Hello, welcome to the Friday, April 27th, 2018 edition of the Sandsenet Storm Center's Stormcast. My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

I mentioned the new triple vulnerability yesterday. At the time I talked about an exploit that was available at Pastebin. We have now seen some individual

exploit attempts using this exploit and variations of it. So this is certainly being used

in the wild. Given that this exploit is still a little bit more complex than the old exploit and does appear

to require our vacation.

We don't see quite the volume with it that we have seen with some of the older exploits.

Tom, who is our handler today, has actually experienced one of these exploit attempts earlier today against one of his own

systems. He's writing it up right now as I'm recording this podcast. So hopefully sometime Friday

morning he'll make his write-up live and it talks in more detail about how this particular exploit was used against his

systems. And you probably heard of remote management systems for servers like IPMI or Dell's

DRAC or HP's integrated light out or ILO. All of these systems have a rich history in vulnerabilities and bad configurations

that have been used in the past in order to compromise systems. Now the latest twist on this

happens to hit HP's integrated light out servers. In this case, it appears good old ransomware is used to encrypt disks.

Now, the way this works is that NetHacker first compromises the server via the integrated lights-out

system.

Now, the integrated lights-out system gives NetHacker full control over keyboard, mouse, the integrated lights out system gives an attacker full control over keyboard, mouse,

the screen and disk drives.

So the attacker here will then remotely mount a CD image that essentially includes the encryption software that's being used to encrypt the disk. In addition, a warning banner

is placed on the console that informs the victim that their systems have been compromised.

It's not quite clear how did hacker gain access to the integrated lights out system in this

case, but often this just happens via stupid default.

Now, in the past, there have been vulnerabilities in these systems that allowed for an

...