Podcast Detail

SANS Stormcast Monday, August 3rd, 2026: zipdump.py update; Atomic MacOS Analysis; OpenAI Phishing; COLDCARD Vulnerability

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10034.mp3

previous
Podcast Logo
zipdump.py update; Atomic MacOS Analysis; OpenAI Phishing; COLDCARD Vulnerability
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

Podcast Transcript

 Hello and welcome to the Monday, August 3rd, 2026
 edition of the SANS International Storm Center's
 Stormcast. My name is Johannes Ullrich, recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu Graduate Certificate Program in Cyber
 Security Engineering. This weekend, we actually got a few
 nice diaries starting with one by Didier about sipdump.py, an
 improvement to an existing tool that Didier has written.
 Now, sipdump allows you to basically extract some of the
 metadata from a ZIP archive. Like even if they're
 encrypted, you often get, for example, the file names that
 are embedded displayed in the clear and that's essentially
 what this tool is extracting from the ZIP file, timestamps
 and the like. Then also the fact whether or not it is
 encrypted or not. Now, one problem was that what if the
 ZIP file is corrupt? Well, that sometimes happens in
 particular in malicious files where they're intentionally
 being corrupted in order to not allow analysis with
 standard tools like this. Well, Didier now added a little
 fix here. You can now display the metadata even if it's
 corrupt and then also define the encoding. Because that's
 not one of the problems with corrupt ZIP file, that you
 can't extract the encoding for the metadata. Well, it's
 either ASCII or UTF-8. So usually, it's not that hard to
 guess once you see the metadata to figure out whether
 or not it's one or the other or you just essentially proof
 -force it between these two options. And Brad wrote a
 diary going over an atomic macOS Steeler infection, also
 known as AMOS, just sort of the initials here of this
 particular malware's name. And in this particular case, it's
 not really a click fix. It doesn't sort of go over the
 capture thing. It just tricks you into believing that what
 you're installing is a macOS toolkit. They even registered
 sort of a reasonably plausible domain name, getmacouscloud
 .com. Well, in doing so, you basically copy paste their
 command to a terminal and then you basically run the command.
 There will be a pop-up asking for permission to install the
 software. But of course, you're inspecting software to
 be installed because, well, you inspect to install this
 macOS toolkit, which actually is kind of better than the
 click fix version of sort of this attack, but you don't
 really expect to actually install software because you
 think you're just solving a capture with the click fix.
 All the network traffic created by the infection is
 downloadable from Brad's site. So as usual, very educational
 here in going over this particular infection and,
 well, in a hopefully safe way, inspect the traffic and figure
 out how you may be able to detect similar infections in
 your own environment. Don't just go for the indicators of
 compromise here, would like these specific domain names.
 They're good and definitely something that you should be
 looking for. But imagine what's the next domain name
 that an attacker would register and you want to
 attack that as well. So definitely look more for the
 overall techniques being used here and not sort of for the
 very specific data items like IP addresses, hashes and
 domain names. And finally, Xavier saw in the wild a
 phishing campaign that was targeting chat GPT or open AI.
 What happened here is that an email basically arrives that
 claims that your subscription payment for open AI's chat GPT
 service failed. As a result, you should be clicking on a
 particular link that will then get you to a pretty convincing
 sort of chat GPT open AI lookalike site that will ask
 you for your credit card data. It looks like in this case,
 they're mostly after your credit card data. They're not
 so much going after open AI login credentials. That's of
 course, obviously another target that you often see
 here, where they're then trying to steal your tokens or
 access to your account instead of stealing your credit card
 data. I can imagine a phishing site that does both, but
 either way, probably something to include in some user
 awareness training if you are doing some kind of phishing
 training. Well, and then we got a new story regarding sort
 of one of my favorite topics that I haven't gotten to talk
 about lately, and that's random numbers. Random numbers
 are hard. The last example here is a cold crypto coin
 wallet called ColdCard. The idea of the wallet is it's a
 little sort of no ESP32, I believe, device that holds
 your crypto coins, meaning your private keys offline. And
 that of course is often considered sort of one of the
 better ways to store your crypto coins, that you're not
 storing them online on some website or some crypto coin
 exchange or something like that. But instead keep them
 offline. Well, maybe even on paper, but ColdCard keeps the
 entire crypto coin wallet accessible, but out of the
 reach of hackers or so at least they thought. The
 problem with crypto coins has always been that it relies on
 public private keys and it all depends on how secure, how
 random your private key is. Apparently what happened here
 with ColdCard is that they do have a good hardware random
 number generator, but due to a bug in their firmware, it's
 actually not used. Instead, it uses the random number pseudo
 generator, pseudo random number generator that comes
 with MicroPython. MicroPython is the Python implementation
 often used with these sort of small devices and like many
 sort of no IoT minimum devices like that. Well, the random
 number generator isn't really all that good. Not really
 meant sort of for cryptographic operations in
 particular, not meant to keep your crypto coins safe.
 Apparently last week, several users of ColdCard wallets have
 lost their crypto coin holdings. If you do own one of
 those wallets, definitely make sure that your crypto coins
 are still around and if they are still around, maybe move
 them to a different wallet. Meaning don't just print the
 secret keys from your ColdCard wallet, but create new key
 pairs and then move the coins over to the new wallet. Well,
 and this is it for today. So thanks for listening. Thanks
 for liking. Thanks for subscribing to this podcast
 and talk to you again tomorrow. Bye.