Summary4 min read

SANS Stormcast – February 27, 2025

Host: Johannes B. Ullrich
Episode Focus: High exfiltration ports in malware, malicious Visual Studio Code theme, developer workstation safety, major cryptocurrency breach, and vulnerabilities in NAKIVO, OpenH264, and rsync.

Episode Overview

In this episode, Johannes B. Ullrich delivers a succinct briefing on current issues in cybersecurity, highlighting trends in port usage by attackers, serious threats aimed at software developers, and newly discovered software vulnerabilities. The episode combines insights from guest contributors and recent high-profile incidents, with practical advice for defenders.

Key Discussion Points & Insights

1. Malware Leveraging High Ephemeral Ports for Exfiltration

[00:18–02:15]

Guest Diary by Robin Sarrier: Focused on the increasing use of nonstandard, high-numbered (ephemeral) ports (e.g., 60,000+) for downloading and exfiltrating malware, making detection harder.
Johannes explains how:
- Attackers avoid traditional ports like 80, 443, or 8000.
- Cloud environments and IP overloading lead to more legitimate applications also using high/odd ports.
- Dynamic port negotiation, once more common in VoIP/gaming, now appears in mainstream applications, further complicating detection.
Advice:
- Watch for HTTP/TLS traffic on atypical ports.
- Block outbound connections on high ports—but "be careful that you're not disrupting any important traffic."
- Quote [01:55] – Johannes:
  
  "Still something to look for. And if you can, definitely block outbound connections on these high ports, again, just be careful that you're not disrupting any important traffic."

2. Attacks Targeting Developers

a) Malicious Visual Studio Code Theme

[02:15–03:34]

Overview:
- Malicious Material Theme, with over 4 million installs, found in the VS Code Extension marketplace.
- The author is highly prolific, making the risk expansive.
- Discovery credited to Amit Azaraf, who is presently collecting compromise indicators.
Mechanism:
- VS Code themes, despite appearing cosmetic, can execute code, opening a path to deeper compromise.
Action:
- Theme has been removed from the store.
- Users with the theme are urged to contact Amit Azaraf or check for listed filenames.
Quote [02:56] – Johannes:

"Even a theme that pretty much just changes colors and such often has the ability to also execute code, and with that, of course, also execute malicious code."

b) Developer Workstation Compromise and Bybit Crypto-Theft

[03:35–05:05]

Incident:
- The Bybit breach resulted in $1.3–$1.4 billion in Ethereum lost, likely to North Korean threat actors.
- The compromise originated from a SafeWallet developer's workstation.
- Malicious JavaScript injected into their web application, specifically targeting Bybit. It altered Ethereum contract signing in real time.
Aftermath:
- SafeWallet now prompts users to verify contracts before signing.
Key Security Lesson:
- Reiterates the importance of separating development and production infrastructure, isolating privileged access.
Quote [04:17] – Johannes:

"A compromise of an individual developer's machine can... compromise your entire architecture."

3. Critical Vulnerabilities in rsync and OpenH264

[05:05–05:45]

rsync Vulnerability:
- Two flaws could allow an attacker to take over a server with rsync exposed to the network.
- Most rsync instances are not internet-exposed, but still a risk to monitor.
OpenH264 Vulnerability:
- Widely used video codec affected by a flaw that could allow remote code execution.
- Likely impacts multiple software products.
Quote [05:36] – Johannes:

"If you're watching video here, you're probably using the H264 codec... could lead to remote code execution."

Memorable Moments & Quotes

Detection tip for defenders [01:12]:

"...these random high ports that are even sometimes negotiated dynamically... sadly seen this more and more with mainstream applications as well..." — Johannes
Theme extension risk awareness [02:56]:

"...Even a theme that pretty much just changes colors and such often has the ability to also execute code..."

Notable Timestamps

| Timestamp | Segment | |-----------|----------------------------------------------| | 00:18–02:15 | High port malware exfiltration | | 02:15–03:34 | Malicious VS Code theme and user warning | | 03:35–05:05 | Bybit cryptocurrency theft and developer risk| | 05:05–05:45 | rsync and OpenH264 vulnerabilities |

Podcast Tone

Johannes maintains a friendly, direct, and educational tone, frequently cautioning listeners with actionable advice and drawing clear connections between news events and practical security defense measures.

Takeaways & Action Items

Scrutinize and monitor for high-port traffic, but ensure legitimate traffic isn’t affected.
Treat all code—even themes and plugins—as potentially dangerous if sourced from large marketplaces.
Enforce strict separation between developer workstations and production infrastructure.
Quickly review patching strategy for rsync and OpenH264.

For further information or to share questions, listeners are encouraged to contact the podcast at https://isc.sans.edu/contact.html.

Loading summary

Transcript1 lines

[00:00]
A
Hello and welcome to the Thursday, February 27, 2025 edition of the sans Internet StormCenter's Stormcast. My name is Johannes Ulrich and today I'm recording from Jacksonville, Florida. Well, today we have a guest diary by one of our undergraduate interns, Robin Sarrier. Robin is writing about the use of ephemeral ports in order to download malware. This is something that happens quite common where the web server that the attacker is connect to in order to download additional malware is not listening on port 80, 443, not even port 8,000, but instead on a very high port like 60,000 something or such. This is certainly something to look for where you're looking for anomalies, looking for HTTP traffic or HTTPs or TLS traffic for that matter. On these high ports you have to be a little bit careful. I particularly lately more and more seen it with web servers and such where they sometimes listen on these high odd ports in cloud environments. Also, I think in part also because of the overloading of IP addresses, people sometimes use these sort of random high ports that are even sometimes negotiated dynamically. So where you first have some kind of handshake that then defines what high port is being used. This used to be more common, like for a voiceover IP and for online gam, but I've sadly seen this more and more with sort of more mainstream applications as well, which of course makes a detection of this kind of attack activity more tricky. Still something to look for. And if you can definitely block outbound connections on these high boards, again, just be careful that you're not disrupting any important traffic. Well, and then we have actually two stories that are related to attacks against developers. One of my favorite topics, I definitely have to cover it here. The first one is a malicious theme for Visual Studio code. What makes this theme particular problematic is that it appears at least 4 million users have downloaded it. And the respective author of this theme and a couple others is one of the most prolific authors on the Visual Code store. Now this comes from Amit Azaraf. Amit did not disclose yet what exact the indicators are that made them believe that this particular theme is malicious. The theme was called the Material theme. And one little problem here is that when you're applying a theme like this, you're thinking you're changing the look and feel of the software, in this case visual code somewhat. But even a theme that pretty much just changes colors and such often has the ability to also execute code and with that of course also execute malicious code. It'll be interesting to See once Amit is coming up with more details here. At this point Amit is asking anybody who has this theme installed to contact them for more indicators of compromise. Now there are a couple listed here. Essentially the name of the theme files that you would have downloaded. The supposedly malicious theme is no longer available in the Visual Studio Studio code store. And the second developer story we have comes from the Bybit. I hope I pronounce this correctly. Breach. Probably have heard of this where Bybit lost something like 1.3 $1.4 billion in Ethereum to a likely North Korean threat actor. Well, the problem here apparently appears to be a compromised workstation of SafeWallet developers. SafeWallet is a company that provides web applications to basically facilitate the signing of these ethereum contracts. And JavaScript was replaced in their application that specifically targeted Bybit. So the next time Bybit went to the site, signed a digital contract, this malware intercepted this and then altered the contract. I just went to the Safe Wallet site just because I wasn't really familiar with the site. I'm not a big into cryptocurrencies and noted they now have a pop up before you go to the site that specifically asks you to verify the contract before you sign it. So I guess that's how they are trying to counter this a little bit. I think just yesterday I talked about how important it is to keep your development and production infrastructures separate. So a compromise. Often individual developers machine cannot compromise your entire architecture infrastructure. We've had this happen a couple times in the past where compromised developer machines sort of basically took down the entire organization. So please try to avoid this. Have some kind of privileged access workstation or whatever you want to call it that are specifically designed to just be used to for example manage things like updates, cryptographic keys and such on production environments. And then two other vulnerabilities I think you should be aware of. First of all, two vulnerabilities in RSync that could allow someone to take over a server running rsync. Definitely something to be aware of. Usually it's not really exposed like this to the network. And then secondly vulnerability in the OpenH264 codec. If you're watching the video here, you're probably using the H264 codec. It's one of the big codecs being used to encode video. So definitely that is probably affecting a bunch of different software and yes, could lead to remote code execution. Well, and that's it for today. So thanks for listening and thanks to everybody who is recommending this podcast. Just saw a nice post today on LinkedIn, I think. So thanks a lot for that. And of course always good to click the like or five Star or whatever your particular podcast app offers or leave a nice little review. Thanks and talk to you again tomorrow. Bye.