Hello, welcome to the Monday, September 25th, 2017 edition of the Sandton at Storm Center's Stormcast. My name is Johannes Ulrich and the I'm recording from Baltimore, Maryland.

When you're doing forensics on a file system, the most volatile property of the files is probably the access time.

It's updated whenever you access the file, meaning whenever you read the file.

Now when Jim recently wrote about the tool Mac robber that he rewrote in Python, he also

noted that this tool was not going to collect checksums of these files by default because that again

would change the access time now in today's diary jim wrote about a little trick that he's using

in order to prevent that from happening and that is to actually use a bind mount a bind mount really maps one

directory in another location and by doing so with the read-only attribute if you are

accessing the file in that new location that you mapped it to then access times are

not updated so this is a pretty neat trick, but still be careful whenever you access files, that you

do it correctly, and that you are not inadvertently updating your access times.

PGP, pretty good privacy, is still probably the dominant encryption mechanism when you're trying to exchange email, in particular for vulnerability disclosure.

The advantage of PGP is it's implemented on many platforms as a standalone application.

It's pretty easy to encrypt a file and then attach the encrypted file to an email or to upload it to a website.

Well, to facilitate these exchanges, many companies are publishing PGP keys.

Now, the emphasis here should be on publishing your public PGP key.

Adobe apparently made a mistake late last week and published its

private key instead. Sadly, this mistake is more common than it should be a lot of people who

use PGP, don't use it regularly, and aren't really all that familiar with the mechanics of actually how these keys work.

And, well, Adobe is just the latest high-profile example to fall in this trap.

And Avast published an interesting blog post with some additional details about the C-Cleaner incident.

With the help of law enforcement, Avast was able to get a hold of the server used to control the bots that were infected with a C-cleaner.

...