Hello, welcome to the Monday, November 13th, 2017 edition of the Sansonet Storm Center's Stormcast. My name is Johannes Ulrich and I am recording from Jacksonville, Florida.

Xavier this weekend had a nice diary introducing a trick to learn more about certificates installed in Windows.

Turns out with PowerShell, you have a virtual device cert colon that essentially leads to the certificate

store and can be easily used to enumerate all trusted route certificates.

The reason this is important is that we had it happen several times,

usually a couple times a year, where malware and sometimes actually also intentionally installed

software like drivers do install additional route certificates. And then of course, an attacker

could use these certificates to sign additional certificates. And then of course, an attacker could use these certificates to sign additional

certificates that your operating system will trust. So taking stock of these root certificates

occasionally certainly makes sense. Personally, I'm not a big fan of removing any certificates that are installed by the operating system by default.

What you're risking there is that your users will get warning messages if they visit legitimate sites.

On the other hand, that's a real good trick that was provided in one of the comments.

You can also monitor this passively. For example, Pro

extracts all certificates, it sees an SL traffic, and then you can easily review who sign

these certificates, who were the certificate authorities, and look for anomalies here. And Google published

an interesting study showing how Google accounts are hijacked.

Well, it should really be a big surprise. There's sort of three ways how this is done.

First of all, if details about an account are being leaked in another breach and the user

did reuse passwords, that's one reason. The most successful,

the most important way, however, appears to be fishing. I was a little bit surprised about the success

rate. They're stating that 12 to 25% of fishing in key logger attacks yield a valid password. I'm not 100% sure how they

counted that if this is only among people that actually responded to the fishing scam,

...