Hello, welcome to the Friday, August 18th, 2017 edition of the Sands and its Storm Center's Stormcast.

My name is Johannes Ulrich, and the day I'm recording from Jacksonville, Florida.

It looks like the bad guys just don't run out of features to take advantage of in Microsoft's Office software.

The latest feature is auto-updating links. You can link different

documents with each other in office, for example, a Word document in this case that includes an

RTF document and Office or Word in this case will automatically pull in that file in order

to update the related content. Well, in this particular case, will automatically pull in that file in order to update the related content.

Well, in this particular case, the attacker is using this trick in order to download a malicious

RTF document that then has additional exploit code in it.

This way, of course, they're avoiding some of the detection mechanisms that look for specific

download techniques in your web proxies. You may see these requests with a user agent of Microsoft

Office Protocol Discovery. Now, this of course by itself doesn't mean it's malicious. This

particular user agent is used for a bunch of different things.

But take a look and see if you find anything interesting.

And according to a paper published at Eusnix by researchers from IBM, it looks like the

Rohhammer attack is back and this time for MLC

Nant flash memory that's commonly found in SSD disks.

Now if you remember, the original Rohhammer attack affected RAMs memory and what essentially

did was that an attacker has access to a limited part of memory.

The attacker can now flip bits very quickly within the memory the attacker has access to.

And by doing so due to interference with adjacent rows, the attacker can actually in a somewhat controlled way flip bits in other parts of memory that the attacker typically would not have access to.

So apparently the same trick pretty much works with these MLC NAND flash chips and does affect solid state drives. An attacker essentially could

...