Hello and welcome to the Thursday, November 30th, 2023 edition of the Sands and the Storm Center's Stormcast. My name is Johannes Ulrich and I'm recording from Jacksonville, Florida.

One of the questions I get a lot is if you're setting up a honeypot, what should you expect? How many attacks should you expect? What kinds

of attacks should you expect? Well, one of our sands.edu undergraduate interns has put together

a little blog post, a little diary on the internet storm center, answering just that question.

The data summarized covers about three months,

and I would call it pretty typical. There are tags against the S.H. Honeypot from about

26,000 IP addresses and 13,000 different usernames were attempted with 43,000 passwords. So quite impressive numbers for a little lonely Honeypot just exposing S's age.

Also, the commands that the attackers are attempting are summarized 27,000 different commands were captured. So this is only after

the initial login attempt was successful. The top 10 that are listed here are very typical

against some some reconnaissance, some overriding of S-H keys. That's actually super common, and I think often not well monitored.

And that's exactly sort of how you learn from Honeypots. If you're seeing that one of the things

that attackers seem to always do is modify your authorized keys file, well, that's probably

something that you need to put some additional controls and

monitoring around. So take a look, and if you're interested in running your own honeypot,

well, please go ahead and let me know how it goes. And Tenable today published an advisory

with details regarding three vulnerabilities in ArcServe UDP.

The backup suite is vulnerable to these three trivial to exploit vulnerabilities. Tenable

does provide the sample curl commands, essentially, that will show you how to exploit these vulnerabilities.

Patches were released last week, so fairly short timeline here in particular, given how

trivial these vulnerabilities are to exploit. But these are prominent systems that you should

have exposed to the internet in the first place. In particular,

the first of the vulnerabilities, that's CVE 202033-41998. It's an unauthenticated remote code

...