SANS Stormcast Wednesday, August 26th, 2026: Obfuscating SSRF; Paint and Photos AI Watermarks; FTP Banner C2;

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10068.mp3

previous

Obfuscating SSRF; Paint and Photos AI Watermarks; FTP Banner C2;

00:00

iTunes

MP3 Download

RSS Feed

Google

Podbean

Amazon Echo

YouTube

Spreaker

Spotify

Discussion

Login here to join the discussion.

Podcast Transcript

 Hello and welcome to the Wednesday, August 26, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu Undergraduate Certificate Program in Applied
 Cybersecurity. Last week I wrote about how we saw some
 simple attacks against our honeypots that apparently
 tried to exploit server-side request forgery
 vulnerabilities with the intent to retrieve data from
 the metadata service that we often see in systems hosted
 within cloud providers. This metadata service listens on
 the IP address 169.254.169.254.
 And of course, that's the IP address we saw here as
 part of the URL. Some simplistic filtering regimens,
 particularly in web application firewalls and
 such, may be looking just for this IP address. And in
 response to my post last week, Sean did a report that they
 saw some attacks that, well, used a little workaround here
 from the attacker's side. The attacker used a hostname
 instead of the IP address and then just configured the
 hostname to resolve to the particular IP address. Now,
 there are actually two domains that Sean observed that
 specifically are designed for that, nip.io and sslip.io. The
 remainder of the hostname is just the IP address you would
 like it to resolve to. You can either use them as labels like
 with dots or you can also use dash, which of course then
 wouldn't match a lot of filters. In addition, Sean
 also saw the domain oneu.ms being used. That one is a
 particular tricky domain. Again, the remainder of the
 hostname can be used to configure what IP address is
 being returned, but you can actually configure it sort of
 for these rebinding attacks where after a certain number
 of hits, the IP address then changes. Now, oneu.ms has this
 specific custom DNS server deployed. However, this custom
 DNS server is also available on GitHub and you're able to
 install it and use whatever domain you would like to use
 in order to get this particular attack working. So,
 interesting options here for the attacker. And of course,
 what this means for you as a defender, that you better make
 sure you are properly filtering URLs that you're
 taking and that you're connecting to because, well,
 if not, then you're susceptible to server-side
 request forgery. And this metadata service IP address is
 really just one of the sort of more popular attack targets
 for server-side request forgery. Recently, there was a
 lot of talk about AI models that started watermarking text
 and images they create. One often quoted solution here, if
 you don't want this to happen, is that you just use a local
 model. Well, looks like some local models at least are
 doing the same thing. There's an interesting blog post by Xu
 Zhang Li who looked into Microsoft Paint. Good old
 Paint, which, well, was always sort of a little bit of a joke
 of an image-editing program, but now also includes AI. What
 happens here is that the AI model actually runs locally,
 but in order to apply safety checks, the prompt is first
 being sent to a Microsoft server for vetting and
 filtering and then sent back to actually create the model.
 And that's where a server -created GeoID is being sent
 back that is then being included in the model as an
 invisible watermark. There's also a visible watermark
 that's just a little co-pilot icon in the corner of the
 image. That, of course, could easily be cut out by someone
 who would like to avoid it being visible or maybe just
 not being edited out with some other image-editing software.
 But the second invisible watermark is sort of embedded
 in the image itself. More details about how this
 watermark exactly works and how to decode it can be found
 in the blog post that I'll link to in the show notes. And
 then when you think you saw it all, well, SockRadar has a
 nice new command-control channel that they have
 observed some Windows malware using, and that's just using
 FTP server banners as a command and control channel.
 I'm not actually sure if you even need an FTP server to do
 this or just a NetCAD listener in order to send the commands
 back because FTP is a fairly simple protocol in that way.
 But either way, the bot is just connecting to port 21 on
 the command control server. The commands to be executed
 are being sent back to the bot and then being executed by the
 bot. Definitely watch for outbound FTP traffic. There
 shouldn't really be much, if any, FTP traffic these days.
 Some old update processes or something like this that you
 probably can easily enumerate, and the remainder, well,
 should really just not be using FTP anymore. Well, and
 that's it for today. Thanks for listening. Thanks for
 liking. Thanks for subscribing. Thanks for
 recommending this podcast and talk to you again tomorrow.
 Bye.