Hello and welcome to the Monday, July 24, 2023 edition of the Sansonet Storm Center's Stormcast.

My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

In our data, I think we are now tracking about 30 different researchers, as we call them, organizations that are

scanning the internet for open ports, vulnerable systems, for research purposes, or to provide

data to customers. Well, the granddaddy of all of these systems, probably the most well-known one at this point, is shodan.io, and we have another blog about how to actually utilize the data.

Rob shows a quick example about how to inspect particular IP address using the Shodan API and how to get all kinds of information about that

IP address.

This is really helpful to look at your internal exposure.

And what's often also referred to as attack surface management, of course, some of the

other Shodan competitors and such also offer products around this type of data.

Now, Rob goes beyond some of the little and simple parts, the API, but also shows how you can

then further drill down into the data.

For example, if there is exposed RDP services, you can even get screenshots

and the like, which wouldn't necessarily replace sort of your own reconnaissance scans as part of

a penetration test or vulnerability assessment, but certainly it's a good part of it and, of course,

much faster in particular if you're looking at a larger network.

And cloud security company Whiz wrote a blog post diving a little bit deeper into what may have happened with Microsoft's Azure Active Directory signing key that was compromised led to the compromise of several Outlook 365 inboxes.

What they concluded was that it probably did not just affect Outlook 365. It may have affected other Microsoft application.

Hard to verify what's in the blog post. Of course, they're not having access to sort of any

internal logs or such at Microsoft. However, they are referring to the documentation provided by Microsoft,

as well as to some of the details like key fingerprints and such, being noted by Microsoft

in their disclosure. They also conclude that the problem was limited to multi-tenant applications.

...