Hello, welcome to the Monday, June 7th, 2021 edition of the Sandstone, Storm Center's Stormcast. My name is Johannes Ulrich. And today I'm recording from Jacksonville, Florida. Just to get us started, Jim noticed a couple of odd spikes lately on Port 37, in particular UDP.

Now, TCP did see some requests, some HTTP requests that looked like they were looking for

Ethereum wallets.

So if you have any insights there, if you know any Ethereum wallets that list on Port 37, then please let us know.

It would be interesting to figure out what attackers are actually looking for here.

And QNAP released another update for its products, this time affecting Video Station.

Video Station is typically used if you are connecting surveillance cameras to your QNAP device.

So the QNAP device here doesn't just store the videos.

It will also provide access to them, which is why often people do leave this feature exposed. Well, you never should do so, and a patch is

available now for this remote code execution vulnerability. No details in the advisory, whether or not

authentication is required. There is also a proof of concept that was released, but it's not really clear if it was

for this specific feature or if this is for a different vulnerability that hasn't really been

patched yet. The proof of concept does not refer to video station also doesn't list a CVE number,

which makes me think that this may be totally different or maybe not an issue at all.

Now I'm not going to link to this proof of concept because the write-up is a little bit weird

overall and a link to GitHub that

supposedly contains the code leads to a 404 page. Now GitHub just clarified their policy on

posting proof of concept code to its site. In the past, it was pretty open and you often found proof of concept code on GitHub,

but there have been a couple of instances lately where GitHub has removed exploit code

from its site.

What they now decided pretty much as their policy is that it will remain okay to post-exploit code

to get up unless it's being used in an active attack. The updated policy states that they

...