Podcast Detail

SANS Stormcast Tuesday, August 18th, 2026: Apple Patches; Screen Sharing Security; Download More RAM

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10056.mp3

previous
Podcast Logo
Apple Patches; Screen Sharing Security; Download More RAM
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

Podcast Transcript

 Hello and welcome to the Tuesday, August 18th, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu Graduate Certificate Program in
 Cybersecurity Leadership. Well, today we are a little
 bit heavy on Apple content here. First, we got Apple
 patches today for iOS and macOS. Now, I don't see a big
 surge here in a number of vulnerabilities like they've
 seen from Microsoft. So the AI search may not quite be
 happening for Apple as it does for Microsoft, but there's
 certainly some changes in how these patches are being
 released. First of all, we only got patches for iOS and
 macOS. We do have patches for the older version of iOS,
 that's iOS 18, in addition to the current version of iOS 26.
 Where it gets also interesting is that out of the 108
 vulnerabilities being addressed in this particular
 update, 87, so the vast majority, is affecting only
 the old version of iOS 18. So this may be a little bit sort
 of a catch-up kind of release. There are only six
 vulnerabilities that affect all three operating systems.
 They're all WebKit vulnerabilities. So really no
 surprise here in this case. Remember a couple of weeks
 ago, we also had the screen sharing vulnerability being
 addressed for macOS. So that, of course, didn't affect iOS.
 So we don't really have a corresponding patch for iOS
 this time around. Overall, nothing that's already being
 exploited. Nothing sort of outrageous, dangerous that I
 sort of could spot by scrolling through these
 vulnerabilities. Definitely get these updates applied. We
 often do see some exploits coming out relatively soon
 after these Apple updates. There's also a Vision OS
 update, but Apple has not yet released any details regarding
 security content of that update, which is a little bit
 odd because often, if they pre -release a particular
 operating system, they may not give us the details because,
 well, the vulnerabilities affect other operating system
 too. But in this case, we'll see what comes out when the
 Vision OS vulnerabilities are made public. And then, well, I
 already mentioned the screen sharing vulnerability. I did
 publish a quick diary with some details how to make
 screen sharing more secure or how to disable it if you want
 to disable it because apparently, yes, it's being
 exploited. And it's almost a bit surprising that people
 have something like screen sharing exposed. But I think a
 part of what can happen here is that if you have it exposed
 or have it enabled on your internal, like home network,
 and then you're moving that system out into the world and
 you don't disable it, that's, I think, where it often
 happens. Also, there are some sort of interesting quirks
 here. If you remember, one of the vulnerabilities that was
 being exploited or was being published a couple of weeks
 ago relied on the fact that Apple screen sharing is really
 VNC. And VNC has sort of this system-wide password you can
 use to gain access to the screen. And Apple still
 supports that mode. First of all, I think that's sort of
 one reason why people may have a weak password. And then this
 particular exploit relied on the fact that once you connect
 to the system, you may see a password prompt, but you're
 connected, the process that you're connected to actually,
 you know, runs with a super user with root capabilities
 because, well, it has to then switch to whatever user you're
 logging in as. So I would definitely keep that disabled
 and restrict who can actually use VNC and or screen sharing.
 And Apple does provide these controls, but don't enable the
 VNC viewers may control screen with password option. And
 that's also a little bit, I think, oddly named because it
 sounds like, hey, if you disable it, then it can access
 without password.
 But also another little bit odd naming or odd feature here
 is the Apple Mac OS firewall. I see that often cause
 confusion because when you enable the firewall, well,
 there is sort of by default an exemption for all system
 processes like screen sharing. So in addition to enabling the
 firewall, you have to disable the open ports for the system
 processes and also for like downloaded digitally signed
 processes. So only then are you actually closed down. Even
 if you enable the stealth mode, if you don't disable the
 system binaries and the signed processes, well, you still
 have those ports open. And those are really the ports
 that matter because that's where stuff is listening at.
 So in some ways just enabling the firewall probably doesn't
 really make a real difference. And well, then we got yet
 another attack against access control of memory. This one
 affects Windows or at least the attack was specifically
 designed for Windows. They call it download more RAM and
 a paper published by University of Birmingham
 researchers as well as a researcher from Durham
 University. It was just presented at the USENIX
 conference. The problem here is that on any RAM stick you
 have a little EPROM and this EPROM or EPROM contains well
 basically the basic configuration of your memory.
 Now turns out on quite a few different vendors RAM sticks
 this EPROM is actually writable so it's not locked
 down. Now in the past there has been a vulnerability that
 basically abused this EPROM but this required someone to
 actually remove the RAM stick and then connect an EPROM
 burner to the particular chip on the stick and then
 basically change the settings and then reinstall the RAM
 stick. That's of course a fairly complex attack with
 physical access like that. What they now found is that
 because this EPROM is not actually right protected on a
 lot of systems well it can be overwritten with software
 running on the system. The second hurdle they had to
 overcome was that this requires access to the I2C bus
 which on Windows does require elevated privileges. Again if
 you already have elevated privileges this is not really
 a valid attack. Well they found that this can be
 implemented with just by exploiting a vulnerable driver
 but then you kind of already have to approach escalation
 that way. The other option they found is they found a
 particular overclocking tool for Windows that comes with
 all the drivers and such properly signed so you can run
 it as a normal user and it also does allow access to this
 EPROM and can then be used to basically make it claim that
 you have more memory. So they're basically doubling the
 size of memory that the particular RAM stick
 advertises. What happens now is if you're trying to access
 memory that doesn't exist it's actually just being rolled
 back to memory that does exist. So there's this
 rollover happening and with that the operating system the
 system does think you are accessing well unrestricted
 memory but you're actually accessing completely different
 memory that may have some restricted data in it.
 Interesting attack and kind of amazing that the system
 actually boots and doesn't just crash. Windows has now
 addressed this vulnerability in last month so actually this
 month's update so that's why they're publishing this paper
 now. So it shouldn't be a problem anymore as long as you
 are up to date. Well and this is it for today. So thanks for
 listening. Thanks for liking and thanks for subscribing and
 talk to you again tomorrow. Bye.