Hello, welcome to the Friday, September 28th, 2018 edition of the Sands and its Storm Center's Stormcast. My name is Johannes O'Rourich, and I'm recording from Las Vegas, Nevada.

If you're looking for something to play with this weekend, Renato gave you a nice little toy here, and that's Python code. It helps you to enrich the

output of Radair 2 and X64 debug with decoded strings. So the problem he had was he had a

pretty massive piece of malware that he wanted to reverse engineer. Now this piece of malware had a lot of encoded

strings, simple X or algorithm, but essentially what he wanted to do is decode the strings and then

insert them back into the disassembly output. So this way he had the strings where they were originally located in the binary and then of course by decoding them he immediately was able to recognize where which string was being used.

Pretty neat trick and a neat little piece of Python code that Renato is sharing here with our readers.

And Duo Security took a closer look at Apple's device enrollment program or DEP.

This is essentially what Apple uses for all of its different operating systems, whether that's

TVOS, iOS or MacOS,

in order to allow companies to more or less automatically add devices to their mobile device

management platform.

The neat thing kind of about this particular protocol is that the user doesn't really have

to do anything if the user doesn't really have to do anything. If the user

receives a device whose serial number is registered for a particular company, the device will

automatically enroll itself in the mobile device management program using DEP. And that's

sort of where the first problem lies in order to check if a device

needs to connect to a particular mobile device management system. All you need is the device's

serial number. What you get back is the device's activation record. Now, you may argue there

isn't really that much in this record,

essentially the URL, where to enroll, and a little bit information about the company. So,

for example, company name, address, phone numbers, and some email addresses. However,

...