Hello, welcome to the Monday, August 21st, 2017 edition of the Sands and its Storms anders Stormcast.

My name is Johannes Ulrich, and the day I'm recording from Virginia Beach, Virginia.

Renato looked at another interesting piece of banking malware.

In this particular case, actually, it goes beyond standard banking malware.

Usually banking malware is looking into stealing credentials, and definitely this banking

matter does so via an HTTP proxy that it installs on the user's system. So sort of a man in a

browser, man in the machine kind of setup that then allows the attacker to capture user names, passwords, and any one-time password tokens.

But in addition to that, this particular malware also installs remote access Trojan to essentially give the attacker full control over the system.

It does also steal additional credentials, like for example TV access credentials and a couple of other things that it happens to find on the system.

So in that sense, one of the more traditional Trojans banking

matter, which we still have quite a bit around. So with all the attention being paid to crypto

ransomware, there's still quite a bit of the more traditional info stealer, credential stealer, and banking malware out there.

And the second piece of malware from this weekend was one that Did he looked at. It's one of

these fake invoice messages that keep popping up from time to time. Kind of interesting in this

case was a Bay 64 encoded PowerShell script,

and as usual, D.E walks you through decoding these scripts. So if you ever run into this

yourself, you can replicate what they did here and decode whatever hit your users.

Starting, I believe, with the iPhone 5S, Apple started including a secure enclave with its iOS devices.

This secure enclave is a special separate CPU that is used to deal with secrets that are stored, for example, to lock the phone and also to

encrypt, decrypt data on the phone. The firmer running within that secure enclave is

encrypted itself as well. Now, as of Thursday, the encryption key that is used to encrypt that firmware has been leaked.

Now, this is not necessarily a huge deal with this encryption key.

...