Hello, welcome to the Wednesday, October 25th, 2017 edition of the Sandtonet Storm Center's Stormcast. My name is Johannes Ulrich, and I'm recording from Berlin, Germany.

A quick reminder from Xavier today that a lot of malicious files are misrepresenting their file type by using an extension that does not reflect the actual type of the file.

Sadly, it isn't always easy to figure out the actual file type.

Now, many files identify themselves by a particular header, and we have tools like the Unix tool file in order to identify file types based on this header, but this isn't always true.

There are a few file types that are actually identified by a trailer.

So at the end of the file, we do have a marker identifying the file type and a couple

file formats have neither. Saville also is showing a couple of Yara rules. That's another way

how to identify file types either by trying to match the header of the file or by looking at any other indicators within the file that

will identify the file type. And it looks like yet another large ransomware campaign is hitting

Eastern Europe. This particular campaign has been named Bad Rabbit and one of the prominent victims is the Russian news agency

Interfax. Apparently this particular ransomware is spreading via fake flash player update pop-ups

that are being placed on various websites. Now once it it enters a particular network, it will move laterally

using the Eternal Blue exploit, as well as mimicads in order to collect credentials from memory.

In addition to Interfax and some other Russian businesses, apparently businesses in the Ukraine got hit as well.

And antivirus firm ESET is identifying this particular ransomware as yet another Petya variant.

And TLS continues to become more and more popular.

Google published its latest transparency report and is stating that between

70 and 80% roughly of web traffic is now using TLS. The data was collected from Google Chrome

users. Now Google also published across its different web platforms and most of them are now in the 80-plus percent of

TLS users.

Android is actually the one platform that's a little bit behind as far as TLS goes.

And then there were a number of news reports, and we also got some emails today regarding

...