Hello, welcome to the Monday, December 7th, 2020 edition of the Sandcent Storm Center's Stormcast. My name is Johannes Ulrich,

and I'm recording from Jacksonville, Florida. And I'm done teaching in Europe, at least virtually, next class.

Well, a week from today again virtually online and well the sort

of virtual location will be Washington DC I'll be teaching the defending web

education security class at a CDI nothing terribly exciting in Diaries today.

One scanner for proxy servers by GE, seeing a ton of these scans, usually going actually

for a more common domain, something like Google or Yahoo or such, to see if they can connect to that site.

In this case, they looked for a very specific custom host name, which may indicate that they even

encode the IP address or such as part of the host name.

Of course the goal here is for the attacker to then use the proxy if available in order

to launch additional attacks.

And you may have done it before or maybe you saw others doing it and that's where you pixelate certain parts of a document

as you publish it in order to protect, for example, a password.

And typically, a human is not able to read that hidden word, but turns out that there is still enough information

left to properly recover whatever was typed. There is a new little script now written

by Sipke Milama, and Sipke here came up with a Python script that essentially uses the fact the algorithm that all these tools use in order to pixelate text.

First of all, they're not really creating black and white pixels.

They're creating various shades of gray, which of course then holds some information about the original text.

And while the recovered image isn't perfect, it's usually close enough where you at least have a pretty good idea what the original text was.

The script has been published on GitHub, so you can experiment with this and see if maybe any

documents that you published with pixelated content can be reversed.

And then we got a very brief but potentially interesting vulnerability announcement from the Apache Tomcat project.

...