Hello, welcome to the Thursday, January 18th, 2020,

for edition of the Sands and its Storms Centers, Stormcast.

My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

One assumption when running a honeypot is that any vulnerabilities being exploited by an attacker

are likely also vulnerabilities

that are frequently seen on system because an attacker wouldn't really waste their resources

exploiting hardly seen vulnerabilities. Well, the same is probably also true for passwords.

With our Telnet and SSH logs. We are collecting

passwords that attackers are attempting against our honeypots. And Jesse took a look at, well,

how numbers are being used in these passwords. Numbers are often used as part of passport requirements to achieve a certain

complexity. Attackers, of course, know that users are gravitating to certain numbers, like

password 1. Well, some interesting findings here from Jesse. First of all, the number one is by far the most common use number,

followed by two and three. No big surprise here. What I also like is that when Jesse looked for

groups of four numbers, that year numbers like 2022, 2021, 2021, 23 are right there in the top. Of course,

the overall top is one, two, three, four. So hackers know how our users are likely going to

react to password complexity and also password rotation requirements. And that in part is reflected in the passwords that they're attempting.

Probably the lesson that has been pushed in recent years to focus on length and not just simple complexity and not to require passport rotation is a sound advice given this data from our honeypots.

Kerserski has an interesting blog post about how to detect malware on iOS.

Detecting malware on iOS can be tricky because, well, a lot of the internal database and such are not necessarily

that well documented. It can be quite tricky to extract all the data. Well, what they found was

that one of the simplest way to get a pretty good idea if a system is compromised is the shutdown log. The shutdown log

is created whenever the system is the iPhone or iOS device is being rebooted or shut down. And

...