Hello, welcome to the Monday, November 20th, 2017 edition of the Sands and its Stormson as Stormcast. My name is Johannes Ulrich and today I'm recording from Jacksonville, Florida.

Recently a few times I've talked about Bitcoin theft. Well, looks like we have yet another method how bitcoins are being stolen, did he observed in his

web logs an increase in scans for what looks like Bitcoin wallets.

Apparently a lot of people are careless and expose these wallets on their website using standard

file names like wallet.sip or wallet backup.

. . And the bad guys have figured it out now and are scanning the internet for respective files.

These scans aren't all that new, they have happened in the past, but the frequency of them has certainly

increased recently. And Pratt is looking at some recent malicious spam that he has received

this time, yet again, the good old roots of a fake resume. It doesn't actually push ransomware apparently this time. Now, this same family of

Malware has pushed ransomware in the past, but appears to have switched back now to banking

malware. I wonder if this is a little bit of Trent Ver. The bad guys are getting a bit sick of ransomware,

and it's switching back to a good old banking matter, but one sample, of course, is a little bit early to call this a trend.

And Big IP released an important update for its products that patches of vulnerability in TLS.

Due to this vulnerability, it's possible for an attacker to decrypt TLS sessions if the

RSA algorithm was used in order to exchange keys.

Now before you run out and panic and update all of your servers on this short week,

let's look at some of the dependencies for this attack. First of all, you need to have a client

Zell profile enabled and RSA key exchange. Now most servers probably do have RSA key exchange enabled, but then if

you do use Diffy-Hellman ciphers, then you are actually not vulnerable because just attacking

the key exchange won't really help the attacker. Also, by default, big IP is configured with what they call the generic alert

option. That does not really return a lot of detail to the attacker, so with this option enabled,

it'll take more work for the attacker to actually decrypt the session. And if you do actually require a valid client certificate, then you are only vulnerable

...