← SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)
SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)
SANS Stormcast Thursday, April 23rd, 2026: Stealing Telegram Sessions; Oracle CPU; Firefox Patches
00:08:00
SANS Stormcast Thursday, April 23rd, 2026: Stealing Telegram Sessions; Oracle CPU; Firefox Patches
Loading summary
Transcript1 lines
- [00:05]
A
Hello and welcome to the Thursday, April 23, 2026 edition of the sans United Stormcenters Stormcast. My name is Johannes Ulrich, recording today from Amsterdam, Netherlands and this episode is brought to you by the Sans Edu Graduate Certificate program in penetration testing and ethical hacking. Today we got another diary by one of our undercratted Sans Edu interns. Alcardy writes about how their honeypot got compromised. Initially it looked like, well, your run of the mill compromise. It did sort of check for crypto miners, tried to kill them, which is very typical for some of these mining scripts that take over Linux systems with weak passwords. But then things kind of changed. The script then went and looked for the TDATA file in the desktop Telegram folder. This is a typical location on a Linux system where Telegram the Messenger keeps their session data. So the content of the TDATA file are essentially session IDs that are being used to authenticate the client to Telegram's system. This session data could then easily be copied to another system and used to authenticate as the user. So it's essentially potentially as valuable as the username and password for a particular account. Even worse if the user had set up two factor authentication doesn't actually matter if the attacker gets a hold of this session data. Telegram remains to be a highly valued platform by criminals, in part because of its easy automation and of course of its worldwide infrastructure that is relatively easy to use and widely used, which of course makes it more difficult for organizations to block access to Telegram. Still something that you probably should monitor and definitely look for access to the TDATA file if you have some endpoint protection that can monitor this for Telegram users. Also, it's important to keep an eye out for any odd sessions that you see established to Telegram. Telegram in its security settings allows you to monitor which sessions are currently authenticated. So you could look or some devices that you don't recognize and then of course log out of systems if you no longer use Telegram on a particular system in order to invalidate the session data should it get stolen later. And then we got some breaking news from the Socket research team about yet another security scanner being compromised. This time it's Checkmarks turn the checkmarks Kicks Scanner was compromised. At least the Docker images that were offered as official checkmarks Docker images in Docker Hub. In addition to that, apparently also some Visual Studio code extensions published by Checkmarks were compromised as well. At this point it's still kind of under development here really. What exactly happened? The first draft or the first version of the Socket blog post was just published about two hours ago as I'm recording this and they state that they will make updates to this blog post as more details become apparent. But it looks like we are having here sort of the typical credentials dealer that we have seen in prior attacks like this, so definitely something to be very careful about. If you're using Checkmark Kicks and you did download images from Docker Hub today, you definitely want to double check and make sure that you didn't download any of the compromised images. Same is also true of course for any Visual Studio code extensions. So this particular attack there's no statement from Checkmarks that I have seen yet, but again we're fairly early on here. They're probably hopefully, I would say still working to figuring out exactly what happened before they make any statements here at this point. Also, the malicious Docker images were rolled back, so currently they're not available anymore on Docker Hub. But then again not really clear yet how long these images were available. So double check if you're using any of Checkmark's code and like we had with the Privy Scanner event and such, this is likely going to then lead to additional compromises down the road. And Oracle today published its quarterly patch update. This particular update fixes 481 different vulnerabilities, which isn't that unusually high of a number for Oracle. Remember this again, across these dozens and dozens of applications that Oracle distributes, nothing that sort of stood out in this particular update. There are a number of vulnerabilities that do allow unauthenticated remote exploitation. Not necessarily code execution, but many of these vulnerabilities are labeled with CV test scores in the 9 dot range. Didn't see a perfect 10 when I skimped the list, but as usual with Oracle for all the details, you must log in to an Oracle customer account anyway to really figure out what these warnabees are all about. And then of course figure out what of these applications actually apply to you. One of the critical warnabies also affects MySQL which of course is part of Oracle's portfolio. But, well, you may be running it without actually being sort of an official Oracle customer and talking about patching a lot of vulnerabilities. Mozilla released Firefox 150 and this version addresses 271 vulnerabilities typically. Well, a new release like Firefox usually fixes around a dozen or less vulnerabilities. This increase in vulnerabilities being addressed in this particular release is is linked to MOZILLA using the anthropic Mythos model in order to scan Firefox for vulnerabilities. They're seeing this as a big win, and I think they have a good point here. The title of the blog where they're introducing and talking about this is called the Zero Days Are Numbered. Just because they feel that this gives them a significant head start over attackers looking for vulnerabilities as well. We'll see where this all ends up, but I guess in a couple of months we'll see how many more vulnerabilities will be found after these 271 vulnerabilities have been fixed. Hopefully. Well, we'll see a significant decline in number of vulnerabilities being found and exploited. As usual, keep your browsers up to date. Restart them once a day in order to make sure that the latest updates are applied at least once a week. Double check whether or not you are actually running the latest version of your favorite browser. Well, and this is it for today. So thanks for liking, thanks for subscribing, and as always, if you have any feedback, if you think I should have covered a story that I missed or should have spent less time on a particular story, please let me know. Thanks and talk to you again tomorrow. Bye.