Hello, welcome to the Friday, March 8, 2019 edition of the Sandsenet Storm Center's Stormcast. My name is Johannes Ulrich,

and today I'm recording from San Francisco, California. Thanks, first of all, to everybody who showed up

to the RSA keynote panel today with Alan Hether and myself.

There is a full recording of the panel available on the RSA website.

It typically also release it to YouTube relatively soon after the conference.

Ed talked about some of the attacks against DNS management consoles,

also how DNS fronning is still used in particular in attacks within cloud providers

and from one cloud provider to another.

Heather talked about some of the risks that you're exposing yourself with all the personal information that's available about you from various cloud providers.

Now, my part was, first of all, about some of the issues with DNS over HTTP, and then also what I sort of tend to call peripheral hardware issues like for example how

BMCs are being used as a beachhead in breaches and also how there's a lot of attention being

spent now to actually create viable exploits against Wi-Fi controllers and also renewed interest in Thunderbolt issues.

So for the details, just refer to the RSA video and I'll link to it in the show notes.

But while I was here in San Francisco, Xavier actually posted a pretty nice diary about disposable email addresses.

Now, disposable email addresses do have a legitimate reason to exist in particular for privacy, but of course, often bad guys also like to use these email addresses for data infiltrations and for command and control.

So Xavier compiled a list of all of these disposable email providers that he came across and he published it on GitHub.

So you can use it to plug it into your SIM to figure out if any of the outbound

communication that you see to these email providers has suspicious content. And storage

system provider Netab is joining the crowd of companies that released devices with default accounts that were not documented.

Netab released updated firmware that will remove this particular account.

This was a default account that would allow arbitrary command execution,

and a large number of NetAps devices are affected by this problem.

...