Hello and welcome to the Tuesday, June 23rd, 2006 edition of the Sands Internet Storm Center's Stormcast.

My name is Johannes Ulrich, recording date from Jacksonville, Florida.

And this episode is brought you by the Sands.edu credit certificate program in cyber security leadership.

Web shells. Well, that's a topic that keeps coming up, and Xavier found a new one on GitHub.

These web shells are popping up ever so often. This one claims to be hard to detect or undetectable.

What this usually means it's just too new for signatures to actually have been added

to standard endpoint protection software that's often used to detect web shells.

A better way often to detect web shells is just to look for unauthorized changes than just looking

for signatures. Now, the way they are typically being deployed is that you have some kind of

unauthorized file, upload vulnerability, maybe a remote code execution vulnerability on a web

server, and then very typical, the first thing that an attacker is doing is maybe a remote code execution vulnerability on a web server.

And then very typical, the first thing that NetHacker is doing is using that vulnerability to gain persistent access by uploading a web shell.

So usually a little script in whatever language you're using on your server.

This one, I think, is written in PHP, but they exist for

pretty much any sort of web application language out there. And as a result, well, yeah,

pay attention to these web shells. No matter, you know, if the attacker uses AI or not,

detecting web shells is probably going to

help you either way. And GitHub is making some improvements to the security of its workflows

in order to prevent some of the more common supply chain attacks. The change they made this week is a change to the pull request target.

So when someone submits a pull request with this particular pull request target, you have

the option to initiate workflows. And these workflows do have access to secrets associated

with the repository. Since essentially anybody can initiate a poll request,

...