Hello, welcome to the Tuesday, December 19th, 2017 edition of the Sandtonet Storm Center's Stormcast. My name is Johannes Ulrich, and I'm recording from Washington, D.C.

We get quite a few of word documents from our readers, and of course, the big question is initially always is it malicious or not sometimes these

word documents are really just used for spam so in the latest case here ddia is looking at a document

that we received from carlos did he does a nice job in this two-part series looking at the document structure of these word files

and how to quickly triage them, how to figure out if there's something worthwhile looking into deeper

or is this something we should worry about or in this case, well, it's just spam, so probably

nothing bad happening here. And with insecure deserialization making it into the

OASP top 10, we do see more work being done, looking at various file formats and how they are

deserialized. And thanks to Anna, who is currently actually taking the defending web application security

glass for pointing me to a blog post by Code White that is looking closer at the action message

format, or as they somewhat jokingly call it in this blog post, another malicious format. They're looking at a couple of different

Java AMF libraries and find vulnerabilities in all of them. And while this file format is somewhat linked

to Flash, it can be found in a number of products that are using these Java AMF libraries.

Sadly, out of the three vendors that are affected here, only one Apache has a patch available.

One of the vendors Exedal actually discontinued its library.

And the third one, Gran ds and web orb for java actually

hasn't responded yet to the disclosure now looking over the different vulnerabilities probably

a diverse issue here and again not that uncommon sadly for these kind of libraries

that within the file and attacker would be able to define Java classes that are then executed

as the code is parsed leading to arbitrary remote code execution and one issue with browser extensions is that these browser extensions, of course,

do have full access to the content the browser provides,

but also, if not done correctly,

...