Hello, welcome to the Thursday, February 6th, 2020 edition of the Sandrine Storms,

Stormcast, my name is Johannes Ulrich, and the I'm recording from Jacksonville, Florida.

Now we know one of the things that we're always pushing is keep your systems up to date in particular exposed software like your

browsers. Now, web browsers have made it quite easy to stay up to date and most of them

will update within a couple days of a new version being released without the user really having

to do anything. But still, users are used to being told to update

software, so if they're seeing a pop-up advertising a browser update, they may actually be willing

to install it. And this is exactly what Brad is describing, but with a malicious twist, where fake browser updates are being used to install the Net Support remote action.

Net support is sort of interesting. It's kind of marketed as a legitimate remote admin tool, but particularly in the past it has been using these fake browser

updates to trick users to install it without really knowing what they are installing on

their system.

Brad actually wrote about a similar campaign a year ago, so the diary he released yesterday

makes for real nice comparison sort of what has changed with this particular threat over

the last year.

Google released updates for Android and looks like some of an average to maybe a little bit lighter patch a day for Android and looks like some average to maybe a little bit lighter patch a day for

Android. There are two critical vulnerabilities in system. One is rated critical for Android

10, that's CVE 2020, 23. Now it only leads to information disclosure, but Google still rated it critical,

so probably whatever information is disclosed is critical from a security point of view.

The second vulnerability CVE 2020-22 is a remote code execution vulnerability and critical for Android 8 through 9 and it's

only denial of service or moderate for Android 10.

Not really clear here what it will take to actually exploit these vulnerabilities.

Google just says that a specially crafted transmission could

...