Hello, welcome to the Thursday, November 10th, 2016 edition of the Sandsenet Storm Center's Stormcast. My name is Johannes Ulrich and the day I'm recording from Jacksonville, Florida.

Residents in an apartment building in Finland were apparently without heat for over a week due to a denial of service attack against the building's management systems.

The result of the denial of service attack was that the heat management system of the building

could no longer connect to a central server. Now, the connection to that central server is

important in order to alert maintenance personnel and such

about dangerous conditions like overpressure.

So the fail save was that the system rebooted in order to establish the connection again

and shut down until it was able to set up the connection.

So essentially it was sort of hung in this infinite reboot loop as a result of a simple denial of service attack.

Not sure why it took over a week to fix. Apparently all they had to do in the end was to set up a firewall to isolate the system from malicious traffic and only

allow connections to the management server and sticking with the end of thanks here

for another story we do have a new vulnerability in D-Link routers this one

affects the HNAP protocol the home network administration protocol, which has been the source of vulnerabilities in the past.

Here, yet again, if you have a problem with an XML parser that could be used to execute arbitrary code.

The problem here is the vulnerability can be triggered using the login function,

so you don't actually have to be authenticated to the device in order to trigger the vulnerability.

The link has not responded to the vulnerability report.

So there is a patch available at this point.

In general, do never ever expose the admin interface of any device like

that to the internet it's just asking for trouble I don't think there is a secure

implementation of any one of these admin interfaces out there right now the

advisory does include exploit code for arm and MIPs processors, so this should cover the range of

...