Hello, welcome to the Tuesday, March 9, 2021 edition of the Sansonet Storms, Stormcast. My name is Johannes Ulrich, and today I am recording from Jacksonville, Florida.

We got a quick diary today by DDA about how to combine Yara rules and Cyber Chef.

Yara rules, of course, are, well, not really regular expressions.

They're really a pattern matching language, kind of meant to detect malware and regular expressions just part of this.

Cyber Chef is the web-based tool that was created by GCHQ and does allow for various

transformations from base 64 to various encryption algorithms. And they will tell you how to combine

the tool to, for example, more efficiently hunt for visual basic macros,

even in compressed files. And Apple today again updated pretty much everything, Safari, MacOS,

watchOS, iOS, and iPadOS. What's sort of a little bit special here is that all of these updates only fix one particular

vulnerability, and it's the same vulnerability across all of these operating systems, and

that's because it's a WebKit vulnerability.

WebKit is the basic library that is being

used by Apple to render HTML and JavaScript, and it's actually also used by other browsers,

so other updates may be coming. The fact that Apple bothers to release this update just for one single

vulnerability may indicate that this vulnerability is exploited. However, this is not stated

in Apple's security announcement. And in response to a recent Nat, SlipStraming attacks Google may be blocking access

to port 554 by Google Chrome.

Slip streaming refers to a technique where a network will trick a browser into connecting a two net hacker's

site on a specific port, assuming that the firewall is dealing with the traffic using a specific

applicational layer gateway or ALG, and then allowing traffic back into the network on various ports.

The reason for this is that sometimes you do have application where the client is connecting outbound to a particular port,

then the application is responding on a different port inbound, and application layer gateways essentially open these

...