Hello and welcome to the Friday, December 21st, 2018 edition of the Santernut Storm Center's Stormcast. My name is Johannes Ulrich. And I'm recording from Jacksonville, Florida.

You may remember Sandbox Escaper, the Twitter handle that was used to publish a couple of Windows Saturdays in the past. Well, Sandbox

Escaper has a Christmas present for us in that he published yet another Windows

Saturday exploit that in this case allows for an arbitrary file read. So it's not a huge deal, I would think,

because you essentially have to run code on the system in order to then read arbitrary files,

but it's essentially sort of approach escalation because you can also read files that you

normally would not have access to. The vulnerable function MSI advertised product is typically called by installers in order to advertise

products and that's the function that runs as system and that can be used to read arbitrary

files.

No patch of course available yet and as far as I can tell,

no response from Microsoft so far. Not much you can do about it other than, well, be careful

what software you run on your system. And Amnesty International has a great write-up with a summary of different, more advanced

fishing attacks that they have seen against activists predominantly in the Middle East.

Now one particular neat feature here is a bypass of two-factor of the occasion.

Essentially what the attacker does here is that they do set up

a typical fishing site, but then instead of just collecting your credentials, they actually

have a copy of Google Chrome that is automated to enter those credentials into the legitimate

websites. And if there is, is for example a two-factor

authentication prompt that prompt is just forwarded to the user and if the user authenticates

using two-factor authentication well then the attacker will add an application specific password

to the account which of course then will give the attacker will add an application-specific password to the account, which of course

then will give the attacker persistent access to the account. In addition, Amnesty International

...