← SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)
SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)
SANS Stormcast Friday, May 15th, 2026: Website Fraud; Outlook Link Preview Bug; NGINX Vuln; Cisco 0-Day
00:06:54
SANS Stormcast Friday, May 15th, 2026: Website Fraud; Outlook Link Preview Bug; NGINX Vuln; Cisco 0-Day
Loading summary
Transcript1 lines
- [00:05]
A
Hello and welcome to the Friday, May 15, 2026 edition of the SANS in the Net Stormsnares Stormcast. My name is Johannes Ulrich, recording today from San Diego, California and this episode is brought to you by the SANS Edu Crad certificate program in penetration testing and ethical hacking. Well, today we have actually two diaries to talk about. The first one comes again from one of our undergraduate interns. Joshua Nicholson is writing about how to essentially inspect a website to see if it may be fraudulent. These are often these fairly cheap consumer goods websites that offer various items at a really good price, but, well, don't really look quite legit in part because of the design and the way the sites are created. So it's always a little bit difficult to figure out if they actually offer a valid product or if they're really just interested in scamming you. Well, in this particular case, Joshua offers a couple of hints that point to scam sites like for example, where product images were stolen from ebay listings and the like. And also then sort of as the ultimate proof, Joshua actually went ahead and got a specific credit card number with very small limit of $5 and placed an order. And in some of these cases and some of these websites, well, the card was immediately charged multiple times from multiple vendors for various amounts that were not necessarily related and anything close to the cost of the item advertised on the site. So real good work and I think that's useful, kind of sort of to have some quick sanity checks on a website, figure out if it may be legitimate or not. Now going all the way and actually trying to order something using some credit card number that's probably too much for most people. But even the other hints are quite good in order to sort of do a quick triage on any deal that may look a little bit too good. And Jan came across an interesting bug or dare I say vulnerability in Outlook. Outlook, if you are placing a message in the junk folder, has the nice property of actually removing some of the formatting from the message, making it a little easier to see what, for example, links are hiding. Now, Jan did just that. He had a spam message in the junk folder, but apparently the links were not displaying at all. Basically the URL that the link linked to. The issue here apparently was that these links were missing the scheme or protocol. So the HTTP prefix, it just started with the hostname, follow by the remainder of the URL. While these type of links are still working, basically HTTPs is then used as a default protocol in this case when you click on the link. This does make it technically an invalid URL and it looks like Outlook in the junk folder will not display these URLs because they don't match the pattern that Outlook is expecting for the URLs. This could be a problem because users are getting used to looking at the junk folder to figure out what a particular message may be attempting to accomplish, whether it is a real message or spam or phishing S in this case, and without the URL being displayed correctly. This of course is just getting more difficult and researchers from AI code security company Depth first have released a blog post with details regarding four vulnerabilities in Nginx. These vulnerabilities were disclosed to F5 and today in in sync with the release of the blog post, F5 also released patches for Nginx. I already have seen some of these patches also hit major Linux distributions. There are four different vulnerabilities that Depth first has uncovered. One of them particular sticks out and deserves some attention. It's a heap based buffer overflow in the mod rewrite module, and this vulnerability can lead to arbitrary code execution. The one caveat here is that the proof of concept being released so far only works if aslr, the address space layout randomization is not enabled. Usually for Linux distributions this is enabled, so you have a little bit extra time left here until attackers are finding the actual exploit that also supports systems with aslr. And Depth first stated that they believe this flaw is exploitable with ASLR enabled. It may however require a good number of requests to make the exploit work. So Proof of Concept is released. Proof of concept doesn't quite work with common Linux distributions, but well, only some changes are likely required to make it work with common Linux distributions. This is definitely sort of one of those patches that you want to get a handle on, probably before the weekend if possible. But I know it's not always that easy to update your web server, but again, major Linux distributions have patches available if you're not running NGINX and you have some extra time this Friday there is also a new critical vulnerability that was patched by Cisco in the Catalyst SD WAN controller. It's an authentication bypass vulnerability that got the distinction of a perfect 10.0 CVSS score. And yes, it's already exploited in the wild. So definitely take a look at the advisory published by Cisco. They also have some guidance here as to what to do if you believe that you're compromised. And no workaround here other than applying the patch. Well, this is it for today, so thanks again for listening. Thanks for liking. Thanks for sharing this podcast with your friends. And there will be no podcast on Monday due to my travel schedule. So talk to you again on Tuesday. Bye.