Hello and welcome to the Friday, October 3rd, 2025 edition of the Sands Internet Storms Centers.

Stormcast, my name is Johannes Ulrich, recording you today from Jacksonville, Florida.

And this episode is brought you by the sands.edu undergraduate certificate program

in Cybersecurity Fundamentals. Well, and today, once more I wrote about the dot well-known directory,

of course, have written about this in the past. Most recently, I think was last week about

some back doors and such, some web shells that people left behind in that directory.

Today it's a little bit different.

Actually, no honeypot data for a change, but instead something I observed on our ISC web server,

and that is that attackers are scanning for URLs in the dot well-known directory that are

valuable for reconnaissance.

There are a number of systems that add configuration files to the dot-well-known directory,

like, for example, the terraform.

JSON file that will give an attacker, of course, some hints as to what

APIs your particular system supports. Some of them are required, like that Terraform.org

dot JSON file in order to use these tools effectively. Also, these Oath and Open ID configuration

files are required if you would like

to use these systems. In so far, it's not a good idea to remove those files from your system

in case you see them on your system. Sometimes they're not even files, they're just APIs

themselves that create those responses dynamically.

So what you want to do is you want to at least keep an eye on these locations and make sure that what's being published here is supposed to be published.

I think it was yesterday or at least earlier this week where we had one case where one of these files did include

some secret keys, some API secrets, not just the public keys that are usually supposed

...