Hello and welcome to the Monday, April 24, 2020, 3 edition of the Sansonet Storm Center's

Stormcast. My name is Johannes Ulrich and the name I'm recording from Jacksonville, Florida.

Manuel this weekend published a quick summary of demarc policies within the Columbian top-level domain.

The overall frequencies here are probably somewhat below what we have seen in other

top-level domains.

What surprised me is that the com.com.co domain, so basically the commercial businesses, is sort of what I would expect, like 8.75%,

but government domains are significantly less coming in at a little bit less than 1%. If anything,

you would think that government domains are more likely going to implement DMARC,

but this may also be part of the different sort of regulatory environment in Colombia.

This particular diary is also published in English as well as Spanish.

And one of the big revelations that I talked about on Friday about the 3CX compromise was

that Mandjand found out that the actual compromise started with a 3CX user installing

X-trader trading application on a home PC. This X-Trader application apparently was compromise, and then

the access provided by X-Trader was leveraged to further compromise 3CX. Not a big surprise, but

Symantec now came forward stating that, well, X-Trader has been an issue beyond

3CX. There are other companies that are likely compromised here. One interesting issue

that Symantec points out is that X-trader is in particular useful for futures trading, in particular energy futures, and they suspect that

it may have been used to breach some critical infrastructure companies. I just want to say again

thanks to 3CX and Mannion for being so forthcoming and making these things public, because as you can see, it helps others directly protect themselves.

And car hacking via the Canbus appears to become more and more mainstream, with now a number of YouTube videos, and so giving at least demonstrations in some cases more tutorials about

how to perform these hacks. What they all have in common is that the attacker will connect

a device directly to the Canbus. This is essentially the network that's being used within

...