Hello, welcome to the Tuesday, March 6th, 2018 edition of the Santered Storm Center's Stormcast.

My name is Johannes Ulrich Entertainment recording from Jacksonville, Florida.

As the saying goes, everything can be done better with a shell script and all it needs for world

peace is the right one-liner.

Well, Xavier looked at a real neat sort of malicious badge script.

In this particular case, of course, we get a crypto coin miner installed.

Kind of interesting that they are bothering to actually figure out how many CPUs are running

on the system so they can set up the right

number of threats but that's not it they're also enabling gran jobs and enabling root back door

now as Xavier points out often the route isn't allowed to log in via SZH, but well, sadly, that's not true a lot of the times, so probably this will work.

Interesting also that they're attacking Redis.

Redis is yet another one of these memory-based no-seql databases, somewhat competing with MAMCashD that kept us busy last week.

In this case, however, they're not interested in a denial-of-service attack. Instead, they're trying

to use Redis to install malicious code on these remote systems. Now, talking about MAM, the denial of service attacks continue to come and continue to get bigger.

The latest record as Arbor reports, it's 1.7 terabits per second.

The attack last week with GitHub was 1.3 terabits per second. The attack last week with GitHub was 1.3 terabits per second. Now both numbers come from Arbor, so I think they're somewhat comparable. But as always, with denial of service attacks that are that large, you'll have to take these numbers with a crane of salt given that quite often

with these large attacks, actually not all of the traffic is detected because it will get

blocked rather far upstream to the congestion close to the source of the traffic. And if you're using the popular Java framework SpringData Rest in order to create Rest APIs,

you may want to double check if you are up to date.

The problem here is remote code execution vulnerability that was fixed back in September last year, but so far we

didn't really have a lot of details about it. Last week, the company that discovered the vulnerability

did release a little bit more detail about what the vulnerability is actually about. So this is probably

...