Hello and welcome to the Thursday, September 25th, 2025
edition of the SANS Internet Storm Center's Stormcast. My
name is Johannes Ulrich, recording today from Las
Vegas, Nevada. And this episode is brought to you by
the SANS.edu Graduate Certificate Program in
Cybersecurity Engineering. Today I wrote up a diary about
some recent attacks that we have seen against Hikvision
camera systems. These usually target DVRs, network connected
video recorders that various analog cameras connect to. We
have written, well, as early as back in 2014 about
vulnerabilities in these systems. This latest rash of
exploit attempts that I've seen, I would probably qualify
it more as a brute force attempt. They're using the
username admin and the password 11. So not even
123456, which tends to be the default password for many of
these Hikvision systems, at least the older ones. One of
the problems with these systems is that they often
don't come with a full keyboard, but you basically
use a mouse and an on-screen keyboard that usually defaults
to a numeric keypad in order to change your password.
Haven't looked at more recent devices and what changes have
been made. It's usually easier to change the password via the
web application, but in order to get to that point, you
first have to set a password using that on-screen keyboard.
Anyway, if you have a Hikvision system still around,
make sure you secure and patch it properly. There is a
possibility that this also attempts to exploit some older
specific vulnerabilities, but at this point, I really think
it's just essentially brute forcing, which also is a
little bit simpler here because the username and
password is just encoded in base64 and appended to the
URL. And then another blast from the past, and that's a
stack-based buffer overflow in SNMP. This was fixed by Cisco
as part of its September set of patches that were released
today. And this vulnerability is noteworthy because it
already has been exploited in the wild. I say blast from the
past because, well, I remember back in 2000, 2001, we had a
lot of issues with SNMP because of the little bit
difficult to power ASN.1 encoding that is used in SNMP.
No idea if this is also related to this vulnerability,
but the stack-based buffer overflow kind of would be a
typical vulnerability here. In order to exploit the
vulnerability, an attacker must have admin access to the
device and is then able to execute code on the device as
root. So this essentially is then usable as a persistent
mechanism to further compromise the device. And
again, noteworthy because it's already exploited in the wild.
And SonicWall released an advisory and firmware update
that for a change doesn't actually fix a specific
security vulnerability. Instead, the point of this
firmware update is to remove a rootkit that has often been
deployed as part of attacks on vulnerable SMA-100 devices.
These rootkits are typically, of course, not removed by
patches. Actually, patches typically don't make any
changes to the system other than fixing the security
vulnerability. And as pointed out before, well, whenever you
apply a patch, you should make sure that the system is not
already compromised. But this turns out to be quite tricky
with this particular rootkit. So SonicWall, in order to help
its users, has released this special firmware update. Even
if you don't believe that your device has been compromised, I
would still recommend applying this update because that's
exactly the problem here. It's really easy to miss this
rootkit and have a compromised device that, of course, then
later can be accessed again by the threat actor responsible
for the rootkit. Well, in the end is or better was near for
Windows 10 users. Turns out that Microsoft has given in
and will extend the Windows 10 end of support deadline that
was originally supposed to happen in October. Due to
public outcry, they initially relented in Europe and offered
free additional one-year essential support for Windows
10 in Europe. Apparently in the US they now have done so
as well. I couldn't find the original release from
Microsoft, so I'm linking in the show notes to a news
report about this. But initially it was supposed to
cost $30 to get continued basically basic support
security updates for a year. But this will now happen for
free. Well, and that's it for today. So thanks for
listening. Thanks for liking, recommending and for
subscribing to this podcast. That's it for today. And talk
to you again tomorrow. Bye.
