Hello, welcome to the Monday, April 10th, 2017 edition of the Sansanet Storm Center's Stormcast. My name is Johannes Ulrich, and today I'm recording from Orlando, Florida.

I'm here in Orlando, of course, at the Sands Conference, teaching intrusion detection. Well, if you missed me here at this conference, I'll actually be in San Diego second week of May teaching the defending web application class and also my two-day IPV6 class if you're interested in that.

But well, let's dive into security news and let's start with an article that DDA posted about

how prevalent malicious sites are among Alexa's top one million sites.

Actually, DDA looked at two different lists, Alexa and Umbrella, both lists that are commonly used as white lists because you don't want to lock your users out of popular sites.

Well, I mentioned it before. Often popular sites are also used for malicious purposes. In particular, sites that allow user content, can easily be abused

as command and control channels. No easy solution here for the defender, but in general,

don't trust white lists or blacklists blindly. Often they do require a more detailed review.

And apparently, someone managed to hack Dallas's emergency management system and turn on

every single tornado siren in Dallas on Saturday evening.

Now, while this attack first may appear more as a prank than a serious attack,

there was actually a quite serious side effect of this attack

in that the confusion it caused did flood 911 operators with calls

and there were substantial delays at times in answering 911 calls as a result of this attack.

These type of systems have been known to be quite vulnerable for quite a while now, also

emergency broadcast systems, and so it has been pointed out in the past that off occasion

alike isn't all that great for these systems.

At this point it's too early to speculate about what exact exploit was used here

or how this attack or who mounted it.

Well, the guess so far is that the attack came from a local source, which probably means that it was

more intended as a not so sophisticated prank. And Shadowbroker, the organization that did

try to sell a stash of stolen NSA hacking tools and already has released a number of interesting tools in the past.

...