Hello and welcome to the Tuesday, September 2nd, 2025
edition of the SANS Internet Storm Center's Stormcast. My
name is Johannes Ullrich, recording today from
Jacksonville, Florida. And this episode is brought to you
by the SANS.edu graduate certificate program in cyber
defense operations. Well, back after a long weekend here in
the U.S., but Didier in Belgium has been busy fixing
bugs in pdf-parser. pdf-parser didn't allow you to extract
all filtered streams. Well, Didier actually goes a little bit
into details why this may not be such a great idea, why you
may want to send that actually to JSON outputs, but he fixed
the bug anyway, so you can now run this command with our
problems. And Google's threat intelligence group is warning
users of Salesloft Drift of possible compromise of OAuth
tokens. Salesloft Drift is one of those AI chatbots that
can basically connect to various backends, Salesforce,
Google Workspace, and the like, in order to basically
obtain data that it then uses in its conversations.
Apparently, vulnerability in Salesloft Drift allowed the
leakage of the OAuth tokens being used for these
connections. And as a result, in particular, Salesforce
instances were heavily targeted by these threat
actors, but also Google Workspace customers. This is
not a vulnerability in Salesforce or Google
Workspace. This is solely kind of on Salesloft Drift here.
Salesforce has disconnected Salesloft Drift from its App
Store, so you shouldn't be able to use it anymore, and
you shouldn't be at any additional risk at this point.
However, it's possible that over the last month or so,
these tokens were abused to steal data. The blog post by
the Google Threat Intelligence Group is going into more
details as to what exact the indicators of compromise are
that you may be looking for in your logs as well as how to
identify whether or not your particular instance was
compromised. Also, Google as well as Salesforce have
notified customers that they knew were affected. But again,
these may not be the only integrations that were
exploited in this particular breach of OAuth tokens. And
Salesforce is reporting that they are seeing threat actors
taking advantage of Velociraptor. Velociraptor, if
you're not familiar with it, is a fairly popular open
source tool that is used in digital forensics in order to
access remote systems. This way, you can essentially
download specific files that you would like to download
without having access to do full disk dumps and also by
doing everything conveniently and remotely. And that's
exactly kind of what attackers are abusing here. Attackers
essentially abuse the infrastructure you built for
security in order to use it against you. This isn't by far
the first time we have seen this. I remember earlier this
year, I think Vazoo, an open source EDR tool was abused
this way. But we've also seen this done with backup tools
and definitely also commercial tools like this being abused
by attackers. Whenever you build any kind of remote
control infrastructure like this, you of course have to
make sure that you're not building it for the bad guys
as well and that you carefully control how this particular
infrastructure is accessed and also what is exactly done
using this infrastructure. Same here with Velociraptor.
They're not abusing a specific vulnerability in the tool.
They're really just using the tool as it's intended to be
used. And SUSE is warning in an advisory that the tool DOI
Vector, which comes as a part of the Docker management tool
Rancher, is being deployed with a default password and
while the user isn't necessarily being prompted or
forced to change the password. This has changed now in the
updated version. A random password is being created and
then saved as part of the Neuvector installation. So
that should fix this problem. However, for existing
installations, it's important that you verify that you do
have some other password, not the default password that
you're using. Even if you're just upgrading, your passwords
aren't changed. I guess there's too much of a risk
that would break initial installs. So definitely make
sure that you're verifying that your install does not use
this well-known default password. Well, and that's it
for today. Thanks again for listening. Thanks for liking
and subscribing to this podcast. And as always,
special thanks for leaving good comments in your favorite
podcast platform. And talk to you again tomorrow. Bye. Bye.
