Hello, welcome to the Monday, August 23, 2021 edition of the Santernet Storm Center's Stormcast. My name is Johannes Ulrich and I'm recording from Stockholm, Germany, but virtually teaching in London, England.

This weekend, we had some malware analysis tricks from Xavier. First of all, how to wait for a command

control server that's not readily available. I've seen this happen sometimes where a malware

campaign is getting too successful and the command control server is overwhelmed with requests. Sometimes, of course, these command

control servers also shut down and it takes a while for them to show up at, for example, a different

IP address. So Xavier is going over how to patch the malware to continue to wait and attempt to connect

to a particular command control

server in order to figure out how the malware exactly works.

And in a second Malware related Diary DDE is presenting a Word document that included an executable.

This may be a little bit not very well thought through attempt at social engineering

to sort of bypass some of the issues that you have with visual basic macros.

That's of course still the preferred way to execute code, but users malvary analysis tools or malware protection

tools are of course pretty aware of this technique now. So here they tried a straight executable.

However, as did he experience, this does not actually appear to work in any reasonably new version of Office or Word.

It looks to the user like the user would open an Excel spreadsheet, but the Vert did recognize that it wasn't executable and prevent the user from launching it. So maybe a user

that really wants to get infected will be able to somehow save the executable in a separate file

and be able to execute it then, but wouldn't be as straightforward as just clicking on the

Excel logo in the VIRT document.

Recently, Microsoft released Windows 365. The idea of the product is to run a Windows 10 and

in the future a Windows 11 system in the cloud and no longer really have any Windows physical hardware to deal with.

The product has been quite popular, and Microsoft now released a security guide, or at least

a blog post, telling you about some of the security features of Windows 365.

...