SANS Stormcast Wednesday, August 26th, 2026: Obfuscating SSRF; Paint and Photos AI Watermarks; FTP Banner C2;
Summary
This episode discusses evasion techniques for server-side request forgery attacks using dynamic DNS services like nip.io and 1u.ms to bypass filters targeting cloud metadata IPs. It also reveals that Microsoft Paint’s local AI features send prompts to Microsoft servers for safety checks, embedding invisible watermarks in generated images. Finally, the host highlights a novel command-and-control method where Windows malware utilizes FTP server banners to receive instructions, urging defenders to monitor outbound FTP traffic.
Topics discussed
Introduction and sponsor announcement
SSRF attacks bypassing filters via DNS rebinding
AI watermarks in Microsoft Paint and local models
Windows malware using FTP banners for C2
Outro and closing remarks
Listen ad-free on Castria