Hello, welcome to the Thursday, September 24th, 2020 edition of the Sandcent Storm Center's Stormcast. My name is Johannes Ulrich, and today I am recording from Jacksonville, Florida.

Xavier was out hunting again and is sharing with us, well, what he brought back home. One item was an interesting, malicious word document.

What was sort of special about this word document was not just that it, well, installed

PowerShell on the machine.

It also updated itself with content pulled from a website. The idea here is that after the user opens the document and of course provides it with access to run macros,

the content of the document will be updated with content that's appropriate for the victim's environment.

So, for example, it could download content in a particular language,

which is the preferred language of the victim,

or maybe something that's related to the particular victim's business or industry.

This, of course, will make it less likely that a victim will report this malicious document to the security team. They're more likely going to believe that this was a legitimate

document. Well, and are you done patching all of your Windows systems for CVE 2020, 2014-72, the famous

zero log-on flaw and probably planning to take the rest of the week off because there's

nothing else to do?

Well, you may need to reconsider.

Turns out that Samba, the open source implementation of the Windows protocol, may be vulnerable as well.

Samba is implementing as part of its suite, the Netlog-on remote protocol, which of course is

the vulnerable protocol here. Now, turns out that back in version 4.8, which was released over two years ago in March of 2018,

the default setting for the log-on part was fixed to use a secure net logon channel.

The setting for this is server s channel equals yes, so that's based

a change that was made back then. But if you for whatever reason change this setting, then

you are vulnerable. Now in addition, Samba did release an updated version of Samba version version 410-18, if you're still running the

410 branch, up to version 4127, if you're on the newer 412 branch.

...