Hello and welcome to the Monday, November 3rd 2025
edition of the SANS Internet Storm Center's Stormcast. My
name is Johannes Ullrich recording today from
Jacksonville, Florida. And this episode is brought to you
by the SANS.edu undergraduate certificate program in
cybersecurity fundamentals. It was just about a week ago that
we got from Microsoft the emergency update for the
Windows Server Update service. This update fixed an already
at the time exploited vulnerability that can lead to
remote code execution. Well, since the vulnerability now
has been made public and also additional details about the
vulnerability have been made public. We have seen in our
sensors an increase in scans for port 8530 and 8531, which
are the two ports that are associated with WSUS. The first
one is just plain TCP. The second one is then also TCP,
but with TLS for the 8530 scan rates went up from about 800
or so a day all the way up to in excess of 3500 and similar
numbers for 8531. A little bit lower here, only about 3000
accounts here per day for 8531, which is probably just
because a little bit slower to scan and TLS if you actually
want to go through the TLS handshake. So assume that if
you haven't exposed the WSUS server, it has been found by
now. Now many of these scans are being done by researchers.
I saw Shadow Server, for example, in our data doing
some of these scans, Shadow Server will attempt to notify
entities of exposed servers. So please take those
notifications serious. And the Australian signals directorate
has published an advisory noting that an implant that
they're calling bad candy is being deployed to Cisco iOS XE
devices that are still vulnerable to CVE 2023-2198.
So this is a 2023 vulnerability. Apparently it's
still not patched. This particular vulnerability has
also priorly been exploited by, for example, Vault Typhoon
that took over a number of telecom providers. So
definitely, you know, make sure your Cisco devices are up
to date and having them not patched now for two years.
Well, it's probably not really excusable at this point. And
if you are finding devices that are not patched for that
amount of time, well, then by all means, consider them
compromise. Again, this vulnerability has been used by
a number of high profile threat actors. And of course,
details about the vulnerability and exploitation
of it have been disseminated ever since. The last few
weeks, we had a couple of incidents where malicious
extensions were published to the OpenVSX store. This is the
extension store where you can download extensions for Visual
Studio Code derived editors, like some of them that are
popular, for example, sort of in the AI coding community.
The problem with these extensions was that they
included malicious code that was actually encoded using
Unicode characters that were rendered as a white space. So
as a developer, if you even would have bothered to review
those extensions, you would have only seen sort of empty
lines and instead of actual malicious code. There was
later also a variant that used this for dependencies in order
to hide exactly what dependencies are being loaded
in code. But the reason this particular worm was also
referred to as class worm was that part of it was invisible.
Well, OpenVSX now responded to this incident and did share a
couple of things that they're going to do to actually
improve their registry. One is pretty straightforward, reduce
the token lifetime limits. That's of course, obviously a
little bit controversial because now how short you have
to make them to actually matter, then also make it
easier to revoke tokens. That is important if the developer
realizes tokens were stolen, that they can easier cut off
access to those tokens. And I think probably most
importantly, here's the third point, that they will improve
the security scanning at publication. In particular,
with these Unicode exploits and such, it should be rather
straightforward to identify them automatically. So that
would be a nice touch here if some of these extensions would
be scanned before they actually end up in the
extension store. Yeah, and then they just ask for overall
collaboration here in order to basically better identify
these malicious extensions. They also state that the
actual scale of the compromise may be somewhat exaggerated.
That's of course always a big question of how many people
actually not just downloaded these extensions, but actually
used those extensions and were then affected by the malicious
code embedded. That's of course always subject to
debate, but ultimately really nice that they're reacting to
it and that they're suggesting some reasonable ways to
improve the security of these extensions. Well, and this is
it for today. So thanks for listening. Thanks for liking
and recommending this podcast and talk to you again
tomorrow. Bye.
Bye.
