Hello, welcome to the April 24th, 2017 edition of the Sansonet Storm Center's Stormcast. My name is Johannes Ulrich Entertainment recording from Jacksonville, Florida.

Jim Glossing this weekend detected an uptick in Port 81 traffic in our firewall locks. Well, I set up a honeypot and the only thing I get, but I get a steady stream of that is

invalid HTTP requests.

They all start with get, then a new line, then login.cgi.

All the servers that I have to write so far will respond with an error message, even things like mini-HTP, which typically is fairly resilient and accepting some invalid HTTP requests.

Best I can tell so far, it's probably a fingerprint attempt, but if you are seeing this data leave your network,

I would appreciate a note to see where it's originating from.

And Didy looked at a Word document that exploited the recent CVE 2017-199 exploit.

This is this famous HTA exploit that was already exploited before a patch was released.

Of course, the last couple of weeks, it has really taken off and sort of hit the mainstream

because it's a relatively easy exploit to execute.

Well, the DA will show you how to analyze these documents.

It was about a week ago that we learned about Eternal Plu and Double Pulsar, the NSA exploit and

the back door that goes with it. Now, at the same time, there was also a detection script that was released

for double pulsar because hosts infected with that backdoor will respond slightly different

for SMB pinks. Well, there have been now a couple of surveys off the internet to see how many systems are infected with double pulsar.

Turns out the number was surprisingly large.

Tens of thousands of systems, the exact numbers vary from survey to survey.

But of course, there is no telling when they got infected. These surveys

that were done late last week, so the bad guys had about a week to infect systems with

these exploits, so not all of these systems were necessarily infected by the NSA originally.

And apparently, in video with some of its latest Windows drivers, did also install Node.js.

...