Podcast Detail

SANS Stormcast Friday, August 14th, 2026: AI vs. Honeypot Data; CPU Bugs; GeoServer 0-Day; Windows USB Driver Confusion

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10052.mp3

previous
Podcast Logo
AI vs. Honeypot Data; CPU Bugs; GeoServer 0-Day; Windows USB Driver Confusion
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

Podcast Transcript

 Hello and welcome to the Friday August 14th, 2020, 6th
 edition of the SANS in the Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu Undergraduate Certificate Program in Applied
 Cybersecurity. Guy ran a little experiment with his
 honeypot. Now, one problem that you're running into very
 quickly with honeypots is that, well, the honeypot
 collects matter that's being uploaded by attackers. And it
 very quickly becomes an issue of scale, even for an
 individual honeypot to actually go over all the data.
 So of course, these days, if you have a problem like this,
 you try to throw it to AI. Now, what Guy did here is Guy
 used Gamma 4. Gamma 4 is a local model. It's an open
 source model. So it doesn't require that you're connecting
 to any kind of frontier model. Of course, that also makes it
 cheaper, because you don't have to spend any tokens to
 get your answers. Gamma 4 is also small enough where it
 does fit into reasonably small memory footprints. What Guy
 did was not have Gamma 4 analyze the malware. Instead,
 Guy had Gamma 4 check sites like VirusTotal and
 CyberGordon, and then a sample summary for this malware. And
 in particular, Guy was focusing on like how dangerous
 is this particular malware is this particular malware, what
 should be done to basically figure out if you're
 compromised or not. So there's a couple of questions that Guy
 asked from the AI and then had it summarize the events from
 his honeypot. Gamma 4 did a pretty good job here in
 summarizing all the results that it retrieved from
 VirusTotal and from CyberGordon. These are the two
 sites that Guy used here, and certainly saved time in
 figuring out what's interesting, what's important
 in all of the logs collected by the honeypot. And then we
 got two new vulnerabilities affecting essentially some of
 the, well, hardware firmware, whatever you're going to call
 it, the underpinnings of how memory and how CPUs are being
 accessed. There are two vulnerabilities, very
 different vulnerabilities, both from the same researcher
 who's going by the name of Domas. The first one is called
 Skitter Creek Bath Salts, and it essentially rewrites memory
 mapping. So when physical memory is being accessed by
 your system, the actual physical memory has to be
 mapped to logic memory addresses. Simple XOR being
 written to one register here. So we're just flipping one
 bit. We'll rewrite this mapping. And now of course,
 well, the CPU doesn't necessarily know what memory
 to protect and how. And with that restricted memory is
 becoming accessible to a regular user. So that's the
 first one. The second vulnerability affects the
 system management mode. And this is a kind of a little bit
 tricky vulnerability. So what happens here is that NetHacker
 first attempts to switch the CPU to system management mode,
 which a user usually can do. The problem with system
 management mode is you can then execute, or the system
 can execute specific and privileged commands in system
 management mode. But it only works correctly, that security
 separation, if all cores are switching to system management
 mode. So the NetHacker now does execute a very slow
 command on one of the cores. This command has to take a
 second or longer. After a second, the process that waits
 for all of the cores to switch times out, and well, then you
 end up with one core being still in system management
 mode while others aren't, which then basically breaks
 that separation. And now you can basically use an
 unprivileged core to write memory that's then being read
 by one that's in the system management mode and execute
 code in system management mode. So interesting
 vulnerabilities. The memory mapping vulnerabilities does
 not appear like there is a simple patch for them. The
 memory mapping vulnerability has been demonstrated on AMD
 CPUs, but the researcher here is proposing that it may
 actually even work on ARM and RISC and other CPUs, so not
 just on x86. The system management mode, that's an x86
 feature, so all x86 CPUs should be affected by it. And
 security researcher Shi Hu Fang did on Twitter release an
 exploit for GeoServer. The exploit wasn't directly
 released, but screenshots of the inner workings, and it's
 just a simple SQL injection vulnerability. So apparently
 in Watchtower was quoted in the press that this is already
 exploited. So this also probably didn't take a long
 time to sort of reverse what GeoFung was doing here.
 Because like I said, it's just SQL injection. GeoServer had
 similar vulnerabilities in the past, which of course, now
 makes it an easy target to exploit yet again. In the
 past, we haven't seen too many GeoServer instances being
 exposed. It's typically used to manage geographic
 information system data. And two researchers, Alejandro
 Hernando and Borja Martinez, did disclose during DEFCON an
 interesting USB vulnerability in Windows. The way this works
 is that Windows does have the ability to automatically load
 drivers for USB hardware as you're plugging it in. Now,
 this has been abused in the past, but they sort of put a
 new spin on it. What they did is that they emulated hardware
 that had known vulnerable drivers that would then be
 installed. So they didn't load their own malware. That's not
 possible here because you basically have to have a
 registered device with Microsoft and then a specific
 file that's being downloaded. And they can't easily tamper
 with that file. But instead, it just relied on the
 vulnerable driver being installed. And you know, like
 all these bring your own vulnerable driver
 vulnerabilities, that driver now allows for privilege
 escalation or other exploitation via a USB device
 or via the keyboard. Well, and this is it for today. So
 thanks for listening. Thanks for liking. Thanks for
 recommending. And as always, talk to you again on Monday.
 Bye. Goodbye. Bye.