SANS Stormcast Friday, July 17th, 2026: Hikvision Scans; LG Spyware; Huggingface Hack; Wordpress Core RCE

Hello and welcome to the Monday, July 20th, 2020, 6th edition of the SANS Internet Storm Centers Stormcast. My name is Johannes Ulrich, recording today from Jacksonville, Florida. And this episode is brought to you by the SANS.edu Graduate Certificate Program in Penetration Testing and Ethical Hacking. Well, today's Internet Storm Center Diaries from our good old friend Hikvision and some new scans that we're seeing for the Hikvision Open Intelligent Security API. This API, often abbreviated as IS API, is used essentially to remote control these cameras and configure them. It's a fairly straightforward REST API using basic or digest authentication. now the scans we are seeing they're looking for the system slash status endpoint that particular endpoint essentially sort of fingerprints the camera or the dbr that the cameras are connected to i believe this is really more sort of a reconnaissance scan we are seeing here not an actual attack yet but i haven't really seen sort of scans for this particular url before so i figure that maybe someone found something new here could be used for brute forcing because this particular endpoint is always available on these cameras. And as a result, it could, for example, look for 400 errors, whether or not it doesn exist like a 404 or maybe a 401 or 403 error if authentication fails And late last week we had multiple news outlets report about LG monitors installing adware and well also spyware on users systems Now, maybe a little bit surprised that you have software being installed by your monitor. But essentially what the LG is taking advantage of here is the Windows Device Manager and Windows Update, which automatically can install software like drivers, but also control panels on your system as new hardware is installed. and it's supposed to make basically the install experience more streamlined and easier for the user but of course the manufacturer can install whatever software they wish on your system and lg took it upon themselves to basically show us how far you can push this feature what they're installing is the on-screen control plus software it's also quite difficult to remove the software from the system you have to delete certain registry hive to really get rid of the software and if you have an older lg monitor you're not safe due to windows update always looking for a new software for your hardware to install you may also be exposed to this malware now according to some reports particular gamer nexus has sort of looked into this at some detail the number one ad you'll see is for McGaffey antivirus, which of course is a little bit ironic right there. But well isn the first time that you sort of have sort of these aggressive ads in particular usually from pre software but this is software that not sort of pre by the vendor of your computer it being installed by the monitor on first detection of the monitor by your system I add a link to the GamerNexus video which does have a little more detail also about other things that LG is doing with their smart TV. And maybe I'll also link to one or two of the news articles, but you'll probably have no problem finding them yourself with a quick Google search. And AI community website HackingFace did publish an advisory disclosing a breach that recently happened and compromised credentials at HackingFace. A little bit ironic here that they actually say it was sort of a full AI agent-led attack that did compromise HackingFace. And after the attacker gained initial access by actually feeding a dataset to a pipeline that exposed a code execution vulnerability, they then pivoted and harvested cloud and cluster credentials. Hacking Face recommends rotating access tokens and reviewing account activity if you're using Hacking Face. They don't state that they have any evidence at this point that user credentials were harvested, but they also ask users to let them know if they find any issues after reviewing their account activity. Also, Hacking Face does state that in order to analyze the incident, they actually took advantage of some AI tools. It not a bad write a little bit short at this point but given that the attack just happened I think they still going to fill in some of the blanks here And usually I don't talk about WordPress vulnerabilities because they're pretty much always plugin vulnerabilities. There's just too many of them to talk about. But thanks to Searchlight Cyber's security research team, we now have a remote code execution vulnerability in WordPress core. Apparently, the root cause issue here is a SQL injection vulnerability. It can be exploited without authentication via the WordPress REST API. Now, one fix here that's being suggested by Searchlight Cyber is to disable anonymous access to this API. WordPress has released an update, a patch to address this vulnerability. Any WordPress version, version 6.9 or 7.0 is vulnerable unless, well, you just installed the latest and greatest one for 6.9 or 7.0. So another option you also have is install additional sort of plugins that will then block access to the vulnerable API. But what you really should do is just install the patch and then, of course, also check whether or not it makes sense to disable access to the API from random users on the Internet. well and this is it for today so thanks again for listening thanks for liking thanks for recommending this podcast and as always talk to you again tomorrow bye