Hello, welcome to the Monday, September 20th, 2021 edition of the Sandcent Storm Center's Stormcast. My name is Johannes Ulrich. And then I'm recording from Jacksonville, Florida.

Xavier on Friday took a look at malicious calendar subscriptions. Calendar subscriptions are a feature that's common in many calendar systems, but abuse is most popular in iOS.

A subscription feature doesn't really sound all that bad initially. Essentially, you can share your calendar with another individual.

The result is that your calendar events are showing up in this individual's calendar and

also notifications and such may pop up if events are approaching.

The problem here is that this will be abused for spam and all it takes is one careless click

and that's exactly what happened here with Xavier's kit who ran into this problem and

now you are following a spammer's calendar.

And the spammer is now able to essentially create pop-ups using these calendar events that then include links that may lead you usually to spam, but of course could also lead you to malicious pages.

Apple apparently has a hard time reining in this abuse of their calendar system. Not too much you can do other than be

careful what you click on and do not accept these random calendar subscriptions. And Microsoft is

reporting that they're seeing increasing numbers of exploit attempts for CVE 2021-444.

This is, of course, the MSHtml vulnerability that has been going around for at least two weeks now

and was patched last week with patched Tuesday. Did he put together a very quick diary of the

weekend showing how his analysis tools, zip dump and R.E. search can be used in order to

extract malicious URLs or potentially malicious URLs from exploit attempts that try to take

advantage of this vulnerability. You can then double check the particular URLs to see if they

are in fact exploiting CVE 2021-444.

And regarding the OMI, the Open Management Interface,

vulnerability that Microsoft patched on Tuesday,

Azure hosts may still be vulnerable to this.

Remember that these tools are installed automatically on Linux

...