Hello and welcome to the Thursday, April 17th,

2025 edition of the Sands Internet Storm Center's Stormcast.

My name is Johannes Ulrich, and today I'm recording from Orlando, Florida.

And well, let's start with a surprise update from Apple.

Apple released a minor update for its operating systems, in particular

iOS, iPad OS, Mac OS, TVOS, and Vision OS. This update fixes a couple of bugs, but also

fixes two already exploited vulnerabilities. One of these vulnerabilities affects core audio and can be

exploited by making the user play a malicious crafted audio stream. The next one allows the attacker

with Arbiter Reat and Write capability to then be able to bypass pointer authentication.

This already is being exploited as well.

So you definitely do want to update these operating systems from Apple patches.

Again, should be available as of today.

And talking about Oracle, of course, we are still kind of not sure what exactly

happened with these decommissioned Oracle servers that apparently were breached

and our user credentials were stolen.

However, SISA now published some guidance as to how to

deal with this particular issue and how to protect yourself from any sort of follow-on exploits.

They're focusing rightfully so on the issue of possibly stolen credentials. So essentially,

make sure that you're changing credentials that may have been exposed. But they're also including here specifically credentials for sort of machine authentication,

basically any kind of API keys or such that may be exposed as part of that breach.

And of course, watching your authentication logs

for any unusual activity.

...