Podcast Detail

SANS Stormcast Tuesday, August 25th, 2026: DOUBLECUP PNG; WebAudio Fingerprinting; Expired Domains; Android; Car

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10066.mp3

previous
Podcast Logo
DOUBLECUP PNG; WebAudio Fingerprinting; Expired Domains; Android; Car
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

Podcast Transcript

 Hello and welcome to the Tuesday, August 25th, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu Graduate Certificate Program in
 Cybersecurity Engineering. Didier today looked closer at the
 latest version of the Double Cup Malware, in particular
 because it used PNG files in order to smuggle PowerShell
 scripts. What Didier found is that this is actually a very
 simple case in how the PNG file format is being abused.
 It really just has, well, the PNG extension and then the
 standard PNG header. Beyond that, it's just a simple
 PowerShell script. So not actually sort of really a
 complete image or not like any attempt to use EXIF data or
 anything like that in order to contain the malicious
 PowerShell script. The DA assumes that, well, the reason
 behind this is simplicity, because in doing a simple
 embedded PowerShell script like this, all the attacker
 needs is the standard DOS find string command in order to
 extract the PowerShell script and then pipe it to
 PowerShell, which will execute the code. So there is no
 specific software needed or such to actually extract the
 data. Then of course, that decoder or such could, of
 course, trigger an alert. Well, and the next story sort
 of falls into the category of things that you really notice
 if you're paying attention. Matt Callahan did pay
 attention and noticed that whenever he visited
 AliExpress, well, his audio stopped working, or at least
 that's what it appeared to be. Like many users, Matt uses
 headsets that switch automatically between the
 phone and the computer. And typically, he plays music on
 the phone, which of course then is audible via the
 headphones. But whenever Matt did visit AliExpress, well,
 the music stopped. And the reason behind this was
 apparently at least a newer technique to fingerprint
 systems. JavaScript provides a web audio API. And what
 AliExpress here does is essentially play some audio
 via the web audio API and then record the waveform that was
 created by JavaScript in order to play this audio. And
 apparently this is just like some of the other JavaScript
 tricks like Canvas and such, unique enough in order to
 further fingerprint systems, and not well known enough for
 users to actually block it. Now, AliExpress is supposed to
 use this as an anti-fraud measure. And there's certainly
 some truth behind where it's always a part of anti-fraud to
 try to fingerprint and try to identify users. But still, if
 you're not happy with this, well, Matt outlines some
 possibilities to block this particular fingerprinting
 technique. And apparently there's also a bucked tracking
 ticket up there for browsers in order to fix this issue.
 The audio itself is not audible, it's just created
 with a gain of zero. Well, if you have dealt with email
 delivery, you probably are familiar with DMARC. DMARC is
 one of those standards that you can't really live without
 if you want to make sure that your email is deliverable. In
 addition to DMARC, of course, we have SPF and DKIM. And one
 of the big reasons for DMARC is that you can define an
 email address and then any recipient who has issues with
 your SPF or DKIM entries can send you error reports. And
 that's actually quite useful. Now, they can be quite
 verbose. They can even include email samples, these error
 reports. The problem here is that in order to receive those
 reports, well, you need to maintain some endpoint to
 actually send these reports to typically an email address.
 And a researcher Alex Shakov with SH Consulting has figured
 out that for a number of well -known domains, the domain
 being used to actually receive these email reports, well, was
 expired. And just by registering the domain, it was
 now possible to receive these reports. This comes back to
 good domain hygiene, something that has been a problem in
 many, many different ways for a while now. So make sure if
 you are no longer maintaining a domain, if you let it
 expire, that you actually don't use it. And yes, all
 these email configurations like DMARC records need to be
 reviewed periodically in order to make sure not just that
 they are still sort of up to date with respect to the most
 recent version of these standards, but also that
 things like these reporting email addresses are still
 valid. Over the years, I've read a lot of papers, heard a
 lot of talks about the possibilities of hacking cars,
 but haven't really seen a lot of actual exploitation of car
 entertainment systems happening in the wild. Well,
 Kaspersky now observed malware being installed on Android car
 head units. So that's actually the unit installed in the car,
 not the Android or Apple phone actually connecting to the
 car. What apparently happened here was that these cars came
 preinstalled with a TWcore application. This application
 was not malicious. It was intended to keep the software
 updated. So it did pull a system at the manufacturer. It
 was a Chinese manufacturer to check whether or not there was
 any new software that needed to be installed. And
 apparently this channel was abused to then install malware
 on affected cars. The malware itself was a proxy server. So
 basically used to disguise other attacks, but I think
 also include some info stealer components and such. So
 basically sort of your standard, very common sort of
 Android malware. Since these systems do essentially run
 Android, that's no real surprise that some malware
 like this got reused to install on these car head
 units. Well, and that's it for today. Thanks for listening.
 Thanks for liking. Thanks for subscribing. Thanks for
 recommending this podcast and talk to you again tomorrow.
 Bye. Bye. Bye.