The IWC CIR is an OSINT resource focusing on advanced persistent threats and other digital dangers. APTs fit into a cybercrime category directed at both business and political targets. Attack vectors include system compromise, social engineering, and even traditional espionage. The revival of the Cyber Intelligence Report comes with a few extras. Included is a link to a new web series called Cyber Secrets. Cyber Secrets covers subjects ranging from forensics to system exploitation and everything in between. Enjoy. Biggest news items it the Recent Heartbleed bug. The easiest explanation came in the form of a comic strip from XKCD.COM More in-depth video here: Cyber Secrets 2x05: heartbleeding bug Cyber Secrets Web Series Top 5 Defacers 140 120 100 80 60 40 20 0 Information Warfare Center: www.informationwarfarecenter.com 1 CIR Legal (11) ACLU Launches User-Friendly Database Of Every Snowden Doc Appeals Court Reverses Weev Conviction Barrett Brown Signs Plea Deal In Stratfor Hack Connecticut, Illinois Investigating Massive Breach At Experian Ex-Microsoft Employee Pleads Guilty Over Data Leak Gogo Inflight Wireless Goes Beyond Giving Into CALEA Google Pays $1.4M Fine Over Italian Street View Snafu Google Wants Supreme Court To Rule On Street View Privacy Case Twitter Still Blocked Despite Turkish Court Ruling US Card Thief Faces Lengthy Jail Term Whitehat Hacker Goes Too Far, Gets Raided By FBI, Tells All Government (13) Colombian Government Ignores Human Rights Cyber Emergency Response Team Launched By UK Drone Hacked To Attack Australian Triathlete? Federal Agencies Fall Short On Data Breaches, GAO Report Says NSA Denies Exploiting Heartbleed NSA Infiltrated RSA Security More Deeply Than Thought NSA Monitoring Turns Yahoo! Into An Encryption Powerhouse Obama's NSA Overhaul May Require Phone Carriers To Store More Data Only 3 Of 43 British Police Forces Can Deal With Cybercrime Researchers Uncover NSA Tool Enabling Faster Cracking Of RSA RSA Ties To NSA Go Deeper Than Thought U.S. Secretly Built 'Cuban Twitter' To Stir Unrest US Attorney General Says Criminals Use Crypto Currencies Mobile (2) Google Beefs Up Android Security With Scanning App Feature iOS 7 Bug Allows iPhone Thieves To Switch Off Find My iPhone SCADA (1) Power Plants Put At Risk By Security Bugs Technology (44) Angry Birds Developers Downplay Fresh Data Leak Claims Anonymous Attacks Hundreds Of Israeli Websites Apple Patches Twenty-Seven Vulnerabilities In Safari Awesome 5-Year-Old Bypasses Xbox Password Flow Brad Pitt's Plan B Acquires Hacker Story 'Anonymous Vs. Steubenville' Call Of Duty Fragged Using OpenSSL's Heartbleed Exploit China's Bitcoin Exchanges Begin Pulling Down The Shutters Cyber Criminals Are Outspending Defenders Two To One Dropbox Causes Storm With Condoleezza Rice Appointment 2 CIR eBay ProStores Suffered From Full Credit Card Disclosure Vulnerability Everything You Need To Know About The Heartbleed SSL Bug Fandango, Credit Karma Settle FTC Charges Of Poor App Security Google Kills Fake Anti-Virus App That Hit No. 1 On Play Charts Hacker Holds Key To Free Flights Hackers Use Security Camera DVRs As Bitcoin Mining Rig Heartbleed Vuln Under Active Attack As Hackers Map Soft Spots Horrific Vuln: Update Your OpenSSL NOW! How Heartbleed Broke The Internet - And Why It Can Happen Again How To Protect Yourself From The Heartbleed Bug If You Were Vulnerable To Heartbleed, Roll Your Private Keys Already LinkedIn Email Addresses Exposed By Plug-in Software Malware Boom Forces Security Vendors To Roll Out Upgrades Every 40 Minutes Massive Data Breaches Hit 552 Million Web Users In 2013 Microsoft Security To Automatically Block Adware On 1 July Microsoft Spells Out New Rules For Exiling .EXEs Middle Eastern Hackers Use Remote Access Trojan On 24,000 Machines Mike Judge Skewers Silicon Valley With The Satire Of Our Dreams New Version Of Chrome Ignores Autocomplete... Deliberately Ransomware: A Q&A Report: Data Breaches Up 62 Percent In 2013 Researcher Lights Fire Under Tesla Security See Global Cyberthreats Mapped In Real Time SmartTV, Dumb Vuln: Philips Hard-Codes Miracast Passwords Tesla In 'Ethernet Port Carries Data' Scandal The Great Hash Bakeoff: Infosec Bods Cook Up Next-Gen Crypto Tinder Accounts Spammed By Bots Masquerading As Singles Uncontrolled Resource Consumption With XMPP-Layer Compression VMware Patches Man In The Middle vSphere Vulnerability Websites Aren't The Only Thing Affected By Heartbleed Who Was Using Heartbleed In November 2013? Windows XP Users Face End To Microsoft Support XSS Vuln In Site Enables Unique DDoS Attack Yahoo! Breaks! Every! Mailing! List! In! The! World! ZeuS Malware Using Valid Digital Signature Papers (5) Microsoft Windows Help Systems Vulnerabilities. Tor Timing Attack Proof Of Concept USB Attacks Need Physical Access Right? Not Any More... WhatsApp Database Extraction Whatsapp Forensic/Stealer (Android) POC Paper Call for Papers (3) c0c0n 2014 Call For Papers NoSuchCon 2014 Call For Papers PIR Workshop 2014 Call For Papers 3 CIR Web App Exploits This section of the CIR is dedicated to inform the public exploits, tools, and whitepapers that may directly affect the security posture of an organization. The term “Proof of Concept (PoC)” is another term for working exploit. Many of these PoCs will eventually find themselves in malicious logic such as viruses, Trojans, and root kits. Exploits (19) Apple Mac OS X Lion Kernel <= xnu-1699.32.7 NFS Mount - Privilege Escalation Exploit osx BlazeDVD Pro Player 6.1 - Stack Based Buffer Overflow Jump ESP windows Bluetooth Text Chat 1.0 iOS - Code Execution Vulnerability ios Fitnesse Wiki Remote Command Execution Vulnerability windows FreePBX config.php Remote Code Execution unix Fritz!Box Webcm Unauthenticated Command Injection hardware HSC Client 1.00 2067 - Privilege Escalation Vulnerability multiple Halon Security Router (SR) 3.2-winter-r1 - Multiple Security Vulnerabilities hardware Heartbleed OpenSSL - Information Leak Exploit multiple ibstat $PATH Privilege Escalation linux Internet Explorer 10 & Adobe Flash Player (12.0.0.70, 12.0.0.77) - CMarkup Use-After-Free windows JIRA Issues Collector Directory Traversal windows Katello (Red Hat Satellite) users/update_roles Missing Authorization linux MS14-012 Internet Explorer TextRange Use-After-Free windows MS14-017 Microsoft Word RTF Object Confusion windows OpenSSL 1.0.1f TLS Heartbeat Extension - Memory Disclosure (Multiple SSL/TLS versions) multiple OpenSSL TLS Heartbeat Extension - Memory Disclosure multiple PhonerLite 2.14 SIP Soft Phone - SIP Digest Disclosure windows plexusCMS 0.5 - XSS Remote Shell Exploit & Credentials Leak php SePortal SQLi - Remote Code Execution php Sophos Web Protection Appliance Interface Authenticated Arbitrary Command Execution unix Sun Java Runtime Environment 1.6 - Web Start JNLP File Stack Buffer Overflow Vulnerability linux Vtiger Install Unauthenticated Remote Command Execution php WinRAR Filename Spoofing windows Denial of Service (8) A10 Networks ACOS 2.7.0-P2(build: 53) - Buffer Overflow hardware Asterisk 1.x - BYE Message Remote Denial of Service Vulnerability multiple EagleGet 1.1.8.1 - Denial of Service Exploit windows InfraRecorder 0.53 - Memory Corruption [Denial of Service] windows MA Lighting Technology grandMA onPC 6.808 - Remote Denial of Service (DOS) Vulnerability windows MacOS X 10.9 Hard Link Memory Corruption osx Notepad++ DSpellCheck 1.2.12.0 - Denial of Service windows WhatsApp < v2.11.7 - Remote Crash multiple 4 CIR CIS Manager CMS - SQL Injection asp CMS Made Simple 1.11.10 - Multiple XSS Vulnerabilities php csUpload Script Site - Authentication Bypass multiple CubeCart 5.2.8 - Session Fixation php Horde Webmail 5.1 - Open Redirect Vulnerability php iShare Your Moving Library 1.0 iOS - Multiple Vulnerabilities ios Kloxo 6.1.18 Stable - CSRF Vulnerability php Kloxo-MR 6.5.0 - CSRF Vulnerability php Microweber CMS 0.93 - CSRF Vulnerability php NetPilot/Soho Blue Router 6.1.15 - Privilege Escalation hardware Oracle Identity Manager 11g R2 SP1 (11.1.2.1.0) - Unvalidated Redirects php Orbit Open Ad Server 1.1.0 - SQL Injection php PDF Album v1.7 iOS - File Include Web Vulnerability ios Private Photo+Video 1.1 Pro iOS - Persistent Vulnerability ios QuickCms 5.4 - Multiple Vulnerabilites php RunCMS 1.6.1 - 'pm.class.php' Multiple SQL Injection Vulnerabilities php Sagem Fast 3304-V2 - Authentification Bypass hardware Sendy 1.1.9.1 - SQL Injection Vulnerability php WordPress Theme LineNity 1.20 - Local File Inclusion php Wordpress XCloner Plugin 3.1.0 - CSRF Vulnerability php XAMPP 3.2.1 & phpMyAdmin 4.1.6 - Multiple Vulnerabilities php XCloner Standalone 3.5 - CSRF Vulnerability php Tools Aircrack-ng Wireless Network Tools 1.2 Beta 3 Capstone 2.1.2 CodeCrypt 1.6 Coloured ELF File Dissector DNS Spider Multithreaded Bruteforcer 0.5 GNUnet P2P Framework 0.10.1 Heartbleed Honeypot Script Immunity Hooking Script LFI Exploiter 1.1 LFI Exploiter 1.1 Lynis Auditing Tool 1.4.9 Lynis Auditing Tool 1.5.0 OpenDNSSEC 1.4.5 OpenSSL Toolkit 1.0.1g Pytacle Alpha2 SkyJack Drone Hijacker sn00p 0.8 Sysdig Exploration Tool Tor-ramdisk i686 UClibc-based Linux Distribution x86 20140409 w3af Web Application Attack and Audit Framework 1.6 Zed Attack Proxy 2.3.0 Linux Release Zed Attack Proxy 2.3.0 Mac OS X Release Zed Attack Proxy 2.3.0 Windows Installer 5 CIR This section of the CIR is dedicated to inform the public of website defacements that have targeted either larger organizations or government agencies. The perpetrators of these attacks are all over the world and have different reasons for hacking that range from curiosity to hacktavism to state sponsored espionage/cyber warfare activity. : (763) Notifier L Domain OS View ./Mr.Dha comprensivosancesario.gov.it Linux mirror ./Mr.Dha icgallipolipolo3.gov.it Linux mirror @Df Brazil Hack Team www.domsilverio.mg.gov.br/edit... Linux mirror @Df Brazil Hack Team www.santanadoipanema.al.gov.br... Linux mirror @Df Brazil Hack Team saojosedoegito.pe.gov.br//edit... Linux mirror @Df Brazil Hack Team www.vitorinofreire.ma.gov.br/e..