Hello and welcome to the Monday, May 5th, 2025 edition of the Sands Internet Storm Center's Stormcast.

My name is Johannes Ulrich and today I'm recording from San Diego, California.

And as promised this weekend, DDA released his steganography challenge.

So this is a further evolution of a couple diaries that

did he recently published regarding steganography and how to use his Python scripts in order

to help you extract hidden messages from images. This is a sample image using a slightly

different methodology here, but the tools should still work.

I think I may give away a couple of stickers or so to some of the solutions left to figure out

how to exactly do that. But if you're interested, submit your answer to either our handler's email or to DDIT directly and, well,

we'll see what we can do with regards to prizes for this challenge. There's also a little hint

there that is Rod 13 encoded, so give you a little bit more of a hint if you are just stuck with this particular

challenge. Then we have a couple of news items related to Microsoft and passwords. First of all,

Microsoft is now starting to offer pass keys by default. If you're setting up a new Microsoft account,

you'll be offered to use pass keys. And as a result, well, you will no longer have a password

for your Microsoft account. So this is further sort of pushing the agenda here of getting

rid of passwords, replacing them with

pass keys.

Certainly a solid security decision that many organizations have sort of embraced on, but

this is probably pushing it further than others have done in the past, but just making that

the default.

The only issue here, apparently, is that this really only works

if you're using the Microsoft Authenticator.

...