Hello, welcome to the Friday, June 9, 2023 edition of the Sansonet Storm Center's Stormcast. My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

Today I wrote a quick diary about some scans that we are seeing targeting Geo Server.-server is an open-source Java-based piece of software

that allows you to organize geospatial data.

It offers the typical sort of Tomcat-based GUI in order to allow you to upload and access

and search data.

You have seen scans from one IP address in particular, a Russian IP address,

but also some researchers, like for example Shadow Server,

are looking for GeoServer instances deployed in the wild.

GeoServer has had last year a significant vulnerability that allows

a remote code execution without any authentication. I have set up a full honeypot for GeoServer,

but after I set it up, well, haven't seen any new scans yet.

So if there is anything coming, well, maybe next week we'll have more details.

If anybody has seen any actual attacks other than scanning, please let me know.

And I've mentioned a couple times in the last two weeks or so about a vulnerability in Barakuta's email security gateway. This vulnerability apparently had been exploited starting October last year, became

publicly known mid-May, and then Barakuda also released a patch for the vulnerability. However, until then, of course, several of the devices had been compromised.

And Barakuta now made the somewhat unusual announcement to recommend affected customers to replace their email security gateway.

So if you believe that your gateway was compromised, you should replace the actual hardware or the virtual appliance. If it was virtual, that's probably easier. No word as to how this will sort of work, like the mechanics of it, in particular for the physical devices. If this is sort of a support warranty action, probably call

barracuda if you have a support contract with them and inquire on details.

And several tech news outlets have reported that Google is going to add biometric authentication

to its desktop password manager that is included in Google Chrome.

Biometrics has existed for the iOS and Android version of the password manager, but so far not for the built-in version in Google Chrome on the desktop,

probably trying to better be able to compete

...