Hello, welcome to the Monday, November 22nd, 2021 edition of the Sandtonet Storm Center's Stormcast. My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida. And just as a reminder, it's the Thanksgiving week here in the United States. So this week, we will only have three podcasts for

Monday, Tuesday and Wednesday. Two quick diaries this weekend from our internet storm center

handlers, Guy wrote about some attacks he's seeing in his honeypots targeting Hickvision security cameras.

The vulnerability being exploited here is reasonably recent CVE 2021-36-260.

So hope you got your cameras patched.

There are a total of 3.2 million of these cameras connected to the internet, according to

Shodan.

And a couple of weeks ago, we had a diary by Xavier talking about how the plugable authentication

modules or Pam in Linux can be abused, in particular, how backdoors can be introduced into these modules.

Well, Dede now has a little bash script that looks for some specific backdoors and will detect them if they got introduced into Pam.

So something you want to keep in mind for your instant response toolkit.

In a collaboration among research institutions from China as well as from the US has taken a closer look at the root certificates that are being used to sign web certificates

that are being used for TLS in the public internet.

What they noticed is, and shouldn't really be a big surprise,

that there are a lot of certificates that are verified or signed by certain authorities that are not publicly known and trusted.

Overall, this is not necessarily a bad thing because a lot of organizations have their own

private CAs for internal use.

And yes, some of those websites may be exposed, but if they're really only meant to be used by internal use and yes some of those websites may be exposed but if they're really only meant

to be used by internal users who trust the specific server authority then it's not

necessarily a bad thing but it becomes a little bit more tricky is that apparently many

of these certificate authorities are attempting to impersonate some well-known certificate authorities.

When you set up a certificate authority, you can give it a name for an internal certificate authority.

...