Hello and welcome to the Wednesday, November 27th, 2020,

for edition of the Sansonet Storm Center's Stormcast.

My name is Johannes Ulrich and I'm recording from Jacksonville, Florida.

In Diaries today, we got yet another guest diary by one of our undergraduate interns. David Fitzmaurice is writing about the Red Tail

Minor. Like many minors, this one is targeting Unix devices that expose ZH with a weak

password. So very basic vulnerability here being exploited. Any minor then typically

ends up on IoT devices, which are quite frequently exposed and have known vulnerable

passwords. The problem with IoT devices is often that you aren't able to implement a lot of endpoint protections,

so you're relying more on the network detection order to identify infected systems,

and that's what the diary focuses on, how to detect this particular malware on the network. There are some

neat snort rules, for example, being introduced, but then David is also going over some other

network traffic, like, for example, DNS requests that may point to a particular infected system. Good diary because, well, these

miners are around. They are often also a good sort of canary. If you find a minor on a system,

just like the other stuff happening on it too, just miners tend to be the ones that are relatively easy to find.

Last week, researchers from Waleck City did publish a blog post that got quite a bit of interest and rightfully so,

for a somewhat unique attack vector that was used.

And I just want to point out that sort of one part here of a fairly complex attack,

and that's attacks from neighboring Wi-Fi networks.

Apparently, the bad actor in this case did compromise initially not the network of the target itself, but instead a network of an organization across the road from the target and then used Wi-Fi infrastructure at that compromise network to then reach out across the road and compromise the targets

and Wi-Fi network.

And with that breach multiple systems inside their infrastructure.

The one takeaway I want to point out here a little bit is that this particular attacker

...