Hello, welcome to the Friday, June 17, 2020 edition of the Sands and at Storm Center's

Stormcast. My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

The diary today by Xavier about the Houdini backdoor. Houdini is an old, old back door going back to 2013, but apparently still interesting

enough to be used, and the version that Xavier found was delivered via a JavaScript dropper.

This JavaScript dropper was obfuscated in interesting ways, which Xavier walks you through

how to decode particular obfuscation. In particular, most of the code was actually not used and really

just inserted to confuse analysis of the particular script.

So if you're running into JavaScript like this, you may find Xavier's post.

Usefully also posts the IP address of the command and control server being used here.

Now, one type of vulnerability I try to focus on here in these podcasts is always when we're dealing with

vulnerabilities in perimeter security devices like firewalls and the like and turns out they

are quite often exploited in particular by more sophisticated adversary.

You have an interesting blog post by Walexity. Wlexity took a look at a recent

vulnerability in the Saffos firewall. Sophorst did publish an advisory on March 25th,

describing a remote code execution vulnerability, but Walexis states that they have actually seen exploitation as

soon as March 8th. So about two weeks before the actual vulnerability was made public by

Sophos. Great right up here by Well, Lexity discussing all the different things that the attacker

did and how they may have used this particular vulnerability. Great right up here by Well, like City discussing all the different things that the attacker did

and how they may have used this particular vulnerability in order to gain access to the firewall.

Once having access to the firewall, they then use that access to a play machine in the middle

and modify and breach other systems.

The Zero Day initiative provides us with an interesting write-up created by a researcher who found

...