Hello, welcome to the Monday, March 16th, 2020 edition of the Sansard Storms, Stormcast.

My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

Well, DDI came across an interesting PDF, and if you know anything about DDI, you probably know what's coming next.

He's going to use some Python scripts to take

the PDF apart. What was kind of interesting about this PDF was that it used incremental updates.

In PDFs, when you make a change to the PDF, the change can actually be recorded as an incremental

update. So when you're retrieving the PDF and look at the viewer, you're seeing the new version of the PDF.

But when you're looking at the actual source of the PDF, you're seeing the original PDF and then an appendix essentially with the modification.

This is typically not what a Malware author wants,

because if the original PDF remains unchanged, then of course any anti-malivar signature

and so will probably still recognize the original PDF. Also, in this case, because the attacker

apparently did this a few times,

we sort of get a nice change history of various attacks, various campaigns, that essentially

used the same document with some minor changes. Same also applies to the metadata of the document, so we exactly know the timestamps,

for example, when the PDF was modified. Well, it's actually sort of interesting about the

timestamp was that it used UTC time zone of minus eight hours, which turns out to be the Pitcairn islands that are in this time zone.

And this island is famous for being apparently the island where the bounty mutineers stranded.

So I guess mutineering no longer really pays the bills, so they're switching now to attacking with PDFs versus bullets and cannons.

And one issue that keeps coming up with the COVID-19 crisis going on is VPN access, of course.

Everybody's trying to work from home, trying to do so securely,

and to use VPN to connect back to company resources is the standard way of sort of solving

that security challenge. There's one problem with this, that VPNs have a limited capacity.

...