Hello, welcome to the Wednesday, May 29th, 2019 edition of the Santernat Storm Center's Stormcast.

My name is Johannes Ulrich, and today I'm recording from San Antonio, Texas.

It's always great to have readers submit malvers samples to us even better if the reader then published a blog post with some additional

analysis of the sample. So we do have two posts actually here to refer to. The first one is by

DDS, part of our diary, where he goes over how to extract the PowerShell script that was Base 64 encoded in this particular office document that the reader submitted.

The reader himself then went from there and did additional analysis.

As part of the show notes, you'll find two links.

One is to DDA's diary entry and one is to the blog published by the reader submitting this sample.

Well, it looks like we still have to talk about the RDP vulnerability Blue Keep or CVE 2019-07-08.

Well, it's about two weeks since we got a patch for this vulnerability.

The latest news here is an internet-wide scan by Robert Cram.

Now, he's a reputation of doing these type of scans quite diligently.

He first just scanned for IP address that have port 3,389 listening.

Well, 7.6 million results came back.

However, turned out that only half of them were running remote desktop.

He did an additional scan using RDP scan. That's a scanner for the

vulnerability that he wrote and actually it is open sourced so you can use it yourself against

your network if you wish to do so. And in the end he ended up with a little bit less than a

million, about 923,000 vulnerable hosts that are exposed to the Internet.

So about a third of the RP servers that are exposed to the Internet are vulnerable.

Now I guess you can conjecture here that if people are exposing RDP to the internet, then there's a good chance, like a one in three chance, they're not patching either, which sort of could imply that if RDP is exposed to the internet, well, that's the real problem that you need to address.

And it's probably just an indicator there of other basic sort of network hygiene and so not really being in place.

...