Hello, welcome to the Monday, July 18th, 2016 edition of the San Center and Storm Center's Stormcast.

My name is Johannes Ulrich and I'm recording from Minneapolis, Minnesota.

Did he a while ago posted a Yara rule that allows you to find any PE files that are using Pi installer.

Pi installer being a tool that can be used to run Python scripts as standalone code on Windows systems.

Now of course this is also used by Benign software, but the DDA found additional examples of Malware that were essentially just written in Python and

then wrapped with Pynstaller in order to launch them. In case you're using his Yara rule,

make sure that you're looking for false positives. But if you find something interesting,

please let us know. DDA would like to look at a couple more malware samples that are using installer.

And Juniper announced a rather serious vulnerabilities in its IPSEC implementation.

When you're using digital certificates in order to authenticate users, one thing of course

it has to be made sure is that the certificate is signed by a trusted certificate authority

and this is not being done properly.

Instead, it just looks whether or not the name of the certificate authority matches.

It does not verify whether or not an actual authorized key was used to sign the certificate.

So what should happen is if a user tries to log in to your VPN and the user presents a certificate to authenticate itself.

The VPN server should now verify the signature of that certificate using the actual

certificate of a trusted certificate authority.

Well, instead it just checks whether or not the name that's mentioned in the certificate that's presented by the user matches one of the trusted set of authorities.

So there is no actual cryptographic match done, just a simple string comparison of the name that's claimed to have signed the certificate authority.

And of course, anybody can come up with a certificate, with any name, and then sign a certificate.

So this essentially invalidates the access control on these VPN implementations.

Juniper released an update for JunoS and they also did release a workaround.

...