Hello, welcome to the Thursday, October 13th, 2016 edition of the Sandsenet Storm Center's

Stormcast. My name is Johannes Ulrich, and the day I'm recording from Jacksonville, Florida.

Just a quick reminder, we got a special webcast coming today about the Mirai Botnet.

If you are interested, sands.org slash webcasts, and it starts at 1pm

Eastern. A good reminder from Xavier about one Wi-Fi feature that keeps getting people into

trouble and this is the preferred network list where

essentially your computer remembers networks that you joined in the past and

will automatically connect you to these networks as long as the SSID remains the same

and of course there are plenty of tools out there that will just listen

for these probes and then offer whatever SSID the user is listening for, giving that

individual that runs this access point, a chance to play man in the middle. Actually, OS10 or MacOS, I should say, in the last update, did add a new feature

where whenever you do connect to an open access point, meaning an accent point, without any kind of encryption.

It does give you a little warning about this, but in general what it comes down to is be careful what public access point you connect to, best not to connect at all, and using something like a tethered cell phone instead, and occasionally review that preferred network list. Make sure there are no networks in there that you

want, don't want to connect without warning. And with all the news about in and of

things and associated vulnerabilities, well it's about time for things to get better a

little bit. Turns out today things just got verse. We have a new set of

vulnerabilities. I think it's about 14 vulnerabilities total in AV Tech IP cameras. Now not all of them

are remote code execution vulnerabilities, but of course there are some here and yeah actually

there is no

default password but instead we got an authentication bypass and command execution

vulnerability in the web interface for this particular camera at this point I would say if you

do have any kind of in-head connectedconnected camera, assume it's vulnerable.

...