Hello, welcome to the Monday, March 28th, 2020 edition of the Sandsenet Storm Center's Stormcast. My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

As a follow-up to one of Brad's Diaries, Xavier posted analysis of XLSB files.

This extension showed up in a quarkbot infection that Brad looked at,

and Xavier explains a little bit how to analyze these files

and the YNet hacker may choose to use an XLSB file.

Usual modern office documents are essentially compressed XML files, but there is an option

and that's what the B or binary in XLSB stands for to use a binary format. And that's exactly what happened here.

Of course, once you have your macros in this binary format,

then it gets more difficult to analyze them,

strings and similar tools will no longer really yield any results.

Xavier shows how sort of some of DDA's tools are actually analyzing these files.

And then recommends if you want something quick and dirty to look at these files, you're

probably best off just carefully, of course, opening the files in Excel and then just save the macros. Now, you don't need to enable

macros in order to do this. So yes, you can do this reasonably safe, but again, you know,

be careful whenever you open a known or suspected malicious file.

And Datadog published a blog post showing how the recently discovered dirty pipe Linux privilege escalation vulnerability can be used to break out of unprivileged containers.

Now, in particular with Kubernetes containers, they demonstrate how RunC essentially can be used in order to break out.

All the attacker has to do, and this is what this script released by Datadog does, is to wait for RunC to run inside a container.

Then the dirty pipe exploit is used to override the RunC binary on the host

with malicious binary, which then of course leads to code execution on the host.

Overall, no real big surprise. In essence, a container is a lower privileged

process, so if I approach escalation and I can trigger it from inside the container, I may be able,

...