Hello, welcome to the Friday, August 11, 2020,

edition of the Sandinand Storm Center's Stormcast.

My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

Boyan today wrote a quick and really neat diary about a weakness in SQL server of that's not new but still often overlooked

because, well, there are often no great alternatives. The problem is that if an

attacker is able to observe the authentication process, there is a password being exchanged that's really just obfuscated. It's not

encrypted. The obfuscation is pretty straightforward. You basically just swap the two nipples

in each bite and then XOR each byte with a 5.

That's all it takes in order to then retrieve the original password.

And Boyan wrote a little Python script to make that even easier for you to perform. As Boyan points out that often there is no great alternative here, it would require a major sort of application rewrite.

Of course, at that point, you may as well use some more modern technologies like a Rest API or something like this, instead of connecting directly back to the SQL server.

And back in April, Microsoft patched vulnerabilities in Windows Defender, and we now have

thanks to research a safe breach, who originally found the vulnerability, more details about

what is exactly involved. The researchers did present at Black Hat this week.

Their talk, which also included a tool defender pretender, that basically demonstrates that

due to this vulnerability, it's not just possible to alter the signatures that Windows Defender uses, and with that,

of course, you could easily make it blind to particular Malibur, but also to get Windows

Defender itself to actually run malicious code.

Part of the issue here is that the signature files that the Windows Defender downloads are not

just the actual signatures, but there's also executables involved here, and then these files

are not properly validated after being downloaded, which does allow an attacker to essentially

replace some of these binaries and with that execute optory code.

...