SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

This episode discusses risks of connecting AI agents to unauthorized models, highlighting a honeypot study where attackers advertised fake endpoints to execute arbitrary commands.

Xavier analyzed 23 million files, finding most malware uses 32-bit C/C++ code, while Go is rare but evasive.

Jan discusses polymorphic phishing pages using obfuscated JavaScript that sometimes fail to load.

Rob shares a PowerShell script to audit Azure AD admin roles, helping identify excessive privileges.

This episode discusses evasion techniques for server-side request forgery attacks using dynamic DNS services like nip.

This episode analyzes DoubleCup malware using PNG files to hide PowerShell scripts and AliExpress employing Web Audio API for browser fingerprinting.

This episode covers Rob’s PowerShell scripts for auditing EntraID MFA compliance and analyzing login risks.

This episode covers two PowerShell scripts for Microsoft Graph to track stale accounts and Entra risk detections.

This episode covers a surge in SSRF scans targeting cloud metadata services to steal credentials.

This episode covers a Microsoft Copilot vulnerability enabling data exfiltration via pre-filled prompts and SSRF, highlighting AI access control challenges.

Johannes Ulrich discusses Apple’s latest iOS and macOS patches, noting most fixes target older iOS 18 versions.

This episode covers active exploitation of patched Apple screen sharing and GeoServer vulnerabilities, urging immediate updates.

Guy tested Gamma 4 AI to summarize honeypot malware data from VirusTotal and CyberCord, demonstrating efficient log analysis.

Johannes Ulrich discusses Linux kernel process accounting as a low-overhead logging tool, noting its utility for monitoring containers on Proxmox.

This episode covers Microsoft’s Patch Tuesday, highlighting critical DNS and DHCP vulnerabilities alongside a Zoom remote code execution flaw.

This episode covers reconnaissance scans targeting Solana RPC endpoints and questions AI's ability to generate effective security patches, citing a study where half failed.

The episode introduces Atuin, a tool that enhances Linux bash history using a SQLite database for better forensics.

This episode covers rapid SSH compromises, a Dell BIOS password vulnerability in SPI flash memory, and insecure random number generation in the CryptoJS library affecting crypto wallets.

This episode covers a Node.

This episode covers OS command injection risks in CGI scripts and Shellshock vulnerabilities, recommending execv for mitigation.

This episode covers malicious package adoptions in Arch Linux’s AUR, prompting a halt on new requests.

This episode covers DDA’s SIPDUMP.

Host Johannes Ulrich discusses an intern’s discovery of advanced hardware fingerprinting in honeypots, likely for AI training or crypto mining.

Johannes Ulrich discusses Apple patches for SIP archive vulnerabilities and clipboard access issues, noting MISC claims the core problem persists.