← SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)
SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)
SANS Stormcast Thursday, February 26th, 2026: CLAIR Model; Cisco SD-WAN 0-Day; Cortex XDR Abuse; OpenSSL Vuln;
00:06:48
SANS Stormcast Thursday, February 26th, 2026: CLAIR Model; Cisco SD-WAN 0-Day; Cortex XDR Abuse; OpenSSL Vuln;
Loading summary
Transcript1 lines
- [00:05]
A
Hello and welcome to the Thursday, February 26, 2026 edition of the SANS Internet Storm Centers Stormcast. My name is Johannes Ulrich, recording today in Jacksonville, Florida and this episode is brought to you by the SANS EDU Undergraduate Certificate Program in Cybersecurity Fundamentals. Our diary today comes from Claire Perry, a graduate of our bachelor's degree program. This diary presents the Clare Model. What this is about is it's about critical infrastructure. And typically when you're dealing with critical infrastructure, one of the big security models and frameworks that's often being used is the Perdoo model. The Purdue model is well established and extremely useful to sort of talk about some of these infrastructure security threats. But as Clare Parry here points out, the model is very insular in that it's great for you, like as an operators, a utility to talk about the security of an individual plant, but it kind of ignores the interdependencies because, well, you don't control many of them, so it just considers them sort of as inputs to your plant. Well, that's sort of what this is attempting to fix here. So this model, this framework is looking very much at interdependencies like external things like all the way to policies and such that may affect the security of your cradle infrastructure systems. It's a proposal at this point, so if you have any feedback or such, I'm sure Claire is happy to hear about it. And Cisco today published an advisory regarding vulnerability affecting Catalyst SD WAN controllers, also I guess formerly known as SD WANV Smart. This vulnerability CSS score of 10 allows an attacker without authentication to gain admin privileges on the device. What makes this even worse is that apparently it has been exploited since 2023, so two, three years already out there and being exploited, now discovered and finally being patched. Cisco's advisory also lists some indicators of compromise. Definitely pay attention to them and make sure that you are not already compromised given how long this particular vulnerability has already been used. There's also an interesting tal a blog post for this vulnerability. I'll link in the show notes to both and yet another defensive product being abused by attackers. Infoguard Labs is talking about how the Live terminal, which is part of Cortex XDR can be used as a command control channel. Nothing really surprising here in that sense that we have seen this with so many similar defensive products in the past where you get command execution, PowerShell execution and the like just by using this trusted product, which of course then much more easily flies under the radar and is not being detected. As I mentioned before, you must control These command control channels that you are using defensively to manage your systems to make sure they're not being abused, which means you need the audit logs and the like to be able to review who is doing what with these systems. And well set up necessarily alerts to constrain any malicious behavior. So if you're using Cortex xdr, take a look at this particular post here to figure out how this applies to your particular installation. Well, and OpenSSL published another update fixing a vulnerability that OpenSL ranks high. It's a stack based buffer overflow that could be exploited via smime, for example, like if you have some authenticated envelope data and such, and particularly if you're using AES GCM as a cipher, which of course is not that unlikely. And essentially it happens when you are parsing untrusted CMS or PKCS 7 data. The exploitability here is a little bit more tricky. It's definitely exploitable for a denial of service, basically crashes the process that is doing the parsing, but could potentially lead to code execution. Stack based buffer overflows of course, exploitability depends a lot on what kind of like safeguards the operating system, the compilers and so put in place. So that varies depending on the system you're working on and typically is not easily exploitable these days. If modern best practices were used. Well, and the good old idea of tar pitting is back these days when it comes to AI companies spidering and collecting data from various websites. The problem right now of course is that AI companies are building their models using data that's not necessarily supposed to be used for building AI models. So they're bypassing some of the copyright protections and such that you may have applied to your site. But well, tarpetting still works and what tarpitting usually refers to is where you basically just well clock a particular attacker with more or less invalid data in this case. So you're basically just throwing noise at the agent that is collecting data from your website, hoping that it will be built to the AI model and render it less useful and essentially just create more work for the AI companies trying to figure out your data. This is a blog post by Portspoof that was published yesterday and well, if you want to look at some of their methods, definitely take a look. And yes, some websites already deployed similar ideas. Well and that's it for today. So thanks for listening, thanks for liking, thanks for subscribing to this podcast and as always, special thanks to anybody leaving a good comment in your favorite podcast platform. Thanks and talk to you again tomorrow. Bye.