Hello, welcome to the Monday, December 21st, 2020 edition of the Sandcent Storm Center's Stormcast.

My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

This week and next week, of course, I hope many of you do get to take a couple days off and we'll have only three podcasts this week as well

as next week. So no podcast on Christmas Eve and Christmas Day as well as on New Year's Eve and

New Year's Day. Unless of course we have something interesting and new happening.

And with that, we're sort of playing a little bit on a summary about the Solar Winds event,

a little bit an update. If you have any specific questions about this event or anything that

you would like to have covered in more detail, please let us know,

and I expect we'll probably do something next week.

But well, just about a year ago, we did have the Citrix vulnerability keeping us busy over

New Year's, and Jan took a closer look at how organizations are

doing patching this vulnerability. Looks like we only got actually a couple hundred systems left

according to Shodan that are still vulnerable and who knows how many of them are actually honeypots.

So only 4.5% of the originally infected systems are still exposed, which actually is pretty good.

Of course, this vulnerability was pretty much exploited instantly, which made it a high priority item for people to fix. And in

some cases, at hackers who took over systems may have either patched a vulnerability or

turned the systems unreachable. And one neat feature of process explorer, which comes as part of CIS Internals, is the ability to have a binary that you find running, that you may consider suspicious, check with virus total.

So in this case, CIS internals does calculate a hash of the particular binary and then sends it off to Virus Total.

Sadly, it looks like the last couple days that this functionality is not working.

Maybe an issue here with Virus Total, maybe sort of a change in the API or such, but this appears to be more problem

with Virus Total than with Process Explorer at this point.

And often on, there is a lot of talk about the need of governments to intercept encrypted

...