Hello, welcome to the Friday, May 12th, 2017 edition of the Sands and its Storm Center's Stormcast. My name is Johannes Ulrich,

and the I'm recording from San Diego, California. If you're wondering what the Rick Exploid kit is about,

Brad has a little update here. He's observing it, installing the Ramnet Trojan lately. Now, it's your typical

infection in that it starts out by visiting a compromised website that then redirects you to the

URL that Cisco calls the seamless campaign, which will then attempt to use the exploit kit in order to install the Ramnet Trojan.

As usual, Brad does provide full packet captures of an infected system as well as various indicators of compromise.

His advice is keep your systems patched and you should probably

be okay. But well, it doesn't always take Malver to have problematic software on your system.

The latest example is software that was found initially on some HP laptops, but apparently does also

affect a number of other manufacturers. The problem here is an audio driver. Now, this audio

driver was written by Connexent. Connexent is a company that makes a lot of the audio processing chips that you do find in modern computers,

and this driver was developed by Connection for its hardware. But turns out that this driver does a lot more than just process audio signals.

It also records all keystrokes that a user types into a log file in the clear.

This log file appears to be available, world readable, on the system.

Now at this point, there is no evidence that these logs are being exfiltrated to a remote system.

Whenever the user logs in again into this laptop

and it's usually laptops where you find these audio drivers,

the log is overwritten and started with a new log.

But still, anybody that has access to the system

has access to the log, which of course does contain usernames and passwords.

So it could easily be used to escalate privileges, could also be used to pivot to other systems to which the user has access.

Overall, the scope is really not quite clear yet from what have I've seen,

...