Hello, welcome to the Monday, August 21st, 2003 edition of the Santernet Storms' Stormcast. My name is Johannes Ulrich, and that I'm recording from Jacksonville, Florida.

Over the weekend, we got a quick malware analysis from Xavier. Xavier looked into a malicious email that claimed to come from Salando.

Salando is a German clothing, a shoe retailer,

and well, this particular malicious email did include a zip file.

Xavier is going over the de-obfuscation of the included code, which will somewhat predictable download additional files to the system, which then in the end turn out to be a remote access, toll, an older version of Net Support Manager.

Various total scores are reasonable but not great, even though this is nothing

really all that special. Five out of the 71 undervirus engines in VirusTotal are recognizing

this particular file as malicious. Xavier also includes the domain name used by the command

and control server.

In popular Windows file compression utility, Winrarr patched a vulnerability that could lead

to arbitrary code execution. The vulnerability was reported via the Saraday initiative,

a user by the handle of Goodbye Eslane, if I pronounce it correctly, has a report and found this vulnerability.

This vulnerability is triggered by the processing of recovery volumes with VINRAR.

Exploitation, of course, requires that a victim is opening a malicious file with VINRA. Exportation, of course, requires that a victim is opening a malicious file with Winrard.

Getting SPF records configured correctly isn't always easy in particular if you're dealing

with a very large domain where you have a large list of mail centers in particular, where you are sort

of delegating mail sending to other organizations and other domains.

And as an example, what happens?

Well, apparently hotmail this week and had some issues with its DNS SPF record.

One component that was including a large number of authorized mail servers was removed and as a result, many hotmail users reported that their email was marked as spam.

The issue was fixed late on Friday apparently, but of course with DNS sometimes taking

some time to propagate properly. There may be a delay in the fix actually being registered

...