SANS Stormcast Thursday, October 15th, 2026: Orphaned VBA Macros in AutoCAD DWG Files; Ledger Wallet Hardware Implants; Docker Hub Token Bug (CVE-2026-105445); curl HTTP/2 RCE

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10138.mp3

previous

Orphaned VBA Macros in AutoCAD DWG Files; Ledger Wallet Hardware Implants; Docker Hub Token Bug (CVE-2026-105445); curl HTTP/2 RCE

00:00

iTunes

MP3 Download

RSS Feed

Google

Podbean

Amazon Echo

YouTube

Spreaker

Spotify

Discussion

Login here to join the discussion.

Podcast Transcript

 Hello and welcome to the Thursday October 15th, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich recording today from
 Amsterdam, Netherlands. And this episode is brought to you
 by the SANS.edu Graduate Certificate Program in Cyber
 Defense Operations. Didier today provided us with an
 update on a problem that he discussed in the past and
 that's Visual Basic for Applications scripts inside of
 AutoCAD files. AutoCAD files just like Office documents can
 carry the scripts with the same devastating consequences
 if you start a malicious Visual Basic for Applications
 script inside your AutoCAD files. Now back when Didier
 discovered this issue he wrote an extension to his scripts to
 extract these OLE documents and with that the Visual Basic
 for Applications scripts from the AutoCAD files. But lately
 Didier has come across some files that no longer had a
 pointer actually pointing to the Visual Basic for
 Applications file or the OLE document containing them
 inside the AutoCAD file. So Didier, well as usual, came up
 with another trick to extract the Visual Basic for
 Applications script from the file. Now the other odd thing
 is how these particular scripts ended up being no
 longer referenced by the AutoCAD file and with that
 also being ineffective. Well Didier suggests that there is
 an AutoLISP command that may have been used to delete
 these files which actually doesn't delete the file but
 well as so often just deletes the pointer pointing to the
 file so they are no longer effective and visible but
 still present inside the AutoCAD file. Cryptocurrency
 wallets made by Ledger apparently have been
 distributed with hardware implants. This apparently
 started happening in early spring this year and Ledger
 had been notified at the time but it hasn't really been made
 public until more recently and we now had wallets sold in
 Asia initially being found with these implants and more
 recently like in the last couple weeks also Ledger
 wallets sold by MediaMarkt, a large European electronics
 retailer. Apparently all these wallets were sold by
 authorized Ledger resellers, however it's not clear where
 these wallets were actually made whether or not they were
 made by authorized manufacturers by Ledger or
 whether they came from some kind of third party. The
 implants include an LTE module with a SIM card that is then
 being used to exfiltrate the seed phrase used by the wallet
 in order to then steal the cryptocurrency and according
 to some reports up to a hundred million dollars in
 cryptocurrencies have been stolen so far. If you're using
 a Ledger wallet please be careful and make sure that it
 doesn't contain an implant. Sadly that may require
 actually opening up and physically destroying the
 wallet. So probably best thing to do right now is just move
 your cryptocurrency off any Ledger wallets that you may
 have. And Docker Hub fixed an interesting security
 vulnerability that came about when a user did convert their
 personal account to an organization. In this
 conversion the user is able to designate a target user that
 is basically then the owner of the repository and in the
 process also the old user's personal access tokens are
 moved to that account. Now the problem with this is that the
 old owner still has access to these personal access tokens
 of course and the new owner is never really asked to confirm.
 So the end result is that someone could essentially add
 personal access tokens to an arbitrary user's account and
 then use them to authenticate as this user. Docker Hub has
 fixed this issue now and this should be a problem. They also
 state that they went back and looked at prior conversions of
 accounts and made sure nothing bad happened there and also
 notified users of the fact that the personal access
 tokens that were added to their account could have been
 used by a prior user of those tokens. So double check in
 case you were affected by this issue but should all be taken
 care of by now. And the curl project did release an update
 fixing a number of vulnerabilities one of them
 allows remote code execution. In order to trigger the
 vulnerability curl has to be used to upload a file over
 HTTP/2 to a malicious server. The malicious server can then
 trigger the remote code execution vulnerability.
 Daniel Stenberg the author of curl has a great detailed blog
 post about the vulnerability how it happened and how it was
 fixed. There is a proof of concept available for this
 vulnerability. So something that you probably want to fix
 if you are using curl to upload files to servers that
 you don't fully trust. Well and that's it for today.
 Thanks for listening. Thanks for liking. Thanks for
 recommending this podcast and talk to you again tomorrow.
 Bye.