Podcast Detail

SANS Stormcast Thursday, August 13th, 2026: Process Accounting; ShieldBreak; SharePoint JWT Vuln PoC; AI regulation

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10050.mp3

previous
Podcast Logo
Process Accounting; ShieldBreak; SharePoint JWT Vuln PoC; AI regulation
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

Podcast Transcript

 Hello and welcome to the Thursday, August 13th, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu Graduate Certificate Program in Cyber
 Defense Operations. Today, I wrote up a quick diary about
 Linux kernel process accounting. Nothing particular
 new, but it was sort of sparked by a comment by David,
 one of our readers here, that when he read about Xavier and
 writing about Atuin, that hey, some of this you can do
 actually with kernel process accounting sort of better. So
 what is it all about? Well, Linux kernels have the ability
 to create a log file whenever a process is terminated. And
 that log file then contains the process name. It contains
 the user who executed the process, how long it ran and,
 well, when it was exactly started. Including a couple
 flags like, for example, noting that the process
 crashed or that it was killed. So quite useful information.
 And all it takes is basically tell the kernel, hey, start
 writing this log. Now, there is a small tool, acct,
 basically account that you run to enable this feature in the
 kernel. And then the kernel just does its thing. So quite
 useful. Now, I run it on my Proxmox server and generates
 about sort of 50 sort of megabytes a day. So not really
 a ton of logs. Now, this is not a very busy server. But
 talking about Proxmox virtualization, one neat thing
 here is that it also sees all the processes inside
 containers. So you don't need to log this separately for
 each container. You just log it on the host. And actually,
 if the container isn't privileged, you can actually
 not run these tools inside the container. So useful
 information. I see it a little bit as complimentary to sort
 of bash history and Atomian tools like this because it
 does not capture the command line parameters that can often
 be critical. But the nice centralized way of doing it
 and the low overhead of the tool really makes it quite
 useful. And we got sort of the usual Microsoft Patch Tuesday
 cleanup tasks here. First of all, yes, it's Saturday,
 Wednesday again. Nightmare Eclipse did release an update
 to the Rogue Planet exploit, which was a bridge escalation
 via Windows Defender. Apparently, this hasn't been
 completely patched. So now we got ShieldBreak, which again
 brings back a bridge escalation via Windows
 Defender. So this probably is the usual cat and mouse game
 that hopefully won't last all that much longer. But yes, we
 got another round of it here. Well, and then we also have
 some exploits, at least one exploit for vulnerabilities
 patched yesterday. I told you to watch SharePoint. Well, we
 do have a proof of concept exploit for the SharePoint
 vulnerability. Rapid7 did release an analysis of this
 vulnerability. Apparently, it all comes down to JWT where
 the signature isn't validated. We can remember that a week
 ago or so we had another vulnerability like this. Maybe
 that's a new thing that testers are looking for JWTs
 where the signature is actually not validated. And
 that's apparently happened more than once. So yes,
 definitely make sure that you patch SharePoint. Well, as of
 the beginning of the month, the European Union requires AI
 content to be labeled. And this week, a similar law went
 in effect in California. So these two laws have prompted a
 number of AI companies to start watermarking their
 output. Now, this has happened for quite a while for images,
 but now it also happens more for text output. This only
 affects these public models with a significant user base.
 So, of course, an attacker using their own private model
 would not have to comply by these regulations, just like
 attackers usually don't comply by regulations anyway.
 Secondly, there is now also sort of a market for AI
 watermark removal tools coming up. I've tested a couple of
 them today and they work pretty well. And now, as far
 as the images are concerned, pretty much all of these
 watermarking techniques are based on adjusting pixel
 values slightly and with that embedding the watermark. The
 goal of these watermarks is to survive some basic
 transformations, like when you're changing image formats,
 resolution and the like. But if you're doing a more
 specific transformation, in particular, if you're reducing
 contrast or such, these watermarks usually disappear.
 And there are some more sophisticated ways also that
 will go at the essence of the information that contains the
 watermark. For text, it's a little bit more tricky, but
 apparently the main methodology being used here is
 Unicode, where Unicode characters are being used in
 order to put patterns into the text that are then
 recognizable as AI generated. And also identify at least the
 particular AI system that was used to generate the text. And
 can't do a Patch Tuesday wrap up without talking about
 Adobe. Adobe fixed vulnerabilities in five
 products. Two of them are sort of some of my favorites,
 ColdFusion and Commerce. Adobe ColdFusion fixes an OS command
 injection vulnerability with a CVSS score of a perfect 10.
 Adobe Commerce fixes a couple of remote code execution
 vulnerabilities and then also a privilege escalation
 vulnerability. So in particular, the two together
 likely will give you a system compromise. Anyway, get those
 things patched and hopefully they haven't been attacked
 yet. Well, and this is it for today. Thanks for liking.
 Thanks for subscribing. Thanks for recommending this podcast.
 Let me know if I made any mistakes. And with that, talk
 to you again tomorrow. Bye. Bye.