Hello, welcome to the Friday, November 8th, 2019 edition of the Sands and its Storms on a Stormcast.

My name is Johannes Ulrich, Entertainment recording from Jacksonville, Florida.

Adobe released an update for its mobile software development kit that does fix a problem with how the software development kit was connecting to Adobe's

cloud services by default. The problem here was a default configuration that shipped with

the SDK and this default configuration did not use TLS.

It's actually not uncommon that in developed environments, TLS is not used.

Not necessarily a great idea, but then of course you should adjust the configuration when you're moving applications live,

which here apparently often didn't happen.

So Adobe now release an update with more secure default settings for its SDK.

Still, if you use this SDK or any other SDK, always verify the settings and make sure they're appropriate for your application.

And QNAP continues to have issues getting rid of the QSnatch malware that takes advantage of

vulnerabilities, but also weak configurations like weak username and password combinations in QNAP's network storage devices.

Yes, I'll say it again, you should not connect them directly to the internet, but still QNAP

has some decent advice here. First of all, you should keep the software updated on these devices.

And then they also now have a security counselor, which they just updated, that will walk you

through some of your configuration choices, as well as a malware remover that you can use

to essentially check and remove commonly seen malware that specifically does attack

the QNAP device. It's a little bit different from a generic antivirus check-in that it specifically

looks for malware that's known to attack the QNAP device. KNAP's latest advisory that was released last week has some decent first steps to make sure

that your QNAP network accessible storage device is reasonably secure.

And TrustWaves Spider-Lab came across an interesting use of malformed SIP files.

Now this is not an uncommon trick where an attacker is creating a file that appears to be invalid.

...