Podcast Detail

SANS Stormcast Wednesday, August 5th, 2026: Diagnostic Tool Hunt; Device Code Phishing; XCSSET; NuGet API Keys

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10038.mp3

previous
Podcast Logo
Diagnostic Tool Hunt; Device Code Phishing; XCSSET; NuGet API Keys
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

Podcast Transcript

 Hello and welcome to the Wednesday, August 5th, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu Graduate Certificate Program in Cloud
 Security. This weekend, our honeypots detected a scan that
 looked for related URLs that I haven't sort of seen being
 scanned like this before. Maybe I missed it. But all of
 the URLs are CGI scripts that are sort of diagnostic related
 like ping.cgi or diagnostic .cgi. A lot of the times these
 scripts execute operating system commands and are
 therefore vulnerable to OS command injection. I've seen
 also some old scans for these URIs that were related to a
 CrowdStrike Shellshock scanner. So also, of course, a
 possibility that these scripts may be vulnerable to
 Shellshock. Not sure how much that still is a problem. But
 then again, have been surprised before how long it
 takes to patch some of these vulnerabilities. As far as
 mitigation for OS command injection goes, I'll write a
 little bit about this in the diary. But it really comes
 down to separating your control plane from your data
 plane, not mixing commands and data. And there is sort of a
 nice C API, at least on Linux, that allows you with execv,
 that's short for exec vector, to sort of nicely separate the
 actual command and the parameters from each other.
 And that really should be sort of the preferred solution to
 avoid these type of vulnerabilities. Windows has
 similar things going. So I have actually an older video
 where I talk a bit in more detail about the Windows side
 as well. And ZeroBEC has documented some recent changes
 to greatness. If you're not familiar with greatness, it's
 phishing as a service kit. You essentially buy a subscription
 for it for a couple hundred dollars a month, and then you
 can use it to launch machine in the middle of the attacks
 in order to steal credentials. One of the latest additions to
 this kit is device code phishing. That's something
 that has been really a problem lately, in particular for the
 more sophisticated attacks. And it being added to
 something like greatness, of course, means that it's now
 more approachable for not so sophisticated attackers. So
 anybody with a couple hundred dollars to spare can
 essentially now launch these device code phishing attacks.
 For device code phishing, once the victim visits the phishing
 website, the attacker is initiating a connection to an
 authentication service that does support OAuth device
 codes. They're typically getting some kind of QRcode
 back that they display to the victim. The victim scans it
 with their device and then approves the connection. Of
 course, the attacker has to come up with some kind of
 pretext that tricks the victim into believing that this is a
 good thing, that they're scanning the code and then
 approving the connection. So it's pretty interesting
 because it really bypasses all the multi-factor
 authentication and a lot of other phishing-resistant
 authentication mechanisms because the victim is never
 really authenticating to a site provided by the attacker,
 but the victim's credentials are only going to the
 authentic site that actually then approves this device
 code. And Palo Alto has some updates regarding XSC set.
 This is a matter that attacks Apple developers, in
 particular those using Xcode. Like pretty much any IDE, if
 you are opening a project, you risk executing code. There are
 often some hooks, some install scripts alike that can be
 executed. Just by opening a project. And this is what XSC
 set here is taking advantage of in order to then hijack the
 developer's machine. Lots of new little things about this
 malware that make it yet more dangerous, more polymorphic
 code to make detection more difficult. Also more of the
 code's logic is only running in memory, is not written to
 disk, which also hinders detection of many of the
 endpoint protection tools that focus on disk activity. So if
 you're using Xcode, if you are developing regularly using
 Xcode, then take a quick look at this blog post and make
 sure that you're not trusting any projects that you may be
 downloading from untrusted sources like GitHub or other
 repositories. And of course, there is this ongoing race
 trying to secure the open source supply chain. We have
 had some changes made to GitHub and to NPM in recent
 days. The latest changes here coming from Microsoft.
 Microsoft is now reducing the API key lifetime for NuGet,
 which is the repository being used for .NET packages.
 They're reducing the lifetime to 30 days and that'll start
 in two weeks. Any API keys before that will then also
 expire. So definitely make sure that your API keys are up
 to date. And yes, let's see how it works. If theft of API
 keys is certainly a big issue in the supply chain attacks,
 I'm not sure how much it'll help to reduce it to 30 days.
 Often these API keys are actually used immediately
 after the compromise. So still up to you to secure those API
 keys for those 30 days. Well, and this is it for today. So
 thanks for listening. Thanks for liking. Thanks for
 subscribing to this podcast. And as always, talk to you
 again tomorrow. Bye.
 Bye. Bye. Bye. Thank you.