Hello, welcome to the Tuesday, October 12, 2021 edition of the Sandcent Storm Center's Stormcast. My name is Johannes Ulrich. And today I'm recording from Jacksonville, Florida. Ever looked at your web server logs and found some odd entries that don't really look like, well, HTTP requests.

I did publish today a quick sample of things that I typically run into and explaining

why you may run into these entries.

This happens more often if your web server is listening on odd port. That's also

used by other services. For example, the Android debug protocol, that's very often still scanned,

even though it hasn't really been exploitable in any somewhat recent version of Android.

On the other hand, sometimes you also have, of course, users that are creative and move S-H servers to odd ports that are also used by web servers.

Well, the bad guys are on to you, and I do see, for example, some S.S.H scans hitting web servers. And with that,

you sort of got some of the characteristic strings there in your web server logs. I also

included a couple of strings that I have no idea what they're trying to accomplish or what they're associated with.

One reader on Twitter noted that it may be actually the line printer demon.

So a common printing service for Unix systems.

A lot of printers are exposing that.

Maybe just someone looking for exposed printers to print

documents on it.

That has often been done as a prank.

Of course, there isn't really much else that an attacker could do with that.

And Apple today released one of its, well, recently somewhat common emergency updates for iOS

and iPad OS. This brings both up to 15.0.2 and it fixes a single vulnerability, an I.O.Mobile

frame buffer, overflow CVEVE 2021 30883.

The reason we get this update is, as before, this has already been exploited out in the wild.

Shortly after the patch was released, security researcher Saar Amar did use the bin-diff utility to compare the old new version of iOS, as well as other tools, in order to essentially reverse engineer what the problem is and create a working proof-of-concept exploit for this. So this is something that you probably should not delay

...