Hello and welcome to the Friday, April 19th, 2020, 4 edition of the Santernet Storm Center's Stormcast.

My name is Johannes Ulrich, and today I'm recording from Washington, D.C.

And we now have a public proof of concept and more details for the delinear secret server vulnerability or ticotic as it used to be known as.

This particular vulnerability allows an unauthenticated user to gain access to the API on these devices.

Interesting vulnerability and sort of one of those tricky authentication bypass

vulnerabilities that you often run into when developers try to something fancy, different,

and don't quite understand all the precautions of the authentication schemes they come up with.

The problem here is that, first of all, there's a user ID that's just encrypted

with a static key. So pretty easy to find the static key in the code and then create your

own encrypted user ID. Just simply impersonating the user with this encrypted user ID was not

possible initially because there was also a

timestamp that was linked to a random UUID that was not predictable.

But turns out if this UUID is just removed and the expiration date of the session, then

well, that check is skipped and an attacker is able to log in as any user.

Exploitation of this is pretty straightforward based on this blog post.

The blog post was published by Johnny Wee, who did initially also find and report the vulnerability to the linear.

And thanks to Tenable, we also now have additional details and a proof of concept exploit

for the Yvante Avalanche heat buffer overflow, something I mentioned earlier this week.

So both Delania and Yvante, you should patch these products before you leave for the weekend.

Typically, fishing campaigns don't really get me that excited, but Lookout has a nice write-up about a bit more sophisticated fishing campaign in terms on how they are impersonating their targets.

First of all, these phishing emails or actually SMS messages as they show up as are

targeting specific individuals, then the link the particular SMS message then connects to

...