Hello, welcome to the Tuesday, November 26, 2019 edition of the Sandcent, and at Storm Center's Stormcast. My name is Johannes Ulrich, and then I'm recording from Jacksonville, Florida.

This week, of course, is Thanksgiving week in the United States, so we'll have a little bit an altered podcast schedule with only three podcasts for

Monday, Tuesday and Wednesday. Also, the podcasts will likely be a bit shorter than usual, just

because typically there isn't that much news to report during this week.

In diaries from this weekend, we first got one from Xavier about an interesting event that he

investigated. The problem was that the firewall they're using blocked an HTTP request

that actually came from outside their network.

Now, this particular firewall was configured to block malicious or inappropriate URLs

from users inside the network.

So typically you would see outbound traffic trying to reach a website that violated some kind of policy.

In this case, however, the attack went the other way around.

Now, one of the most common attacks that we see in our web allocation firewalls is people looking for proxies.

If someone is looking for a proxy, they would typically go to a

well-known and not blocked site like Google or something like that. But in this case, what apparently

happened was an attacker checking out the file wall to see which sites are allowed and which sites are not allowed for internal users.

And then of course the attacker could use this information to, for example, create a phishing email that links to a website that's not blocked.

So the real problem here is that the firewall was misconfigured in that it did allow access from the outside.

Instead, it should block all access from outside the network and for internal users only.

It should then apply its content filtering policies.

And Gies talking about malice. Malice is an interesting. apply its content filtering policies.

And Ghee is talking about malice.

Malice is an interesting open source project that allows you to build your own multi-engine malware analysis system.

...