Hello, welcome to the Friday, December 4th, 2020 edition of the Sandsenet Storms anders Stormcast.

My name is Johannes Ulrich, and today, well, I'm in Jacksonville, Florida, but actually teaching at Sands Frankfurt.

And with that, let's take a look at what we have in Diaries.

Today, we have another traffic analysis quiz by Brad.

So if you are into analyzing P-Caps, and well, this week I'm actually teaching the intrusion detection class, so fits really well. You can take a look at what Brad has put together here for you

as a challenge. And you don't just get the P-Caps, you also get links to tutorials he has put

together in order to teach you about Viarshark and help you analyze this particular packet capture.

An item I probably should have covered yesterday is an article by Google Project

Zero's researcher Ian Beer.

He discovered back in, well, actually sort of a year ago, November 2019, vulnerability in iOS that Apple later fixed with iOS 1331

and macOS 10153 at the end of January of this year. What makes this vulnerability so notable is that it may be exploited

wirelessly. It does not require any user interaction and essentially leads to a full system

compromise. The bug was part of Apple's wireless direct link protocol or AWDL. This is the protocol

that iOS and macOS devices use, for example, for Airtrop. While fundamentally, it's basically

8.11, it is sort of Apple's own take on it to set up these ad hoc peer-to-peer networks.

And the attacker in this case would have to be able to essentially hit a particular

vulnerable device with a specially crafted AWL packet.

And what's really neat about this entire story is, first of all,

that Ian wrote this amazingly detailed blog post about it, but also that he went way beyond

actually just finding the flaw. We do have a lot of sort of wireless vulnerabilities like this, where researchers intentionally find the flaw. We do have a lot of wireless vulnerabilities like this where researchers

intentionally find the flaw, they are able to cause some software, maybe a system crash,

but that's where they stop. And if you're reading that blog post, you kind of understand why,

...