Hello, welcome to the Monday, August 3, 2020 edition of the Sansonet Storm and Stormers Stormcast.

My name is Johannes Ulrich, and then I'm recording from Jacksonville, Florida.

Jan took a look at what pages are being hit on his web server if he adds a certain very popular among bot pages to his Robots. Text file.

Robots. Text, of course, is supposed to prevent good bots from searching and indexing those

pages. But, well, this way he sort of is able to essentially identify the bad bots.

So anything but your Google and other search engines.

No surprise, WordPress is right up there.

Now, I stopped sort of mentioning all the different WordPress mobile and abilities in particular in plugins.

Jan's results also confirm another observation that I had. It's not the missing patches that it usually get you with

these web applications. It's the weak passwords. The top hit is usually towards login pages, and that's what we see here with Jan's result.

Over the weekend, I actually took a close look at our honeypots to see if we can detect any

Cisco exploits. Remember, Cisco last week had this fairly easy to exploit directory traversal vulnerability.

Well, I imulated the respective Cisco VPN gateway and haven't really seen any exploit attempts,

but what I keep seeing is attempts to log in with weak, well-known passwords. So keep that in mind. It's not just about

updating and applying patches. It's also a lot about configuring these devices correctly and monitoring

them so you're able to detect unusual logins as they occur.

Now, talking about some patches that you may want to apply if you're using KeyPass with

KeyPass RPC, well, you should update immediately and the reason being that KeyPassRPC does

essentially allow any website access to all of your passwords.

Now, first of all, not all KeyPass users have KeyPass RPC installed. It's an optional add-on

that you only need in certain browser configurations to better integrate key pass with your browser.

The problem here is that the browser extension has to authenticate to key pass, the binary.

...