Hello and welcome to the Monday, September 11, 2023 edition of the Science Internet Storm Center's Stormcast. My name is Johannes Ulrich and today I'm recording from Jacksonville, Florida.

People often ask why you would run a honeypot or use the data we have to offer at the internet storm center that's derived from

these honeypots, I usually state that the data is most useful to add color to your logs.

The data we collect from honeypots can help better understand why, for example, a certain attack,

a certain IP would show up in your logs.

So it's really about augmenting the data that you already have for your sock.

But it's also useful for the honeypot itself if you run the honeypot.

One of our undergraduate interns, Chris Wichick, went at least in MyBook a bit unusual route to add more context to his Honeypot logs. Chris used a PowerShell script, not Python, to collect data from APIs, like, for example, Alien Wall's thread exchange to see how the data for his honeypot fits in with all the other data sort of collected by the thread exchange.

He outlines the complete process in his guest diary, including, of course, some of the scripts that he then created.

When I recorded Friday's podcast, I mentioned that we had yet a year from Citizen Lab about the Apple Patch

released on Thursday. Citizen Lab was noted in the Apple security announcement

that they alerted Apple of this particular vulnerability. And again, this was already

exploited. That's really what Citizen Lab found. The patch addressed two vulnerabilities that are exploited in target attacks.

An interesting twist was that one of the patches addressed vulnerability in Apple's wallet application.

Citizen Lab released a blog post with details shortly after I finished recording for the Friday podcast,

so we now have some more details to talk about.

The attack did not require any user interaction.

Apple's relatively new lockdown mode does apparently prevent exploitation, but before you run and enable lockdown mode, realize that it may affect some significant features.

The exploit took advantage of a buffer overflow in image I.O. That's the library that displays images, but to exploit the vulnerability,

the exploit took advantage of a validation issue in Apple's PASKit. Pasket is used to create iOS

wallet items like boarding passes or concert tickets.

This vulnerability has gotten a lot of press, but realize that the only known exploit is part of sort of a more high-end commercial exploit kit that was used in targeted attacks.

...