Hello, welcome to the Thursday, July 18th, 2019 edition of the Sandstone Storm Center's Stormcast.

My name is Johannes Ulrich, and the time recording from Svindon, England.

Xavier did a little study of DNS text records.

He looked at 300,000 different text records that he had collected and looked at,

well, what's the content of these DNS text records? Turns out that most of them are used

for some variation of email filtering, like SPF records, or in some cases also to verify domain ownership.

But probably most interesting very exploits that Xavier found in these text records.

There were a couple different cross-site scripting attacks and also a SQL injection attempt.

This of course does target systems that will, for example, display these text records in

a web console or insert them into a SQL database.

The use of DNS to deliver exploits isn't exactly new, so this is something you definitely should be ready for if you are reading DNS text records or any DNS record automatically.

Host names, for example, while they're more limited in the characters they should contain are not perfectly safe.

And of course, you could always have someone deliver a non-standard compliant response.

So for a quick summary and what these exploit records were all about, just check out Xavier's

diary from today.

We're talking about Linux malware. We're usually talking about malware attacking servers, for example, via popular web application

vulnerabilities. So it's kind of exciting that in Teaser, a security company found desktop malware for Linux.

They dubbed this particular Malver Evil Knoam. It does come disguised as a Knoam extension.

The purpose of this malware appears to be essentially spyware. It has capabilities to, for example, take screenshots.

Also, it is able to exfiltrate newly created files. A keystroke logging facility that is part of this

particular malware doesn't appear to be fully finished yet, which makes it teaser believe that this

particular malware is still in its development stages, and it is founded on Virus Total,

...