Hello, welcome to the Thursday, March 4th, 2021 edition of the Sansternet Storm Center's Stormcast. My name is Johannes Ulrich and then I'm recording from Jacksonville, Florida.

Well, just a quick follow-up on the Microsoft Exchange Cereaday that I talked about yesterday. Of course, lots of talk about

these vulnerabilities and the associated exploits today. One of the vulnerabilities is the deseralization

vulnerability has been extensively discussed in a blog post and well there is sort of some these pieces of

proof of concept exploits out there haven't really seen anything about the server side request

forging issue which probably is the most critical one of these vulnerabilities rapid seven has a real good blog post, turns out, that

they actually were able to detect this as early as February 27th, so last week, and apparently

also alerted Microsoft of some of these issues. One of the things that should not be underestimated is that these attacks may be more

widespread than your typical targeted attack.

It more looks like there are thousands, if not tens of thousands of victims here, at least as far as the US IP address space goes.

It appears that it was entirely scanned by these actors.

We had hits in our honeypots from one of the actors.

So if they start hitting honeypots and such, it's often a sign that,

yes, they're pretty much just hitting everybody. So if you do have an exposed, unpatched

Microsoft Exchange server, assume it's compromised. And again, the Rapid 7 blog has some real good insights into what to look for.

Now, whenever there's a big vulnerability like this, it's often easy to overlook other issues.

And one that I want to point your attention to is a new patch for Salt Stack. Salt Stack is this IT management suite that

has been the target of attackers in the past. Now, this latest vulnerability is just a privilege

escalation vulnerability, but very easy to exploit. And it does affect the minion component of salt which is what you're

installing on the managed system so there's a pretty large footprint of this and an attacker

breaking into any one system finding minion installed could use it to escalate privileges.

The problem here is that Minion at one stage is looking for processes running and then essentially

...