Hello and welcome to the Friday, June 6, 2025 edition of the Sands Internet Storm Centers, Stormcast.

My name is Johannes Ulrich, and this episode, prok you by the Sands.edu, credit certificate program in cybersecurity engineering.

It's recorded in Jacksonville, Florida.

Well, in Diaries today, we have an interesting one from Xavier who

ran into a scam involving Zoom in this case. The scam arrived as an email. The email was a fake

invite for a Zoom meeting. Now, that overall looked legit, has the right layout, right format,

and then if you click on the link to join the actual meeting, you'll be created with, well,

an update notice that your Zoom client is out of date and you need to update it. That's something

like this. I've definitely seen in other online meeting software where you need to update it. That's something like this. I've definitely seen in other online meeting software where you try to join a meeting.

You haven't used a particular client in a while because there are so many of them out there

that you're presented with notice like this that you should update your client.

And that would be certainly something that a user could easily fall for,

in particular if you sort of created that urgency of having to join this meeting right now,

not really being able to wait, just want to get started, want to download that client and

get going. Interesting scam. He had certainly something to probably throw into some kind of

awareness presentation. Well, and then we have a new vulnerability in the Python tar file module.

That module has had issues in the past, and there are some fundamental problems whenever you're

trying to extract files from something like a tar file or a zip file,

and that's usually related to the fact that you may create arbitrary files, additional directories,

that you don't necessarily intend or want to have created.

Now, in the past, there has been so a little bit forth and back between the

maintainer of the TAR file modules and users, how much it's the responsibility of the TAR file module,

...