Hello, welcome to the Tuesday, July 12, 2016 edition of the Sansonet Storms and a Stormcast.

My name is Johannes Ulrich and the I'm recording from Jacksonville, Florida.

You got a great new guest diary by Yasser Munsour.

He's talking about the malicious vert macros that he observed install malware. Interestingly here the

malware is embedded in the word document and then extracted by the word macro. Very detailed

instructions here with lots of step-by-step guidance on how you can do something like

this yourself pretty much with open source

tools so if you have to reverse engineer malware and you're running into one of these

word macros you may want to take a look at this guest diary and by the way we always accept

guest diaries if you have an idea just it to us before you go through trouble and writing it

all up.

And the Pokemon GoFever is continuing not just with kids running around trying to find

Pokemon's, but also with security researchers finding vulnerabilities in the application.

First of all, if you installed Pokemon Go on an iOS device, you probably gave it access to your Google account,

which means that the application has full access to everything Google on your phone or on your Google account, including

emails, pictures, and Google trive data. There appears to be no simple way right now to limit

the permissions that the Pokemon app has on your phone. Secondly, the web API that the

application uses appears to be vulnerable to man the middle attack. It does not actually

verify ZSEL certificates. So with that, it's not really such a huge deal for the user, more for the people behind the app,

because it does allow you to gain arbitrary goods, for example, in the Pokemon Go Online store.

And one problem with simple speaker-independent voice command systems like Siri has always been that someone

could play a voice file speaking commands that would then get interpreted by the phone or whatever

...