Podcast Detail

SANS Stormcast Thursday, August 27th, 2026: Entra ID Admins; Unifi Patches; log4j Vuln; Sleepwalker Malware

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10070.mp3

previous
Podcast Logo
Entra ID Admins; Unifi Patches; log4j Vuln; Sleepwalker Malware
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

Podcast Transcript

 Hello and welcome to the Thursday, August 27th, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu Graduate Certificate Program in
 Cybersecurity Engineering. Well, Rob is still at it,
 creating useful PowerShell scripts to inspect Entera ID
 configurations. The latest one looks at who has administrator
 rights. Now, this is a little bit more complicated than just
 looking for like administrators because, well,
 there are a bunch of different roles with some level of
 administrator privileges. There's not just the global
 administrator. There's, for example, also something like
 with global read permissions where, well, a user that
 basically can read everything, which in itself may not always
 be as defined as administrator, but certainly
 it's a role to keep an eye on. And what Rob's PowerShell
 script here does is basically collect all of the different
 roles and then either display how many users you have for
 each one of these roles or who the actual user is associated
 with this role. So quick little audit script that's
 certainly quite useful to find like leftover administrators
 that are no longer needed or maybe something malicious that
 was added by NetHacker. Ubiquiti today released
 Security Advisory Bulletin number 67. This bulletin does
 outline 22 different vulnerabilities that affect
 several products sold under the UniFi brand. Now, when
 you're patching these devices, keep in mind that, for
 example, if you have one of their dream machines or such,
 you may have to patch the operating system itself and
 then also applications that you installed on the device,
 like, for example, the Protect or the Network or the Talk
 product that is being sold under the UniFi brand. The
 vulnerabilities themselves, some of them have rather high
 CVSS scores, like 10 and there are a few 9.9s and 9.1
 vulnerabilities there. Some of the CVSS scores look kind of
 high, like there is a approach escalation vulnerability with
 a score of 9.9. However, the description is extremely
 sparse, so really hard to second guess here the rating
 for the CVSS scores. Also, a number of these
 vulnerabilities were apparently found by AI tools,
 which these days, of course, is no big surprise. As far as
 mitigations go, the bulletin doesn't really outline any,
 but pretty much all of the vulnerabilities from me
 scanning them do require access to the control plane,
 basically access to the respective UniFi application.
 So, just like with all similar applications, try to limit who
 can access your network configuration, your camera
 configuration systems and the like. And that will
 significantly reduce the exposure and with that the
 risk of exploitation. The actual patches were released
 over the last few days, so if you have auto update enabled,
 you're probably already set. And then we do have a new log4j
 vulnerability. Now, as this vulnerability became
 known, of course, there was a lot of talk about yet another
 log4j disaster. This one doesn't appear to be that
 severe, that bad, I should say. It's certainly a remote
 code execution vulnerability. It's a deserialization flaw in
 the filtered object input stream feature. The problem
 with this function is it's actually meant to do the right
 thing. You have deserialization because you do
 allow arbitrary objects to be deserialized. Well, the
 filtered part in filtered object input stream is
 supposed to exactly prevent this. But as so often, well,
 they're allowing one particular object in here that
 then actually can in turn itself create arbitrary
 object. So that gives you that famous gadget and with that
 remote code execution. One of the big constraints here is to
 for this to be exploitable is that you must have software
 that directly accepts these log4j serialized objects.
 That's typically not the case. So this is not like the old
 log4j vulnerability where I could send a request to a
 web server. And as that request is being logged, it
 would trigger the vulnerability. As a result,
 this is probably not exploitable in most software
 that uses log4j.
 So, I'll also
 link to Jeff's blog post in addition to the proof of
 concept exploit. So, yes, an exploit is known, is public.
 No patches available at this point and not even a CVE
 number yet. Apparently, the bug report that this was
 originally reported with wasn't made like hidden as
 usual security reports, but was left public for a couple
 of days. And that's sort of how this entire issue became
 public. And we got some interesting malware analysis
 from Dominic with Palo Alto. So, this malware is described
 as sleepwalker. And what makes it kind of unique and sort of
 also caught my attention is that it has a little bit
 unusual, at least these days, command control system.
 Usually these days you have the malware reach out to some
 kind of web server or such in order to retrieve
 instructions. Well, back in the old days, I've seen quite
 often sort of some passive listening for packets. There
 were some famous DDoS agents and such that did it. Well,
 this is exactly what this particular malware does. Also
 interesting that it sideloads itself into the antivirus
 product, ESET. And well, then it starts listening on the
 network for packets that match very specific characteristics.
 It actually doesn't appear to matter what protocol, what
 port, but then the payload has to match specific checksum
 conditions. If that's the case, they're then decrypted
 and interpreted as bytecode, which then instructs the
 malware to do various additional operations. So,
 interesting malware here and actually also a real nice and
 interesting write-up of some rather unusual malware that
 probably often is being missed because it doesn't have sort
 of that today classic kind of beaconing and such a behavior
 that you would typically see in malware. Well, and this is
 it for today. So, thanks for listening. Thanks for liking.
 Thanks for subscribing. And talk to you again tomorrow.
 Bye.