Hello, welcome to the Tuesday, July 23rd, 2019 edition of the Sansonet Storm Center's Stormcast. My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

Great little walkthrough by DDA today in his post about how to analyze a compressed PowerShell script.

The not only tells you how to recognize these type of scripts, but also how to decode it

and of course under heavy use of the DA's own OLLI dump tool.

And if you are running Palo Alto's Global Protect SSL VPN, make sure you are running the latest version.

About a year ago in July, actually, 2018, Palo Alto released an update for Global Protect, but it didn't note a particular easy to exploit remote code execution

vulnerability. To researchers that were actually doing a security assessment of Uber, ran into

this vulnerability when they explored Uber's Global Protect setup. They reported the vulnerability to Palo Alto only to find out

that it was already patched in the latest version of Palo Alto's software. The problem here,

of course, is since Palo Alto never actually pointed out this vulnerability, and it is

trivial to exploit vulnerability.

It never really got the attention needed to get people to actually update their devices.

So if you still run a firmware that's a year old or older, you may be vulnerable and you

probably should double check that you run the

latest version of PanOS.

And well, then we also got updates from 40 Net.

We have updates for 40 OS, 40 manager and 40 analyzer.

All of these updates are fixing a critical certificate revocation vulnerability

that could be used by an attacker to use an invalid certificate for authentication.

So the way this would be exploited is that if you are revoking a certificate that, for example, is lost, if a device got stolen or something

like that, the revocation may not necessarily be effective. As an additional quirk to this update,

it has to be installed manually. And the NSO group, which is famous for selling high-end spyware, in particular to government clients, has announced that it has come up with a new smartphone spyware.

...