Hello and welcome to the Friday, November 7th, 2025
edition of the SANS Internet Storm Center's Stormcast. My
name is Johannes Ullrich, recording today from
Jacksonville, Florida. And this episode is brought to you
by the SANS.edu Undergraduate Certificate Program in Applied
Cybersecurity. Today's diary comes from one of our
undergrad yet interns, David Hammond. David wrote about
something that I always like to talk about and sort of
emphasize in this internship, and that's scripting. I always
think there are two kinds of security professionals, those
that know how to script and those that will be replaced by
a script. But what I often find is that students who are
more exposed to the Windows world, not so much to the Unix
world, often aren't exposed to scripting the same way how
Unix users are often more sort of naturally exposed to it.
However, we do, of course, have some great scripting
tools on Windows. They're just a little bit more hidden
behind that GUI. And one of those tools is PowerShell. So
what David is looking at here, how do things that you
commonly do on Linux with command line tools like JQ and
such to parse, for example, JSON files, how do you similar
things on Windows? So great if you are more a Windows user
and are looking for an in to some of these scripting tools.
I often also think that on the Windows side, there aren't a
lot of great tutorials to do some of this common scripting,
as you often find it much easier on the Linux slash Unix
side. And earlier this week, I talked about Botnet that we
observed that did exploit a relatively new ex-wiki
vulnerability. Well, one of the odd things here was like
the email address that was left as part of a user agent
and such. Well, it turns out this was what's also known as
Rondo Bot or Rondo Docs. I mean, I have a great write up
here from Mario Candela. Mario runs his own honeypot called
Belzeboop. I think that's how you would pronounce it. And
this honeypot captured samples, including the second
stage that I didn't discuss in my blog. And yes, this
particular bot just recently increased the number of
exploits they're using in order to attack systems.
That's why it became more verbose. And with that also
triggered more alerts in our honeypot networks, which then
led to the diary. So great work here by Mario. And the
great sort of additional analysis that was missing from
my earlier blog post this week. And we got an update for
Google Chrome that you probably want to make sure you
update before the weekend. It fixes five different
vulnerabilities. None of them are exploited yet. Three of
the vulnerabilities are rated high. One that I'm
particularly concerned about here is affecting WebGPU.
That's sort of one of those lower level components. So
having some remote code execution here may certainly
pose a problem for Google Chrome. Maybe in particular
then, of course, with some kind of sandbox escape to
actually break out of the Google Chrome sandbox. Again,
nothing being exploited yet. But the reason I think you
should patch this relatively quickly is just because
similar vulnerabilities have been exploited in the past. So
there are probably some templates around that
attackers can use to develop exploits relatively quickly.
And talking about patches that you probably should take care
of before the weekend, the more tricky one here affects
the Cisco Unified Contact Center Express, also known as
Unified CCX. There are two vulnerabilities being
addressed in this update. The first one is an
unauthenticated arbitrary file upload vulnerability. But as
so often, that file upload vulnerability then quickly
escalates to full remote code execution. The second one
allows the remote invocation of Java functions, also
without authentication. As Cisco points out in the
advisory, these are two independent vulnerabilities.
So it's not that you first use the authentication bypass
vulnerability to then upload a file or vice versa. These are
completely independent. So each one of these
vulnerabilities can lead to a complete system compromise,
including gaining root access on an infected device. So
definitely update now, because particularly the exploit for
this. But I haven't seen one yet. It's probably already out
there, because this should be relatively straightforward to
exploit now. Well, and before I give you anything else to
patch on Friday, I better stop. Thanks for listening.
Thanks for subscribing, liking this show. And as always, talk
to you again on Monday. Bye.
