Hello and welcome to the Monday, September 29th, 2025 edition of the Sands Internet Storms Centers.

Stormcast, my name is Johannes Ulrich, recording today from Jacksonville, Florida.

And this episode is brought you by the Sands.edu graduate certificate program in industrial control system security.

Quick script from Jim this weekend for anybody doing forensics, instant response, something to convert the Unix timestamps in Bash History files to a more human-readable ISO format.

Adding timestamps to Bash history is obviously useful in instant response.

If it's not done by your system, all you have to do is add a hist time format variable to your

Bash RC or a similar file.

And with that, you basically define the format.

It's often defined as a Unix timestamp.

Part of this is to make it easy to sort.

The file is being written whenever a shell exits.

So if you have multiple shells running around the same time,

well, these particular commands may not necessarily be in time order as they're being saved to the file.

And of course, the usual caveats about this file being potentially manipulated or disabled

by an attacker applies.

And then we still have to talk about the Cisco vulnerability that I mentioned last week,

the vulnerability had already been exploited.

So again, this affects the ASA and firepower devices.

Note that exploitation of the devices likely started about a year ago. I've seen numbers in news articles

and so that mentioned two million affected devices. Now note that these are potentially

vulnerable devices, not exploited device. I think that distinction sometimes got lost in some of the articles that I've seen.

At this point, there's only a very small number of actual exploited devices as far as I've seen.

...