Hello, welcome to the Tuesday, August 4th, 2020 edition of the Science and the Storms,

on Stormcast. My name is Johannes Ulrich. And the time I'm recording from Jacksonville, Florida.

Saville came across a pretty interesting visual, basic macro that actually turned out to be part of a document that was either distributed as part

of a red team exercise or a targeted attack where Xavier believes it's probably deformer because

of the very specific version of the dot-net framework that was required for this particular macro to run.

This technique is often used in order to avoid collateral damage.

In this case, the attacker set actually up a website distributing diversity and inclusion survey

that then loaded the malicious macro.

What's also sort of interesting is that the bot actually is able to communicate via

a couple of different command control channels looks like, well, HTTP, of course, but also Slack and then also DNS.

And well, we do have updates for the boothole vulnerability. That was the vulnerability in

Crup 2. And I told you that this is a little bit of tricky update to release and apply.

Well, Redhead now, as well as Debian and Ubuntu, have come up with packages that should make

installation easy, but looks like they didn't get it quite right initially.

In particular, for Redhead, and with that also for SendOS, there are

reports of systems that fail to boot after the update was applied and it's actually a little

bit tricky to get them to work again. Similar issues also with some Debian and Ubuntu installs doesn't appear to be as

common with those systems compared to Redhead SendOS and seems to be more limited to dual boot

systems that boot via Linux or Windows.

I'll link in the show notes to respective troubleshoot notices that Ubuntu and Redhead published,

so hopefully they'll help you if you got affected by this bad update. If you only applied the update and you didn't reboot yet, well, have those articles handy.

And security researcher Matt Shockley found mixing the simple way actually to bypass transparency consent and control TCC in macOS.

...