Hello, welcome to the Friday, September 29th, 2017 edition of the Sands Internet Storm Center's Stormcast.

My name is Johannes Ulrich and I am recording from Baltimore, Maryland.

Well, I'm here in Baltimore teaching intrusion detection, so really fitting that Xavier today posted about how to analyze huge amounts

of PCAP data. One really interesting tool here is MoLock. Moloch is a database that collects

essentially PCAP data and then makes it available via an elastic search database. It also

implements a real neat and slick web front end. Xavier shows how to install these

components really quickly using a Docker container and then goes over some of the

features of Moloch.

So we'll create weekend project and of course a hat tip to William Saluski, the person behind Moloch.

And CyberArk found an interesting vulnerability that can be used to bypass Windows Defender and possibly other anti-malware systems as

well. They call it illusion gap and it relies on the victim downloading the malicious file

from an SMB file share. The problem here is that initially the victim will download the file using a process on the system.

Creating that process does trigger antivirus to then check on the file, which triggers an additional request from the antivirus software to the file share in order to download and inspect the file.

Illusion gap relies on identifying whether or not a request was initiated by a process the

user started or by anti-malware.

Whenever the user downloads the file, the malicious file is served.

If anti-malware downloads the file, then a benign file is served, essentially

confusing anti-malware and allowing the particular file to run. Now, CyberArk did notify Microsoft

about this issue. The problem here is that Microsoft doesn't really see it as a big problem because in order

to download the file from this particular SMB server, the user first has to trust and

connect to that SMB share, which triggers a number of pop-ups. This could not be exploited by

uploading this file on a share. user already trusts, because in order to switch the file, the attacker actually has to swap out the SMB server used to serve the files.

...