Podcast Detail

SANS Stormcast Tuesday, August 11th, 2026: Solana Attacks; AI Generated Patches; Gunra Ransomware; Neo4J/GraphQL Patch

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10046.mp3

previous
Podcast Logo
Solana Attacks; AI Generated Patches; Gunra Ransomware; Neo4J/GraphQL Patch
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

Podcast Transcript

 Hello and welcome to the Tuesday August 11th, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu Bachelor's Degree Program in Applied
 Cybersecurity. Well, in diaries today, nothing too
 exciting. Some scans against our web honeypots for Solana
 endpoint. Now Solana is a development platform that's
 very popular for developers of cryptocurrency applications.
 If you're trying, for example, to get cryptocurrency payments
 working and the like, then that's sort of a popular
 choice. And now it does implement RPC, a remote
 procedure call API that uses standard JSON payloads. And
 that apparently looks like what the attacker is after
 here. So they're requesting a couple of different requests.
 One just looking for the health basically off at the
 endpoint. There one looking for the version and then one
 for current Ethereum chain being loaded. So that's really
 more reconnaissance. Haven't managed to get them sort of to
 launch any attacks yet, but keep refining the honeypot to
 provide better responses. So maybe in a week or so, we'll
 have sort of a better idea what the exploit chain looks
 like here. If you have any experience with this, I would
 appreciate some input into what the attacker is actually
 after in these particular cases. And of course, one of
 the issues that we're all worried about, well, tomorrow
 is also Microsoft's Patch Tuesday coming again, is just
 the large number of vulnerabilities being
 identified using AI. Now, one of the hopes here is that AI
 could also help patch those vulnerabilities or develop
 patches for these vulnerabilities. Well, the
 1Password off by one lab, not to be confused with Steven
 Sims, excellent live stream on YouTube, the off by one
 stream. I think he usually does that on Fridays. Anyway,
 they did look at the large number of vulnerabilities and
 associated patches. I think something like 6,000 or so of
 them. So the patches here were generated using AI. And what
 they found is that in half of the cases that they looked at,
 that the patch developed by AI did not really sort of address
 the vulnerability that was found here. And essentially,
 you know, had to be fixed up. So with that, the human
 intervention is still very critical in developing these
 patches. And of course, no, it's not just whether or not
 the patch actually fixes the vulnerability, but also what
 else a patch like this may break. And the FBI, together
 with a number of US cyber organizations, as well as the
 Korean National Police Agency, has published a report about
 the Gunra ransomware. This ransomware has been around for
 at least a year. And this report now outlines some of
 the techniques being used by this particular threat actor.
 Nothing sort of earth shattering in you here.
 Imagine that the initial access vector appears to be SL
 VPNs, even though they're not just looking for sort of
 vulnerabilities, but also for badly configured accounts
 where they can guess or find the password for. Once they're
 in, they're using, well, SMB and things like Windows screen
 sharing and such like RDP to then do their lateral
 movement. Like I said, nothing really earth shattering, but
 maybe a good chance to yet again, go over your
 architecture, run some tests, make sure that you have these
 attack vectors locked down because yes, that's exactly
 how probably most ransomware, not just Gunra, enters your
 network and then spreads internally. Well, and then we
 have an interesting patch for the Neo4j GraphQL
 implementation. GraphQL is one of those APIs that allows you
 to subscribe to events. So it's not just a sort of a
 simple request response pattern as we like have for
 rest, for example, and that is often implemented over
 WebSocket. Now with WebSocket, we can just basically set up a
 connection and then the server can send us data whenever
 there is an update available. So it fits very well that
 subscription paradigm. But you of course also need to
 authenticate. Now the way this is solved here is with JWT.
 JWT, a nice solution for this. You have a digitally signed
 statement basically telling the service what you have
 access to. The problem with the Neo4j implementation was
 that, well, they never check the signature. So you can
 essentially include any JWT listing, any claims that you
 may or may not have, and they're just being accepted,
 which allows you then to subscribe to events destined
 for a different user. So information leakage, that's
 the minimum property you have to be concerned about here.
 Not clear if an attacker could sort of not add subscriptions
 with this. I don't think so, but that's maybe possible. So
 definitely something that you do want to patch because,
 well, it will at least leak other users' data. Well, and
 this is it for today. So thanks for listening and
 thanks for liking, thanks for subscribing. Get ready for
 tomorrow's patch Tuesday and that's it. Talk to you again
 tomorrow. Bye.