Hello and welcome to the Thursday, December 15th, 2016 edition of the Sanjord, Storm Center's Stormcast.

My name is Johannes Ulrich, and I am recording from Washington, D.C.

Xavier looked at an interesting JavaScript sample that a user submitted this particular exploit,

abuses an interesting feature in the event viewer, which is a tool in Windows to look at log events.

Well, in this case, actually, it is abused in order to bypass UAC.

All you have to do is you have to write the script that you would like the event viewer to execute in the right registry key and well event viewer will execute this script without actually triggering uac and the script will run with high privileges as far as as I can tell, this particular method to bypass

UAC was first described back in August. So interesting to see this now in relatively common

malware. And Trustwave released advisory describing a desktop API in Skype as a backdoor because, well,

instead of authenticating to the API as you typically would have to do as a desktop program

can be bypassed by just naming the client correctly as Skype Dashboard Widget plugin.

Describing that as a backdoor, I think, is a little bit a stretch, is a desktop API that allows other software running on the same system to access Skype.

Makes it easier to do so, but I think actually without the API,

you probably could gain access in this situation to things like messages

or audio being sent to Skype.

You are just foregoing the warning to the user that you're going to do this.

Microsoft, on the other hand, announced that they're actually going to remove this API,

no longer going to support it.

Of course, at this point, it's sort of just being phased out.

I've already talked about certificate transparency a few times on this podcast. Certificate

transparency is a process where certificate authorities are publishing information about certificates

that they are issuing. The idea behind these logs is that you can search these logs and then figure out if someone is trying to obtain a certificate for a domain name that you are controlling.

Now, up to now, there were a couple of sites that allowed you to search these logs, but there wasn't really anything simple and free that would allow you to

...