Hello, welcome to the Friday, March 29th, 2019 edition of the Science and Internet Storm Center's Stormcast. My name is Johannes Ulrich, and today I'm recording from Madrid, Spain.

I keep saying one of the most useful log sources that you can get in your network that's actually also reasonably easy and cheap to get is DNS logs.

Now, typically you would get them from your DNS servers,

but either you don't run your own DNS server or you're having problems

enabling sufficient granular logging.

After all, doing full query logging can sometimes

be quite taxing on your name server. Also, if you're running Windows name servers, the log format

isn't that easily digested by your normal set of log analysis tools. So Xavier today has another option for you, and that is running your own passive DNS service.

Passive DNS service is essentially a sniffer that watches your network traffic for DNS queries and replies,

and then summarizes them, and with passive DNS, the tool that Xavier introduces

you here, you even have the option to create JSON formated output, which of course is ideal if you

then import the data into Elasticsearch in order to integrate it with your other security data.

The same of course is also true for Splunk, so that's the tool actually that Xavier is

discussing in his blog post. So take a look at his post if you are interested in any of the

details. And Cisco's small business routers RV320 are in the news again, and this time it's

certainly not good news. About a month ago, Cisco did patch a fairly simple web application

vulnerability in these routers that allowed remote code execution without authentication.

Well, it turns out that this patch was actually not a patch at all.

Instead, the only thing that the patch did was it did add a configuration option to the EngineX configuration. That's the web server running on these

routers that would block any user agent that contains curl. Of course, many proof of

concept exploits released for the vulnerability did use curl in order to launch the exploit,

but everybody, probably that listens to this podcast, knows it's

...