Hello, welcome to the Monday, August 7, 2020, 23 edition of the Sandsenert Storm Center's Stormcast.

My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

Savier took a look at whether or not credentials found in these league credential dumps are actually being used by

attackers. And, well, it turns out, yes, they are. In order to investigate, Xavier took a look

at his own mail server and looked at any rejected logins that showed up in some of these recent credential dumps that Xavier collected.

So this is not the complete, I think now 12 billion long list from like have I been poined, but a smaller list that Xavier looked at.

It wasn't, as he pointed out, a super high quality list either,

but, well, attackers, they grab what they can find and give it a try and sometimes it

apparently works for them. But the lesson for the defender here is that you really have to be

proactive about these leaked credentials and check if you do find some of these credential dumps whether any of your users are included and if so double check that these credentials are not used in any of your systems.

And if you're using the paper cut print management software BMAIR, there is another vulnerability

out there that can lead to a remote code execution.

Similar to prior vulnerabilities in Papercut, this is a file upload vulnerability that then

leads to remote code execution. Essentially,

the attacker can sort of upload a web shell. According to Horizon 3 who found this vulnerability,

exploitation of this new vulnerability is more complex, so we may have more time until a public working exploit is out there. Horizon 3 does

not really provide any details here, so they're not helping the attackers with any details

how to exploit this new vulnerability. The CVE for the new vulnerability is 2023-39-143. The old vulnerability that has widely

been exploited is 2023-27-350. And again, given that history, it's likely that we'll see some exploitation

for this new vulnerability in the near future.

So that's why you probably should prioritize patching paper cut.

And Microsoft fixed, I should say fixed again, vulnerability in its power platform.

...