Hello, welcome to the Monday, September 17th, 2018 edition of the Sands and its Storms Center's

Stormcast. My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

This weekend, the DA wrote a diary with some shortcuts helping you to reverse malicious visual basic code.

What is mostly about is trying to decipher these obfuscated strings that are typically passed to create objects.

Well, the DA's assumption here is it's actually somewhat predictable what the attacker would like to create here with create objects.

And often, obfuscation doesn't change the length of the string.

So using these assumptions, you are able to make some intelligent guesses as to which object is being created without having to jump through all the hoops and the obfuscating the code.

So neat little trick if you do a lot of reverse analysis, but probably also requires some

experience to sort of make the right guesses here. But then we also have a question for you

listening to this podcast or reading our blogs. Did he for a long time now is seeing in

his weblogs an odd user agent. That user agent is UA Tools Random. This looks like a function,

a variable that wasn't properly expanded as the attack tool was run.

So really looks like an attempt to create a random user agent that failed.

So if you have any ideas, which attack tool could create a string like this,

well, please let us know.

And then we got a new denial of service attack against Safari.

Now, typically crashing a browser isn't really all that exciting, happens quite often.

But this one is particularly devastating for iOS, where it actually reboots the entire phone.

On desktop versions of Safari, it appears to at least under some circumstances lock up the browser. There are also some reports that this may affect some other browsers.

For example, Chrome if you enable the right development features or Firefox may be affected by this.

Also there are some reports of internet 11 on Windows 7 being affected by this vulnerability.

So it appears that the vulnerability is actually part of a WebKit, which is the Apple rendering library that is included in a lot of other

...