SANS Stormcast Tuesday, November 3rd, 2026: Multipath TCP (MPTCP) Detection; BTCPay Server 2.4.1 Hot Wallet Thefts; Barracuda ESG Flaws (CVE-2026-116606, CVE-2026-111560); Synology DSM Ransomware

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10162.mp3

previous

Multipath TCP (MPTCP) Detection; BTCPay Server 2.4.1 Hot Wallet Thefts; Barracuda ESG Flaws (CVE-2026-116606, CVE-2026-111560); Synology DSM Ransomware

00:00

iTunes

MP3 Download

RSS Feed

Google

Podbean

Amazon Echo

YouTube

Spreaker

Spotify

Discussion

Login here to join the discussion.

Podcast Transcript

 Hello and welcome to the Tuesday, November 3rd, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu Graduate Certificate Program in
 Cybersecurity Engineering. Yesterday and last week I
 talked about multipath TCP and the recent Linux vulnerability
 affecting it. Well today I decided to take a little bit
 of different approach, not really talk about the
 vulnerability, but talk about the feature. One big problem
 of course with some of the little more obscure features
 like this is that it's always hard to tell if you're
 actually using this feature in your network. And that's what
 the blog post is a little bit about, just to talk about
 whether or not this feature shows up in your network, how
 to detect it. It's essentially a specific TCP option you're
 looking for here, option 30. And then there are a couple
 subtypes that you may see. But yes, if you see option 30 in
 your network, then you are using multipath TCP. The most
 common use that I have seen is iOS devices connecting back to
 Siri. First of all, that's where I sort of first saw it,
 but it's also used for other iOS features like for example,
 Apple Music, I believe also uses it. So if you don't want
 to disrupt these connections, you may want to allow outbound
 multipath TCP to 17 slash 8. That's the IPv4 range for
 Apple that these connections are usually directed at. There
 is nothing really but Apple servers there. So the chances
 of an attack from that particular space are fairly
 low. And in general, outbound multipath TCP is not the
 problem here. It would be inbound. And yeah, while it's
 enabled on Linux, I don't really see it used usually.
 You would see it used on maybe some high performance servers,
 load balancers, things like that may use multi-path TCP.
 Another big story last week was also the compromise or the
 crypto coin theft from Binance. Now, this of course
 made the news big time. But what's often overlooked here
 is that there are many, many smaller crypto heists that
 keep happening because users either use insecure keys, they
 are downloading malware, or in the latest example, they're
 running an outdated server that manages their
 cryptocurrencies. BTCPay, so Bitcoin Pay is the latest
 example. They just published a good blog post where they're
 outlining some of the attacks that they are seeing against
 older versions of their software, in particular 2.4.1
 and earlier. Now, to put some perspective, 2.4.1 was released,
 I believe, in June or July. And then the next version,
 2.4.2, came out in August. So we're talking about a fairly
 recent update here. And definitely something that you
 need to keep an eye on. And yes, anything crypto coin
 related is money and with that needs to be well protected and
 kept up to date. And Barracuda did release updates for their
 products fixing two vulnerabilities, which are
 particularly devastating for their email security gateway.
 Now, in order to exploit these vulnerabilities, the attacker
 needs to have access to the admin interface of the
 respective appliance. And there are two vulnerabilities
 involved here. The first one is an authentication bypass.
 The second one is a command injection vulnerability. Now,
 in order to exploit the command injection
 vulnerability, an attacker needs to have administrative
 access. But that's where the other vulnerability, the
 authentication bypass vulnerability comes in. And
 the email security gateway is affected by both
 vulnerabilities, while the other products are only
 affected by the arbitrary code execution vulnerability. So in
 this case, the attacker would still need to gain admin
 access. As so often, please, please, please don't expose
 these admin interfaces to the public. Nothing good is going
 to happen. And users of Synology devices, please make
 sure that you're up to date. Synology did post a brief
 notice stating that they see active exploitation of units
 that are running old versions of DSM, the DiskStation
 Manager. Now, these are quite old version. They say it was
 patched in December 2024. But I see these types of devices
 often sort of lagging behind in updates, because they're
 often not easy to update. And updates are often also
 disruptive, as you have to take them offline for a little
 while. So double check, make sure that you're up to date.
 Synology doesn't really publish notices like this very
 often. So this certainly indicates that there is
 something happening where they really want to pay attention.
 Well, and that's it for today. Thanks for listening. Thanks
 for liking. Thanks for recommending this podcast.
 Thanks for subscribing. I also have two additional links in
 the show notes. One is for the SANS Difference Maker Award.
 So please take a look at that. And then also for future
 classes I'm teaching. Next one will be in DC in December. And
 that's a little bit more than a month out. So thanks and
 talk to you again tomorrow. Bye.