Hello, welcome to the Tuesday, March 19th, 2019 edition of the Sansand-Storm Center's Stormcast. My name is Johannes Ulrich. And today I'm recording well still from a yet-to-be-disclosed location at one submission so far that got actually pretty close.

Well, to start out with, today we got a new version of Patti, the favorite Windows

ZH client.

This update fixes four vulnerabilities, two of which actually could trigger buffer overflows

if you're connecting to a malicious server.

There's another kind of interesting vulnerability where if you are running Puddy from a directory

that also contains a malicious Windows help, so one of those CHM files, that could also lead

to code execution. And as the update points out, this is, for example, very possible

if you are running Puddy directly from the download folder from your browser. Also interesting

about this, the vulnerabilities were disclosed via Hacker 1. The European Union actually started a bug bounty program a while ago I think I

mentioned it and funds essentially the hacker one part of this disclosure so even though

putty is free in open source software you can still get a bug bounty if you're finding vulnerabilities in it.

Well, the second vulnerability we have is actually initially sounded like nothing all that special

vulnerabilities in wireless keyboards. We have seen them a lot where essentially there's no

encryption being used or if the encryption is just a simple XOR.

So it was a little bit surprising to find a vulnerability in the Fujitsu keyboard that actually uses AS to encrypt keystrokes.

The problem here is not the usual sort of eavesdropping attack, but instead a key injection attack.

The problem is not with the keyboard, but with the USB receiver that comes with the keyboard.

This receiver will not just accept encrypted keystrokes from the authentic keyboard,

but if someone manages to create an unencrypted keystrokes from the authentic keyboard but if someone manages to create an

unencrypted keystroke signal that's accepted as well so really the encryption

is only optional and while the keyboard seems to implement it correctly anybody

...