Hello, welcome to the Tuesday, February 21st, 2017 edition of the Sanctored Storm Center's Stormcast. My name is Johannes Ulrich, and today I'm recording from Scottsdale, Arizona. At the end of yesterday's podcast, I talked about an XML external entity attack and how it can be used to send email via FTP. I also stated that PostFix doesn't

usually accept this connection. Well, not quite right. PostFix actually by default only

blocks connections via HTTP release, so it does block some of the standard HTTP verbs like get and post and connect

it doesn't do anything for these FDB paste attacks so today I published a little

diary that does show you how to extend post fix it's pretty easy there is an

SMTPD forbidden commands setting that you can use

to essentially just list whatever commands you would like to block, and if you add user and

pass to that, then you will block these FTP relay attacks as well as HDP relay attacks.

User and pass is not used as far as I know as part of standard SMTP in order to authenticate with SMTP you would use the auth command

which of course is still available in this configuration. And then we got two car hacking

related stories. The first one comes from Kasperski.

Kasperski looked at various apps that car makers are offering their users to remote control cars.

Typically you're able to lock and unlock the car, sometimes even start the car, or use geolocation features in order to figure out where your car is currently at.

Now, all of the apps that Kaspersky looked at had some very basic security shortcomings.

For example, they didn't protect the app window from overlay, so a malicious application

could pretend to be part of the car application.

They also don't check if the phone is rooted, and they don't check the integrity of the app,

so malicious software could alter the app after it's being downloaded.

Overall, what it comes down to is that these apps are only as secure as the

phone that you run them on. If your phone is compromised, then of course this app is

compromised as well. In addition, some of these apps, but not all of them, are storing

credentials in clear text on the phone. The second story comes from IBM's X-Force and deals again with apps that you're using

...