Hello, welcome to the Friday, September 1st, 2003 edition of the Sansonet Storms, Stormcast. My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

Today, Jan looks at why do we see so many of these simple fishing attacks? And well, the quick answer here,

it's just really easy to pull them off and cheap in doing so. So an attacker doesn't really need

a huge success rate in order to make these attacks work. The sample here was a simple HTML

page. It does, of course, use some obfuscation.

And the victim is directed into opening the HTML page thinking it's an audio file and it's

displaying then a Microsoft login page and stealing credentials. So really easy to pull off. You can probably copy 99% of the

code for a page like this from a prior email that you received and the attacker will get a couple

of passwords probably which is sufficient to make the attack worthwhile given how easy it is to pull off.

And Palo Alto Networks has a blog post describing an interesting attack against GitHub actions.

The problem here is how GitHub deals with action pins.

An action is pinned if only a very specific version of the action is being executed,

meaning a cryptographic hash is first verified that only this particular version of the action is being used.

If later a malicious actor would update the action while a death version would not get

executed. The problem, however, is that there are a couple different ways in Palo Alto goes over

the different methods that can be used here, how one action may include another action. And of course,

you don't need to change the action itself if one of

those dependencies can be altered and with that malicious code could later be inserted into the action.

Interesting concept, not really sure how to fix this, but of course, this is one of the big problems that

people are struggling with when they're dealing with supply chain security, trying to work out

all of these dependencies of dependencies.

And last few days, I've seen a number of references to work done by Rapid 7 regarding attacks against

...