Podcast Detail

SANS Stormcast Monday, July 20th, 2026: Hikvision Scans; LG Spyware; Huggingface Hack; Wordpress Core RCE

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10014.mp3

previous
Podcast Logo
Hikvision Scans; LG Spyware; Huggingface Hack; Wordpress Core RCE
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

Podcast Transcript

 Hello and welcome to the Monday July 20th, 2026 edition
 of the SANS Internet Storm Centers Stormcast. My name is
 Johannes Ullrich, recording today from Jacksonville,
 Florida. And this episode is brought to you by the SANS.edu
 Graduate Certificate Program in Penetration Testing and
 Ethical Hacking. Well, today's Storm Center Diaries from our
 good old friend Hikvision and some new scans that we are
 seeing for the Hikvision Open Intelligent Security API. This
 API, often abbreviated as IS API, is used essentially to
 remote control these cameras and configure them. It's a
 fairly straightforward REST API using basic or digest
 authentication. Now, the scans we are seeing, they are
 looking for the system slash status endpoint. That
 particular endpoint essentially sort of
 fingerprints the camera or the DVR that the cameras are
 connected to. I believe this is really more sort of a
 reconnaissance scan we are seeing here. Not an actual
 attack yet. But I haven't really seen sort of scans for
 this particular URL before. So I figure that maybe someone
 found something new here. Could be used for brute
 forcing because this particular endpoint is always
 available on these cameras. And as a result, it could for
 example, look for 400 errors. Whether or not it doesn't
 exist like a 404 or maybe a 401 or 403 error if
 authentication fails. And late last week, we had multiple
 news outlets report about LG monitors installing adware and
 well also spyware on users systems. Now, maybe a little
 bit surprised that you have software being installed by
 your monitor. But essentially what the LG is taking
 advantage of here is the Windows device manager and
 Windows update, which automatically can install
 software like drivers, but also control panels on your
 system as new hardware is installed. And it's supposed
 to make basically the install experience more streamlined
 and easier for the user. But of course, the manufacturer
 can install whatever software they wish on your system. And
 LG took it upon himself to basically show us how far you
 can push this feature. What they're installing is the on
 -screen control plus software. It's also quite difficult to
 remove the software from the system. You have to delete
 certain registry hive to really get rid of the
 software. And if you have an older LG monitor, you're not
 safe due to Windows update. Always looking for a new
 software for your hardware to install. You may also be
 exposed to this malware. Now, according to some reports, in
 particular Gamer Nexus has sort of looked into this at
 some detail. The number one ad you'll see is for McGaffey
 Antivirus, which of course is a little bit ironic right
 there. But well, it isn't the first time that you sort of
 have sort of these aggressive ads in particular, usually
 from pre-installed software. But this is software that's
 not sort of pre-installed by the vendor of your computer.
 It's being installed by the monitor on first detection of
 the monitor by your system. I'll add a link to the Gamer
 Nexus video, which does have a little more detail also about
 other things that LG is doing with their smart TV. And maybe
 I'll also link to one or two of the news articles. But
 you'll probably have no problem finding them yourself
 with a quick Google search. And AI community website
 Hugging Face did publish an advisory disclosing a breach
 that recently happened and compromised credentials at
 Hugging Face. A little bit ironic here that they actually
 say it was sort of a full AI agent led attack that did
 compromise Hugging Face. And after the attacker gained
 initial access by actually feeding a data set to a
 pipeline that exposed the code execution vulnerability, they
 then pivoted and harvested cloud and cluster credentials.
 Hugging Face recommends rotating access tokens and
 reviewing account activity if you're using Hugging Face.
 They don't state that they have any evidence at this
 point that user credentials were harvested, but they also
 ask users to let them know if they find any issues after
 reviewing their account activity. Also, Hugging Face
 does state that in order to analyze the incident, they
 actually took advantage of some AI tools. It's not a bad
 write up a little bit short at this point. But given that the
 attack just happened, I think they're still going to fill in
 some of the blanks here. And usually I don't talk about
 WordPress vulnerabilities because they're pretty much
 always plugin vulnerabilities. Not just too many of them to
 talk about. But thanks to Searchlight Cyber Security
 Research Team, we now have a remote code execution
 vulnerability in WordPress core. Apparently, the root
 cause issue here is a SQL injection vulnerability. It
 can be exploited without authentication via the
 WordPress REST API. Now, one fix here that's being
 suggested by Searchlight Cyber is to disable anonymous access
 to this API. WordPress has released update a patch to
 address this vulnerability. Any WordPress version, version
 6.9 or 7.0 is vulnerable unless you just installed the
 latest and greatest one for 6 .9 or 7.0. So another option
 you also have is install additional sort of plugins
 that will then block access to the vulnerable API. But what
 you really should do is just install the patch. And then,
 of course, also check whether or not it makes sense to
 disable access to the API from random users on the internet.
 Well, and this is it for today. So thanks again for
 listening. Thanks for liking. Thanks for recommending this
 podcast. And as always, talk to you again tomorrow. Bye.
 Bye.