Hello, welcome to the Monday, August 8, 2016 edition of the Sansanet Storm Center's Stormcast.

My name is Johannes Ulrich, and I'm recording from Jackson, Florida.

D.D.D.A. has been writing a couple of diaries lately about malicious RTF files,

and in response to help him better analyze make it easier to

analyze these files he wrote a tool RTF dump on Saturday. DDA did publish a diary

with links to videos showing you how to use RTF dump so if you run malicious RTFs, take a look at his tool and at his videos and should be relatively straightforward to figure out if an RTF file is malicious and what exactly it's trying to accomplish.

And vulnerable peripherals are in the news again. This time it's trying to accomplish. And vulnerable peripherals are in the news again.

This time it's monitors, just like any other piece of hardware monitors do have firmware,

they do have memory and complex CPUs that can be exploited.

In a presentation at DefCon, an exploit was demonstrated that would use the firmware in a monitor to then alter what is displayed on the monitor.

Of course, you could also then read whatever data is sent to the monitor.

So lots of options here that could lead to a full system

compromise without necessarily hitting the actual desktop or a laptop, but instead the entire

code is in the monitor where, well, usual anti-malware and forensic software can't get to it.

Interesting exploit. Not sure I'm really that surprised that it's possible,

but of course we'll have to see how practical,

in particular remote exploitation of these vulnerabilities will be.

It will certainly be an attractive way for an attacker that

has admin access to a system to gain persistent access. And over the last few years, several

manufacturers came up with external USB drives that include a keypad that allows you to lock the drive using a pin.

Now of course four even eight digit pins are relatively easily brute forced

so essentially what these devices do to prevent brute forcing is that they add a delay whenever you do enter the wrong pin or they may eventually totally

...