Hello, welcome to the Wednesday, April 21st, 2021 edition of the Sansonet Storm Center's Stormcast. My name is Johannes Ulrich. And today I'm recording from Jacksonville, Florida. Well, today almost feels like patch Tuesday. We got two products that require critical patches that will address vulnerabilities that are

already being exploited in the while.

First of all, we got our good old friend Pulse Secure Fire Eye today, published a blog post

in coordination with Pulse Secure announcing a new vulnerability that apparently

is exploited in the wild and it does allow the execution of arbitrary code without authentication.

Now Fire area has a ton of detail about this vulnerability. Sadly, no patch available yet for this vulnerability. It is being

exploited together with older vulnerabilities in Pulse Secure in order to completely compromise

affected devices. Once compromised, backdoor accounts will be installed, web shells will be installed,

and any updates will not typically delete these backdoors. So these beachheads will persist

even after a system is upgraded. The attacker will typically also modify the system in order

to establish special backdoor accounts. And for example, if the system does require two-factor

authentication, two-factor authentication will not be required for these backdoor accounts, so the attacker will

still be able to just log in using the attacker's established passwords.

Also, logs will be modified in order to make detection of these exploits more difficult.

Now, as far as Pulse Secure's side of the response goes, Pulse Secure did publish an integrity checking tool.

You can use this tool to verify if your device has been compromised.

Pulse Secure also published an advisory with some tips in what you can do in order

to prevent exploitation. For example, they recommend to disable the Windows FileShare

browser and also disable the Pulse Secure collaboration feature. But they do not have a patch available yet. Neither

is there a timeline for a patch in the advisory. Within the show notes, I'll link to the advisory.

So maybe by the time you're listening to this, there will be more details about a patch timeline,

but this is something that you certainly should patch as soon as a patch is released.

...