SANS Stormcast Tuesday April 15th: xorsearch Update; Short Lived Certificates; New USB Malware
SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)
SANS ISC Handlers
4.9 • 696 Ratings
🗓️ 15 April 2025
⏱️ 6 minutes
🧾️ Download transcript
Summary
xorsearch Update
Diedier updated his "xorsearch" tool. It is now a python script, not a compiled binary, and supports Yara signatures. With Yara support also comes support for regular expressions.
https://isc.sans.edu/diary/xorsearch.py%3A%20Searching%20With%20Regexes/31854
Shorter Lived Certificates
The CA/Brower Forum passed an update to reduce the maximum livetime of
certificates. The reduction will be implemented over the next four years. EFF also released an update to certbot introducing profiles that can be used to request shorter lived certificates.
https://www.eff.org/deeplinks/2025/04/certbot-40-long-live-short-lived-certs
https://groups.google.com/a/groups.cabforum.org/g/servercert-wg/c/bvWh5RN6tYI
New Malware Harvesting Data from USB drives and infecting them.
Kaspersky is reporting that they identified new malware that not only harvests data from USB drives, but also spread via USB drives by replacing existing documents with malicious files.
https://securelist.com/goffee-apt-new-attacks/116139/
Transcript
Click on a timestamp to play from that location
| 0:00.0 | Hello and welcome to the Tuesday, April 15th, 2025 edition of the Sands and at Storm Center's Stormcast. |
| 0:08.8 | My name is Johannes Ulrich and today I'm recording from Orlando, Florida. |
| 0:13.6 | Well, I think it was only a week ago that Didi promise to expand his tool XOR search with the ability to actually search for regular expressions. |
| 0:25.1 | This promise has now been fulfilled, actually has more to it. The original XOR search was |
| 0:31.0 | compiled executable. The new one is now a Python script, typical for DDA of course. |
| 0:38.3 | And with that comes the ability to not just specify regular expressions, but actually |
| 0:43.3 | Yara rules that you can use to search the result file for various strings. |
| 0:50.3 | And Yara supports regular expressions, so with that also comes regular expression support. |
| 0:57.1 | Pretty neat update to the tool. |
| 0:59.2 | Let the DAE know if you like it, |
| 1:00.9 | and of course there are plenty of examples |
| 1:04.7 | how to use the tool, |
| 1:06.0 | what the different output formats are |
| 1:08.1 | for the strengths that you are finding in the DA's diary today. |
| 1:15.1 | And then we have more news for users of TLS certificates. |
| 1:19.3 | The Certific Authority browser forum finally finalized their decision on shortening certificate |
| 1:26.5 | lifetimes. |
| 1:28.2 | First of all, it'll start with reducing the certificate lifetime to 200 days. |
| 1:33.9 | That'll start on March 15th next year. |
| 1:38.4 | Next we'll have again March 15th, 2027. |
| 1:42.0 | It'll go down 200 days. And finally, March 15th, 2027, it'll go down to 100 days. And finally, March 15th, 2029, it'll go down all the way to |
| 1:50.7 | 47 days. In order to support that, of course, you will need better automation. |
... |
Transcript will be available on the free plan in 10 days. Upgrade to see the full transcript now.
Disclaimer: The podcast and artwork embedded on this page are from SANS ISC Handlers, and are the property of its owner and not affiliated with or endorsed by Tapesearch.
Generated transcripts are the property of SANS ISC Handlers and are distributed freely under the Fair Use doctrine. Transcripts generated by Tapesearch are not guaranteed to be accurate.
Copyright © Tapesearch 2025.