Hello, welcome to the Wednesday, February 22nd, 2017 edition of the Sansanet Storm Center's

Stormcast. My name is Johannes Ulrich, and today I'm recording from Scottsdale, Arizona. Microsoft

still delivered one bulletin from February's skipped patch Tuesday today, and that's MS-17-005.

It is the Microsoft Mirror of Adobe's Flash Bulletin that was published last Tuesday.

For quite a while now, we did have it where Microsoft did issue bulletins for Flash updates

that did affect Microsoft's own browsers like Microsoft Edge and Innet Explorer 10 as well as 11. So this is no big surprise. This isn't really a new vulnerability here. Just Microsoft did publish this bulletin now because the wallablies were already known and addressed in Adobe's bulletin.

So with Microsoft's update today, we now have a patch for these vulnerabilities for InExplore 1011 and Edge.

Last week, we had a diary by Xavier about how the preferred network list can be used against

a user to detect what locations this user may have visited in the past. Well, a great testament to

the diversity of our handlers. Today, we sort of have a defensive response to that particular article by Rob

that will show you how to collect these preferred network lists from users in your environment

using a PowerShell script. This can be quite useful to figure out if certain users are very careless about connecting

to other wireless networks and can then also be used, of course, to detect machines at risk

of being compromised. Of course, this may not be perfect given that it's not that difficult to impersonate SSIDs and tools like

Karma of course will allow NetHacker to automatically impersonate any SSID that a particular client is

looking for. So Rob's PowerShell script is ready to go for you if you would like to investigate your network to figure

out what your users are connecting to. CyberX, a company that specializes in monitoring industrial

control systems, published an interesting blog article about some malware they found at several

of their customers. What's sort of unique

about the malware is that it does enable the microphone on the system and then exfiltrates

large audio files back to whoever is in control of the malware. Of course, there's no news here

in terms of being able to turn on the microphone,

...