Hello, welcome to the Wednesday, September 7th, 2016 edition of the Sansonet Storm Center's Stormcast.

My name is Johannes Ulrich Entertainment, recording from Jacksonville, Florida.

Google today released the September update for Android.

Now, the way they did it this time is they released three different updates and they assigned

three different dates to these updates so you know which update you have installed.

The first one is labeled with September 1st, but then again, it was released today and it does include the security patches that everybody should apply.

The second and the third one only applied to certain hardware components.

So if your Android phone doesn't use any of the affected hardware, then it may not need to have that particular security patch.

These two are then labeled September 5th and September 6th.

So by looking at the exact version date of your Android version, you can then deduct which one of these patches was applied, which of course is for the most part up to the OEM or the carrier you got your device from.

For Google Nexus owners, these updates should already be available.

Probably noteworthy here are two vulnerabilities that are addressed by the September

first patch, one in Lipute Hills, another one in good old favorite media server, both are

rated critical for their ability to lead to remote code execution. And SEC Consult did publish an update to a study they did about nine months ago.

In this study they crawled the internet for systems that use known default keys.

So essentially they connected to S-H servers, they connected to HDPS servers, and based on the public key they got back.

They were then able to deduct whether or not this public key was part of a key pair that is well known

because it is the default configuration for certain groups of devices.

Similar, of course, also for default passwords.

Back then a sec consult went to cert and they did a big notification of about 50

different vendors trying to get them to fix the problem.

So now nine months later sec consult went back to see how did things change?

...