Hello, welcome to the Tuesday, December 1st, 2020 edition of the Sandstone Storm Center's Stormcast.

My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

First in diaries, we have a quick diary by DDA showing how to decrypt PowerShell payloadss using his tools base 64 dump and translate.

So what's happening here is that an attacker will encrypt the malicious power shell payload.

It's actually more meant to obfuscate. The key is usually delivered with the encrypted payload. And using the DA's

tools, it's then pretty straightforward to use this key after you extract it from the Malver

to decrypt the actual PowerShell payload. To make all of this as easy as possible, the DA has recorded a video

walking you through the entire process. And another day and yet another Pro-Hescalation

vulnerability in an anti-Malver product. This time, it's Trent trend micros turn and its server protect for a Linux product.

It suffers from a heat-based buffer overflow, and yes, it can use to arbitrary code execution,

but since the attacker needs to have already access to the system that the product is running on.

This really only leads to a privilege escalation.

So overall, not super critical, but something you probably want to take care of in particular

since it's the kind of system that's easily missed.

And of course one class of war on abilities that tends to is the kind of system that's easily missed.

And of course, one class of war on abilities that tends to be hard to sort of take control of is various software components that of course are included then in various products.

One example here, WebKit.

WebKit is a browser engine that is used by multiple browsers.

It's an open source project that originally was created by Apple.

And if you ever looked at user agent strings, you probably saw references to a WebKit in many of these user agents.

Now, as the Cisco's Talis team here disclosed to vulnerabilities that recently were fixed by the WebKit team,

both are arbitrary code execution vulnerabilities that could be

...