Hello, welcome to the Friday, September 2, 2016 edition of the Sansonet Storm Center's Stormcast. My name is Johannes Ulrich and if I'm recording from Jacksonville, Florida.

Apparently, Malware authors are now using Max Mine's geolocation service in order to figure out if they may have gotten into a researcher's sandbox

or in a geographic area they would like not to do business with.

You have seen this in the past, for example, with Russian malware that tries to avoid

Russian targets in order to avoid running afoul of any Russian laws.

But also with MaxMite, you don't just get geolocation, you also get more details about the ISP.

So for example, if it's running on a cloud system, you probably know that it's not an end user that is running your malware.

Well, it mixed what I see here in my own investigation.

A lot of malware doesn't seem to care.

But then again, if you have something a little bit more special and targeted, they usually do take precautions not to run in

sandboxes or researchers' machines. Content security policy is one of those security features

I'm really struggling with, trying to figure out how to best deploy and get the best value

out of it. Google now did publish an

interesting paper looking at content security policy, how it's used in the wild, and it gives

some decent really hints in how to deploy content security policy correctly. One of the problems I always run into with content security policy correctly.

One of the problems I always run into with content security policy is in an existing large website, like the internet storms on our website.

It's really hard to sort of in hindsight limit what kind of JavaScript, what kind of

style sheets and such you're using in your application, particular

with inline JavaScript and inline styles.

Probably inline styles being more of a problem for me here personally than JavaScript.

Google found in its own enumeration of content security policies that over 94% of policies

are bypassable in part because they do things like specify an unsafe in line source and

...