SANS Stormcast Tuesday, December 9th, 2025: nanoKVM Vulnerabilities; Ghostframe Phishing; WatchGuard Advisory

Summary

SANS Stormcast Podcast Summary – December 9th, 2025

Host: Johannes B. Ullrich
Main Theme:
A concise review of important security events, focusing on nanoKVM device vulnerabilities, a novel Ghostframe phishing campaign, and a WatchGuard security advisory.

---

nanoKVM Vulnerabilities

Overview:
nanoKVM, an inexpensive remote KVM (Keyboard, Video, Mouse) switch, is highlighted as a device with significant and ongoing security problems.

Key Points:

• Device Purpose:
  nanoKVM provides remote access to a system’s keyboard, video, and mouse via IP – even surviving power outages ([00:33]).

• Security Concerns:

  • “This device does not scream secure, it screams cheap.” – Johannes B. Ullrich ([00:18])
  • Critical security weaknesses identified:
    • Poor password hashing and encryption.
    • Default enablement of SSH server with default password.
  • Vendor is slow to address vulnerabilities:
    “Researchers had had a hard time to convince the maker to fix some of these vulnerabilities.” ([01:14])
  • Firmware Update Flaw:
    • Firmware updates, especially for the proprietary binary blob, are insecure.
    • Potential for malicious (‘evil’) updates to be installed ([01:27]).

• Unexpected Microphone:

  • Device motherboard features a small, surface-mounted microphone, raising privacy concerns ([01:43]).
  • Possible benign reason: The board is repurposed from a single-board computer variant where a microphone is an advertised feature.
    • “There may actually be a benign explanation for the microphone.” ([01:46])
  • Physical removal of microphone possible but tricky due to size.

• Open-Source Solutions:

  • Ongoing efforts to develop alternate, open-source firmware based on Linux for security-conscious users.
  • Johannes has not tested these alternatives for reliability ([02:26]).

• Best Practice:

  • “Remember, never ever expose these devices to the Internet.” ([02:36])

---

Ghostframe Phishing Campaign

Overview:
Barracuda reports a new phishing kit dubbed “Ghost Frame” which evades traditional detection by leveraging deceptive use of iframes.

Key Points:

• Detection Evasion:

  • Phishing emails and web pages use benign HTML to pass automated detection.
  • The actual malicious login content is loaded via an iframe ([02:48]).

• Personalization and Automation:

  • Iframe sources use unique subdomains with long, random prefixes encoding the recipient.
    • “...they can load the right login page for the right victim in a scalable automated manner.” ([03:22])
  • Comparable to other phishing tactics where company logos are displayed dynamically, but here achieved via hostname manipulation, not just URL parameters.

---

WatchGuard Firebox Vulnerabilities

Overview:
WatchGuard issues a security update for its Firebox appliance, addressing a spectrum of vulnerabilities.

Key Points:

• Vulnerability Breakdown:

  • Total of 10 vulnerabilities patched, 5 rated high, none critical ([04:03]).
  • Noteworthy issue:
    • Memory corruption in the IKE daemon, previously a source of vulnerabilities in IPSEC systems.
    • In this instance, it allows only a denial of service (DoS) attack, requiring specific configurations ([04:16]).
    • “...only a denial of service and only in fairly specific configurations. So nothing I would be too worried about.” – Johannes B. Ullrich ([04:29])

• Potentially Underestimated Risk:

  • XPath vulnerability allowing unauthenticated attackers to leak internal configuration.
    • “That does not require authentication in order to exploit it.” ([04:38])
    • “...could lead to internal configuration leaks...” ([04:38])
    • More creative attackers could exploit this further; highlighted as noteworthy.

• Recommendation:

  • No immediate critical need, but should patch by end of next week.

---

Notable Quotes

• On nanoKVM:

  • “This device does not scream secure, it screams cheap.” ([00:18])
  • “Researchers had had a hard time to convince the maker to fix some of these vulnerabilities.” ([01:14])
  • “Remember, never ever expose these devices to the Internet.” ([02:36])

• On Ghostframe:

  • “So that way it's not being detected as easily by any defensive mechanisms.” ([02:58])
  • “...they can load the right login page for the right victim in a scalable automated manner.” ([03:22])

• On WatchGuard's XPath vulnerability:

  • “It could lead to internal configuration leaks and that does not require authentication in order to exploit it.” ([04:38])
  • “So apply the update. Again, nothing critical here, but something probably you want to get patched by the end of next week.” ([04:52])

---

Timestamps for Important Segments

| Time | Topic | |--------|----------------------------| | 00:04 | Introduction | | 00:18 | nanoKVM security concerns | | 01:27 | Firmware update insecurities| | 01:43 | Microphone discovery | | 02:26 | Open-source firmware effort| | 02:36 | Best practice—do not expose nanoKVM to Internet| | 02:48 | Ghostframe phishing attack | | 03:22 | Automated phishing targeting| | 04:03 | WatchGuard update overview | | 04:16 | IKE daemon vulnerability | | 04:38 | XPath vulnerability details| | 04:52 | Patch recommendation |

---

Overall Tone & Takeaway

• Tone: Practical, slightly wry, with clear security skepticism and actionable insights.
• Core Message:
  • Cheap remote management hardware poses serious risks and should never be Internet-exposed; pursue open-source alternatives with care.
  • Phishing operations are getting stealthier and harder to detect.
  • Keep up with security advisories—patch, especially when unauthenticated vulnerabilities might expose sensitive info.

“So apply the update. Again, nothing critical here, but something probably you want to get patched by the end of next week.” – Johannes B. Ullrich ([04:52])

Transcript

[A]

Hello and welcome to the Tuesday, December 9, 2025 edition of the SANS Internet Storm Centers Stormcast. My name is Johannes Ulrich, recording today from Jacksonville, Florida and this episode is brought to you by the Sans Edu Grad certificate program in Purple Team Operations. I would imagine that many of you listening have seen a device being advertised, the Nano kvm. KVM stands Keyboard, Video and Mouse Switcher, which is a little IP accessible device that gives you remote access to the keyboard, video and mouse of a particular device that you connect it to. Now this device does not scream secure, it screams cheap. And it's advertised as the cheapest possible device to accomplish this IP access to your keyboard and video screen. So a little cheap way to get basically remote access to a system even if like power fails and the like. Which is definitely something nice to have. And I have actually one here at home and I've been playing with it and definitely it works. But of course the security aspect here comes in in particular since the device has had a number of glaring security faults like bad hashing and encryption of passwords. Things like an SSH server is enabled by default with default password. And researchers had had a hard time to convince the maker to fix some of these vulnerabilities. The latest issue is that the entire firmware update process is insecure, in particular the update of a binary blob that's sort of the proprietary part of these devices. So that of course opens up the possibility of evil updates being slipped in here. The other thing that came out this week was that the motherboard of the device includes a microphone with no obvious reason for that microphone to be here. Now of course there were a lot of suggestions about spying and such. There may actually be a benign explanation for the microphone. This company also makes a little system on a chip, sort of a single board computer that's based on the exactly same motherboard as this kvm. The KVM was really just sort of an application of this single board computer. And yes, that single board computer does have a microphone. The microphone is advertised in the product description, so it's not something that's hidden, even though of course it's a little bit hard to find based on it being a really, really small sort of surface mounted microphone on the board. You can always well remove the microphone even though it's a little bit tricky because of the small size of it. There's also now an effort underway to create sort of a more third party open source version of the firmware that's based on standard Linux distribution. So if you don't trust the manufacture, you can always switch to one of those solutions. Haven't really tested them yet to see how reliable they are and how well they function compared to the official firmware. But then again, remember, never ever expose these devices to the Internet. And Barracuda is reporting about a new fishing kit that they're calling Ghost Frame that uses iframes in order to evade detection. The way this particular phishing kit works is that the phishing mail and web page itself is just simple benign HTML that's not triggering any kind of phishing detection rules. Then inside that HTML page, an iframe loads the actual login part of the phishing page. So that way it's not being detected as easily by any defensive mechanisms. The other little trick here is that this iframe loads this page from random, or not really random, but the unique subdomain. So the attacker uses a particular subdomain and then just has a prefix, a long random looking string which basically encodes the recipient. And that way they can load the right login page for the right victim in a scalable automated manner. That's a little bit like some of these phishing sites where you sort of get automatically your company logo also being displayed by based on some URL parameters. In this case they're not using URL parameters, they're just using the first label of the host name. And watchguard did release an update for its Firebox appliance. This update fixes 10 different vulnerabilities. Five of them are rated high, none of them is rated critical. There was one vulnerability that sort of scared me a little bit initially when I read the title, and that was like memory corruption in the Ike daemon that's actually component has been vulnerable in various IPSEC instances in the past. In this particular case, an unauthenticated attacker may cause a denial of service, but again, only a denial of service and only in fairly specific configurations. So nothing I would be too worried about. There's an interesting XPath vulnerability that I think could actually turn out to be more severe. It could lead to internal configuration leaks and that does not require authentication in order to exploit it. So that may be one of those vulnerabilities where the right attacker that's a bit more creative in what they're looking for can actually cause some damage. So apply the update. Again, nothing critical here, but something probably you want to get patched by the end of next week. Well, and that's it for today, so thanks for listening. And one special request. If you you are using the Apple Podcast app in order to listen to this podcast, would appreciate a review. So please and thank you and talk to you again tomorrow. Bye.