Hello, welcome to the Monday, October 4, 2021 edition of the Sandcent Storm Center's Stormcast. My name's Johannes Ulrich, and I'm recording from Jacksonville, Florida.

As far as offense goes, one big trend these last few years has been Living off the Land binaries. This typically refers to finding binaries

that are installed on systems by default and then using them as part of some malicious

actions, sometimes for encoding, sometimes for downloading files. Xavier ran to a script

that did find yet another binary that it abused here or used, I should better say, CVT RES.

CVT RES is essentially compiling files. It's meant to convert a resource file to a cough object. That's the common object

file format. Typically extension here would be .obj and then that can be linked to an actual executable.

So the goal from a hacker's point of view here is to load .res file, which is not necessarily on your top 10 list of

file types to inspect, and then convert it on the system itself using CVT res, which is installed

with the dot net framework.

And recently we had so many seradaries in Google Chrome meaning war on abilities that were exploited before a patch was available that actually I think last week I have to admit I missed to mention two of them.

So what I recommend is with all of these exploits out there and Google being pretty good

in responding to them and keeping Google Chrome up to date, once a day, why don't you just

open Google Chrome type Chrome colon slash settings slash help in the URL bar and that should get you straight to the update dialogue.

I sometimes find that you have to try twice the first time you'll get an error message,

but the second time it usually applies the update, and that way you sort of shortcut a little bit the automatic update

that Google Chrome is doing anyway. Other than that, just at least once a day, close down

Google Chrome, start up again, that also may trigger the update. And October is Cybersecurity

Awareness Month.

Well, if you're listening to this podcast, then probably every month is Cybersecurity

Awareness Month for you.

And really the targeted audience here is more non-technical.

...