Hello, welcome to the Monday, November 9th, 2020 edition of the Sansonet Storm Center's Stormcast. My name is Johannes Ulrich. And today I'm recording from Jacksonville, Florida.

Well, we got a couple of interesting diaries from this weekend. First of all, one from Guy about WebLogic. He took a look at his honeypot and found that the older WebLogic

vulnerability from January is still being exploited or attempted to be exploited. In this particular

case, it was a crypto coin mining script that the attacker attempted to install.

That's of course something we have seen for a while now.

And since this question came up last week, actually in an internal discussion,

DDA did publish a quick tip in how to use his OLLI Dump tool to extract a visual basic code

from malicious documents. Of course, OLLI Dump is meant to analyze these complex office documents.

And one of the things that it can do is point out that there are macros,

but you can also use it to then pretty much automatically extract the respective macro.

And just a follow-up to the iOS and macOS updates from last week, there was an iOS update for iOS 14 as well as one for iOS 12.

There was no iOS update for iOS 13.

The idea here is that anybody that's running 13 should be able to upgrade to 14, but you are vulnerable if you are running iOS 13.

Now, older versions for macOS, like macOS 1014 and 1013, we didn't see an update for those yet.

These are still supported, so if they're vulnerable, we should see an update for those yet. These are still supported. So if they're vulnerable, we should see an update

for these older versions of macOS. And let's encrypt this warning that starting September

next year, older versions of Android, and that's before Android version 711, will no longer recognize

Let's Encrypt certificates as valid.

The problem here is when Let's Encrypt first started out, they didn't have their own trusted

certificate authority, so they actually used someone else's certificate authority in order to sign their

certificates and ever since have cross-signed their certificates. So they're actually signed

with both of these root certificates, the old one, and now Let's Incript's Own Certificate.

...