Hello and welcome to the Friday, December 22nd, 2023 edition of the Sands and its Storm Center's Stormcast.

My name is Johannes Ulrich and I'm recording from Jacksonville, Florida.

The reason we are running honeypots at the United Storm Center is to figure out what vulnerabilities attackers are exploiting.

And again, our interns with the Sands.edu Undergraduate program are helping us to sift through

the logs and figure out, you know, what is new and interesting. Now, often we are sort of focusing a little bit more

on cutting edge recent vulnerabilities, even though the vast majority of these hit hacks is

looking for well-known problems. That's something pointed out by David Thompson here in

his diary. This diary looks at essentially some of these sort of enumeration, brute forcing attacks for different file names, seeing a ton of them.

And really a good reminder to, first of all, clear up any files that you no longer need on your system and properly access controlling files

that still need to be present. And David is going over some tricks here to show you how to do this

properly in Apache. And then before you go into your well-deserved holiday, probably a long weekend, you may want to quickly make sure that Google Chrome is up to date.

We do have a new Saturday vulnerability that was patched in Google Chrome.

And talking about the holidays, just a quick note here, not related to a specific

news story or such, but a couple of things that you probably want to look for if you are

in the unlucky place to be stuck at work over the weekend, sort of monitoring your systems.

Probably the best thing you can do during this time, if you have to be stuck at work over the weekend sort of monitoring your systems. Probably the best thing you can do during this time if you have the extra time is to carefully watch your remote access systems. And this includes

things like VPNs, of course systems like Citrix and such. We had a lot of attacks against that recently. Make sure that access you're seeing is legitimate. And of course, sometimes you may have in particular enabled some of these systems to allow for people who are working remotely over the holidays to be able to assist you with things like network

administrating tasks. Don't forget the serial consoles if you still have things like this.

And again, if you have some extra time, maybe a good thing to just poke around a little bit,

check your logs, make sure everything is up to date and look for any kind of odd

access patterns when it comes to these remote access systems.

Now for those of you spending the holidays at home with family, just a couple of reminders

...