Hello and welcome to the Thursday, July 23rd, 20206 edition of the Sands and a Stormer's Stormcast.

My name is Johannes Ulrich, recording today from Jacksonville, Florida.

And this episode is brought you by the sands.edu undergraduate certificate program

in Applied Cybersecurity. Going over our web honeypod logs today, I saw two things that

I talked about the past, the first time at least I've seen them together, and that's GeoServer and

the Rondo Botnet. Now, GeoServer and the Rondo Botnet.

Now, GeoServer is one of those big Java applications that helps you process geolocation data.

It's often used for geographic information systems to essentially prepare maps for various purposes.

I don't think there are a ton of them exposed on the internet,

but I guess sufficient systems that they are worthwhile scanning by those botnets.

The vulnerability being attacked, here's an older one.

24 is when that vulnerability was originally made public.

It's an expath expression evaluation issue. Now, the botnet that's scanning for it is the Rondo

botnet. And Ronde is one of those, I would say, a little bit old-fashioned, funny kind of botnets.

It has this Chicago rap theme to it.

And if you're currently going to the website

where it originally pulled down the bash script,

well, you're getting some of the typical for this botnet

sort of advertisement for this Chicago rapper.

No idea how they're related.

If it's just a fan that wrote the botnet or how this exactly happened.

But yes, of course, the site is still compromised

...