • • Cisco – – • • 2 root access, 1 BO ( 3 CVE ) Apple – – – – – i. OS 12. 1. 3 ( 31 CVE ) mac. OS ( 23 CVE ) tv. OS 12. 1. 2 ( 24 CVE ) watch. OS 5. 1. 3 ( 17 CVE ) Safari 12. 0. 3 ( 10 CVE ) i. Cloud for Win 7. 10 ( 12 CVE ) i. Tunes for Win 12. 9. 3 ( 14 CVE ) i. OS 12. 1. 4 ( 4 CVE ) mac. OS Supplemental ( 3 CVE ) Shortcuts for i. OS 2. 1. 3 ( 2 CVE ) – – Face. Time bug Mac Key. Chain Chrome – 4 0 -days, hardcoded creds Kubernetes, runc systemd – 284 fixes 3 DB / 5 Java / 30 My. SQL Adobe – – – • • 58 patches fire. OS – Content Injection

• • • DNS Flag Day Data Privacy Day Public Domain Day – “new” works from 1923 • • Firefox, drops flash support Bing now with child porn • • Play-with-Docker escape airline e-ticketing flaws/ • • • 202 m users on chinese job mongodb Collection #1 Massive creds cache found (new? / old? ) Collections 2 -5 drop • is the 10 year challange an AI trainer? • Google URL inspection tool • FRR & BGP • • • SMS intercepter, Modlishka mac malvertizing stego Speak. Up linux malware • Nintendo Switch firmware cracked in 4 hrs • • 5 G aka vulns Poodle redux, now for TLS 1. 2 Hacking

• Fierv buys First Data • digi. Cert buys Quo. Vodis • Dropbox buys Hellosign • Ultimate Software going private • Help. Systems buys Core Security • Carbonite buys webroot • BBT buys Sun. Trust • Symantec buys Luminate • OXO popped • El Al website popped • Airbus popped • Houzz popped • VFEmail servers destroyed • Dunkin Donuts cred stuffing round 2 • OKCupid cred Stuffing • Avast exposes local creds • D&Q loose elastic • Signaporian HIV database exposed Corp

• ? ? popped, Discover replaces cards • Cal Poly leaks student information • Ok Dept of Securities DB • reddit password resets • twitter protected tweets bug on android • Google GDPR fine, 57 mil • Jack'd app leaks photos • Tmobile caller verification • Google now with DNS over TLS • Netflix to tighten noose on cred sharing • ATT Google data selling • not petya act of war, no insurance payouts ? • Azure Dev. Ops Bug. Bounty • You. Tube/Google updates dangerous content policy • HITRUST expanding in to GDPR and PDPA • FB app mashup • MS 0365 Security Command Center • Quardiga. CX CEO dies with password, 145 mil poof • SBI leaks user creds • DC Exchange User keys leaked, 600 K • VIOPo. com DB Corp

• Cert expirations • Mass updates data breach law • Jeep hack going to supreme court • Feds can't force fingerprint unlocking • illinois biometric privacy • Mean while in Indiana • US charges Huawei • on-line voting in VA? • Family. Tree. DNA admits to sharing data with FBI • House calls ajit on the carpet • Fed VPN Ban? • European court says right to be forgotten should only apply to EU • EDPB 2 nd Privacy Shield Report • Hungary 8 yrs for reporting flaw? • x. Dedic market shutdown Govt

Papers Please Forget Where I Was Last Summer: The Privacy Risks of Public Location (Meta)Data https: //arxiv. org/pdf/1901. 00897. pdf New PCI-DSS standards https: //www. pcisecuritystandards. org/pdfs/New_Software_Security_Standards_Press_Release. pdf bitlocker how to https: //www. zdnet. com/google-amp/article/windows-10 -experts-guide-everything-you-need-to-know-about-bitlocker/ Decent write up on secure password and credential cache https: //isc. sans. edu/diary/rss/24612

WT F Scooter take downs Creeper sites Maps shit blogging Apple sued forcing 2 fa

Tools Covenant. Net C&C Framework metasploit 5 dnsdumpster. com aztarna a “shodan” for robots wireshark tutorials Google adiantum Iot encryption PWDCOMPARE() sql passwd comparison Google Cluster. Fuzz fuzzer

t s a P ns o C Enigma Cyber. First Girls Competition 2019

Fu tur Co e ns BDYHAX - 23 -24 Feb – Austin Hou. Sec. Con 9 - 9 -10 Apr – Houston BSides. OK – 10 -12 Apr - Tulsa Thot. Con 3 -4 May – Chicago ISC 2 Congress CFP

ISSA Fort Worth @ISSAFort. Worth ( 2 nd Tuesday / location varies ) Hack Ft Worth @Hack_Ft. W ( 3 rd Tuesday / Barrel & Bones, Fort Worth) DHA @Dallas_Hackers ( 1 st Wednesday / Family Karaoke, Dallas ) TX 2600 @dallas 2600 ( 1 st Fri / Wild Turkey 35&Walnut. Hill, Dallas ) The Lab. MS @The. Lab_ms ( 2 nd Saturday + random events / The. Lab. ms, Plano ) OWASP Dallas @OWASPDallas ( 3 rd Tuesday / location varies ) Pwn School Project ( 3 rd Wed / Dallas | 4 th Mon Denton ) Crypto Party DFW @Crypto. Party. DFW ( 3 rd Thursday / The. Lab. ms, Plano ) North Texas ISSA @ntxissa ( 3 rd Thursday / Maggiano’s, Plano ) North Texas Cyber Security Group @ntxcsg ( Last Thursday, Jakes, Frisco ) Dallas Maker. Space @dallasmakers Where ( Random events / Carrollton ) 0 -day All Day @0 Dayallday ( Quarterly / Genius. Den, Dallas )

All images scavenged without permission