SANS Internet Storm Stormcast: September 12, 2025 Edition on Cybersecurity

In this September 12, 2025 edition of the SANS Internet Storm Stormcast, Johannes Ullrich, recording from Jacksonville, Florida, presents several crucial topics in cybersecurity.

The first topic discussed is an update from Ghee regarding the dshield seam, a tool he created and maintains. This seam is particularly useful for users of honeypots, systems designed to attract and analyze attacks. The graphical interface of this tool allows for more intuitive visualization and analysis of attacks, without requiring advanced command-line skills. It offers geographical maps, port statistics, and other valuable information for understanding attacks. One of the advantages of this seam is that it runs entirely within Docker containers, making updates much easier. However, it requires more processing power than what is found on a basic Raspberry Pi, but it works well on more powerful systems or virtual machines. The tool uses the Elk suite (Elastic Search, Log Stash, Kibana), familiar to those who know these tools.

Another important point is the increase in attacks against Sonic Wall SSLVPNs, reported by the Australian Government's Signals Directorate. These attacks are related to a vulnerability from the previous year. The major issue here is twofold: on one hand, some devices are still not patched; on the other hand, even if the devices are patched, they may already be compromised. Attackers can leave backdoors, add additional accounts, or steal credentials. Therefore, it is crucial, when updating these devices, not to settle for just patching. It is also necessary to change identifiers, passwords, SSH keys, secrets for two-factor authentication, and conduct a review of suspicious users and binaries. Without a quick and complete response, the device could remain compromised even after the update.

Finally, Johannes Ullrich discusses a study conducted by researchers from the United States and Europe on the use of keystroke detection via JavaScript on various websites. This technique allows sites to capture each keystroke, even before a form is submitted. This poses significant risks to privacy, as sensitive information such as passwords can be captured even if deleted before sending. Sometimes, this technique is used to detect human behaviors or to protect against copy-pasting, but it remains problematic. A recent study showed that both malicious and non-malicious sites use these techniques similarly. To protect oneself, it is advised to be cautious about what is typed and to monitor network requests in the browser's development tools.

In conclusion, this edition of the Stormcast provides valuable insights into cybersecurity tools, current vulnerabilities, and online tracking techniques. It emphasizes the importance of vigilance and rapid response to threats.