Hello and welcome to the Monday, September 25th, 2020, 23 edition of the Santernut Storm Center's Stormcast.

My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

Guy looked at some honeypot hits that he saw in his honeypots, but we also saw some interesting trends earlier

this year when it comes to Lara Well. Larval is a framework for PHP, quite popular among

PHP developers, and yes, it had vulnerabilities.

Keynotes in 2021.

There was, for example, a vulnerability that was made known, but these attacks or these scans that we are seeing are not actually going after anything sort of Laravelle-specific.

Instead, they're looking for dot env files, essentially. Dot Env files often used to store environment variables that are

then used to provide credentials like API keys and such for the application. We have seen that before, and I think a few months ago, we already had a diary about

these kind of configuration files.

They're certainly being searched for, and something that you should pay attention to.

These files should not be accessible in your document route.

If you have files like this at all, they should be stored outside the document route.

Or, well, even better, take a look at how, what other mechanisms, your particular framework,

your language makes available for credential storage, in particular in the cloud and such

you often have secret managers that you can use instead of storing credentials in a simple

file on the file system.

And Palo Alto's Unit 42 has an interesting blog post about a fake proof of concept that was released to GitHub for CVE 2020-477.

This was the WinRAR vulnerability from about a month or so ago, so a high-profile vulnerability. Lots of people were looking for proof of concept exploits.

And this one may have been downloaded several times by people either maliciously looking for proof of concept exploits or researchers trying to figure out how this particular vulnerability could possibly be exploited.

Well, they got definitely more than they bargained for, but they didn't get Winrower exploit.

The exploit that was actually sort of used as a template for this malicious backdoor was an exploit for CVE 20203-25157. Totally unrelated to WinRAR. This is some kind of geo-server,

...