Hello, welcome to the Friday, November 6, 2020 edition of the Sansonet Storm Center's Stormcast.

My name is Johannes Ulrich and I'm recording from Jacksonville, Florida.

Interesting post from Xavier today with an interesting lesson the obfuscating PowerShell code in particular,

trying to spot the Invoke expression command.

Invoke expression, roughly equivalent to Eval in JavaScript or exec in Python, is a PowerShell

command that can be used to execute commands represented in a string.

Now, this of course is often used in obfuscation techniques,

so spotting invoke expression is often a good sign

that you're dealing with malicious power shell code.

But because this is such a popular signature, the Invoke Expression Command itself

is often obfuscated. So Xavier is going over soft techniques that attackers are using to

accomplish this and make it more difficult to spot this particular command.

So if you're dealing with malicious PowerShell script,

nice little exercise here for you to go over these different off-your-scation techniques.

Well, Apple today released updates for everything for iOS, iPadOS, WatchOS, Mac OS, and probably also TVOS.

I have to double check. I haven't noticed that coming along yet.

But that's very typical, of course, for Apple because these operating systems share so much code, they're often affected by the same vulnerabilities.

Of note are three vulnerabilities in iOS that apparently are already being actively exploited in the wild.

And I think the set of vulnerabilities is also interesting because it's really sort of a neat little exploit chain that you have there. First, we have a vulnerability in Apple's font parser that can be exploited to execute arbitrary code. So that's how an attacker would attempt to originally get access to the phone

by sending a message or something with a malicious font. Next, we have a vulnerability that is closest

kernel memory. That's often used to bypass certain anti-exploit protection. And lastly, there is a

vulnerability that provides a malicious application with the ability to run arbitrary code with

...