Hello, welcome to the Monday, March 25th, 2019 edition of the Sansonet Storm Center's Stormcast.

My name is Johannes Ulrich, and I'm recording from Madrid, Spain.

We got a couple of nice diaries this weekend.

Actually, my favorite was probably the one from Friday by Remko, where he talked about

reverse analyzing malware written in Go. Go is Google's programming language, and it has become

quite popular, mostly, I think, for network software, because it has quite nice networking capabilities,

but also has some fairly easy and lightweight threats,

which of course is always nice if you, for example, want to write a server

that's able to deal with multiple connections.

Remco is going through some of the initial steps in getting started with Go language. For example, because the

binaries are all statically linked, they tend to be quite large, so they're usually compressed

and going forward how to then decompile some of the Go code. And then we got two diaries by

D.D. One actually deals with some malware that uses the Velvet of the Go Code. And then we got two diaries by DD.

One actually deals with some malware that uses the Velvet Sweatshop password. If you remember, this was something we wrote about last year, that old Word documents

used that password as of a default encryption password.

So if you encrypt current Word documents with this password, they're automatically decrypted by Word, but still in some cases may sneak past antivirus. And the second diary by the DA gives you a quick Python script to read QR codes.

This is useful for some of the recent extortion emails that are using QR codes in order to communicate the Bitcoin address.

And then, of course, some filters that you set up to find Bitcoin addresses, well, they may not trigger.

And this weekend we had yet another edition of the Pone to Own Hacking Contest, and yet again,

pretty much all software being presented to the teams did fall.

They developed exploits against Firefox, Safari, Microsoft Edge, Windows 10, Virtual Box, and

VMware. First time this time, they also had a Tesla car available for hacking, and yes,

...