Podcast Detail

SANS Stormcast Tuesday, September 2nd, 2025: pdf-parser Patch; Salesloft Compromise; Velociraptor Abuse; NeuVector Default Password

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/9594.mp3

previous
Podcast Logo
pdf-parser Patch; Salesloft Compromise; Velociraptor Abuse; NeuVector Default Password
00:00

pdf-parser: All Streams
Didier released a new version of pdf-parser.py. This version fixes a problem with dumping all filtered streams.
https://isc.sans.edu/diary/pdf-parser%3A%20All%20Streams/32248

Salesloft Drift Putting OAuth Tokens at Risk
OAuth tokens used by Salesloft Drift users to provide access to integrations with Salesforce, Google Workspace, and others have been compromised and heavily abused for additional compromise and large-scale data exfiltration from exposed services.
https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift

Velociraptor incident response tool abused for remote access
Attackers are using the open source incident response tool Velociraptor to access remote systems in breached networks. Tools like Velocitraptor are ideal for attackers to perform lateral movement.
https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/

Default Password in NeuVector (Rancher Desktop)
SuSE fixed a default password vulnerability in NeuVector, a security tool included in Rancher Desktop.
https://github.com/neuvector/neuvector/security/advisories/GHSA-8pxw-9c75-6w56

Podcast Transcript

 Hello and welcome to the Tuesday, September 2nd, 2025
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu graduate certificate program in cyber
 defense operations. Well, back after a long weekend here in
 the U.S., but Didier in Belgium has been busy fixing
 bugs in pdf-parser. pdf-parser didn't allow you to extract
 all filtered streams. Well, Didier actually goes a little bit
 into details why this may not be such a great idea, why you
 may want to send that actually to JSON outputs, but he fixed
 the bug anyway, so you can now run this command with our
 problems. And Google's threat intelligence group is warning
 users of Salesloft Drift of possible compromise of OAuth
 tokens. Salesloft Drift is one of those AI chatbots that
 can basically connect to various backends, Salesforce,
 Google Workspace, and the like, in order to basically
 obtain data that it then uses in its conversations.
 Apparently, vulnerability in Salesloft Drift allowed the
 leakage of the OAuth tokens being used for these
 connections. And as a result, in particular, Salesforce
 instances were heavily targeted by these threat
 actors, but also Google Workspace customers. This is
 not a vulnerability in Salesforce or Google
 Workspace. This is solely kind of on Salesloft Drift here.
 Salesforce has disconnected Salesloft Drift from its App
 Store, so you shouldn't be able to use it anymore, and
 you shouldn't be at any additional risk at this point.
 However, it's possible that over the last month or so,
 these tokens were abused to steal data. The blog post by
 the Google Threat Intelligence Group is going into more
 details as to what exact the indicators of compromise are
 that you may be looking for in your logs as well as how to
 identify whether or not your particular instance was
 compromised. Also, Google as well as Salesforce have
 notified customers that they knew were affected. But again,
 these may not be the only integrations that were
 exploited in this particular breach of OAuth tokens. And
 Salesforce is reporting that they are seeing threat actors
 taking advantage of Velociraptor. Velociraptor, if
 you're not familiar with it, is a fairly popular open
 source tool that is used in digital forensics in order to
 access remote systems. This way, you can essentially
 download specific files that you would like to download
 without having access to do full disk dumps and also by
 doing everything conveniently and remotely. And that's
 exactly kind of what attackers are abusing here. Attackers
 essentially abuse the infrastructure you built for
 security in order to use it against you. This isn't by far
 the first time we have seen this. I remember earlier this
 year, I think Vazoo, an open source EDR tool was abused
 this way. But we've also seen this done with backup tools
 and definitely also commercial tools like this being abused
 by attackers. Whenever you build any kind of remote
 control infrastructure like this, you of course have to
 make sure that you're not building it for the bad guys
 as well and that you carefully control how this particular
 infrastructure is accessed and also what is exactly done
 using this infrastructure. Same here with Velociraptor.
 They're not abusing a specific vulnerability in the tool.
 They're really just using the tool as it's intended to be
 used. And SUSE is warning in an advisory that the tool DOI
 Vector, which comes as a part of the Docker management tool
 Rancher, is being deployed with a default password and
 while the user isn't necessarily being prompted or
 forced to change the password. This has changed now in the
 updated version. A random password is being created and
 then saved as part of the Neuvector installation. So
 that should fix this problem. However, for existing
 installations, it's important that you verify that you do
 have some other password, not the default password that
 you're using. Even if you're just upgrading, your passwords
 aren't changed. I guess there's too much of a risk
 that would break initial installs. So definitely make
 sure that you're verifying that your install does not use
 this well-known default password. Well, and that's it
 for today. Thanks again for listening. Thanks for liking
 and subscribing to this podcast. And as always,
 special thanks for leaving good comments in your favorite
 podcast platform. And talk to you again tomorrow. Bye. Bye.