Hello, welcome to the Monday, January 16th, 2017 edition of the Sansonet Storm Center's Stormcast. My name is Johannes Ulrich, and the time recording from Brussels, Belgium.

Xavier wrote on Friday about backup files on web servers. Now, backup files, as he points out, are a good thing as long as they are outside your

document route. And the reason he wrote about it is that he's seeing recently a lot of scans

for common backup file names against his web applications. And yes, while this is not new and

cutting edge in any way, it's one of those

simple operational issues that's often overlooked. Now, while we're talking about simple operational

issues that aren't new but still being exploited in Apache, you often find the server status

page still enabled. That feature does list recent connections to the Apache server,

and with that, of course, you often leak confidential URLs. A new very simple tool illustrates

that hackers certainly are still looking for server status pages. This tool just keeps polling

the server status page, extract tool just keeps polling the server status page,

extracts all URLs, and then creates a SQLite database that, of course, can be used,

for example, as an input for a vulnerability scanner to further exploit any URLs that are being

found via that method. And last week there was a big article in The Guardian

about a possible weakness in the encryption of WhatsApp. Now, WhatsApp uses the same protocol as

Signal. And of course, both tools are heavily used by individuals who are trying to hide their conversations from governments.

Turns out that this particular weakness actually was discovered and discussed first back in

April 2016, so a little bit less than a year ago. And it's really more a design compromise in the application than

a back door. The problem, of course, with all of these crypto applications is how do you

initially verify that you're talking to the right person at first contact when you are receiving

whatever public key certificate or so is used to verify the sender. Now, SSL

user certificate authorities. We talked a lot about how that doesn't work. With WhatsApp, you

...