Hello, welcome to the Wednesday, November 4th, 2020 edition of the Sansonet Storm Center's Stormcast.

My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

Yesterday, I mentioned attacks that we are seeing against our honeypots installing Cobalt strike using the WebLogic CVE2020 1488 to vulnerability.

These attacks are ongoing and Renato has published a post now that at least at a time when

this podcast moves live should also be live on the

ISE website. Cobalt Strike is significant because it does point to attacks that then use

manual follow-up. So this goes beyond the sort of fully automated attacks that we have seen before

installing crypto coin miners and the like. For example, ransomware is often preceded by

Cobalt Strike. That's a tool that ransomware gangs like to then explore the network and install their ransomware.

And well, once you're done patching web logic, turn your eyes at Saltstack.

Saltstack is a platform to manage systems and we had a big vulnerability in this system back in May that caused some

large breaches for example a couple of Cisco servers and so were breached as a result of

this vulnerability this recent update fixes three vulnerabilities,

and while SaltStack hasn't added official severity rating yet,

well, two of them are high or critical and probably should be,

because they do allow unauthenticated access to the Salt API and via that to the SH client.

One of them is shell injection vulnerability in the SH client.

The second one sounds almost easier to exploit in that it says, well, it's a broken authentication. Any value for the e-auth or

token value would allow a user to bypass authentication and make calls to salt SSH. So as long as you

provide some token, you're good to go. The only mitigation offered for these S-H client vulnerabilities is to apply the patch and also to ensure that the Sault API has been restarted after applying the patch.

And with all of these critical sort of enterprise-ish vulnerability, it's nice to see that we also

have a very regular Adobe Reader and Acrobat patch that was released today.

...