Hello, welcome to the Friday, July 15th, 2016 edition of the Sands and Storm Center's Stormcast.

My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

Xavier today wrote about web shells and how they evolved and what great features you find today in web shells.

Now, web shells are typically uploaded by NetHacker that tries to get persistent access to a web server,

typically via a web application vulnerability.

So the attacker would find a way to upload a file to the server and then they would upload one of these web shells in order to then

have an easier time executing arbitrary commands and as Xavier shows with his screenshots,

these web shells are quite sophisticated and make it pretty easy then to take over a server.

And apparently in India, the large ISP Airtel has started intercepting traffic for the Pirate Bay.

Now, Pirate Bay does use Cloudflare as their proxy service.

So if you are connecting to the Pirate Bay, you're doing so via servers that are operated by Cloudflare.

And apparently Airtel did intercept all traffic to these servers.

Initially, it was a little bit suspect because the Pirate Bay does offer HTTP, but it does appear that only the

HTTP copy of the traffic is being intercepted. And this is exactly the reason why you do need,

for example, strict transport security that advertises your site as HTTP only. And of course, you need to implement keypinning in order to prevent these kinds of attacks from succeeding.

Now there hasn't been a clear statement as to why they started off a sudden blocking the pirate bay but of course the pirate bay has been in the crosshairs of various anti-piracy groups for a while,

so it's not a big surprise.

And in India, many sides have been blocked in the past without really explaining why.

In this particular case, if you're trying to go to the Pirate Bay.org from one of the ISPs that routes via Airtel, you would just see an empty page with a quick note that access to the site has been blocked.

And since I yesterday talked about vulnerabilities in Triple plugins, only fair that I mentioned today's word press plugin problem it

affects the SEO pack plugin that's the search engine optimization pack

plugin it does manifest itself in a persistent cross-site scripting attack

...