SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast) SANS Stormcast Tuesday, June 3rd, 2025: Windows SSH C2; Google Removes CAs from trusted list; MSFT issues Emergency Patch to fix Crash issue; Qualcom Adreno GPU 0-day
4 snips
Jun 3, 2025 A simple SSH backdoor exploits Windows clients, offering unauthorized access through a sneaky configuration. Google Chrome shakes things up by distrustful of certain certificate authorities, impacting digital certificates. Microsoft rushes an emergency fix for a bug that halts system restarts after a patch, affecting both virtual and physical machines. Meanwhile, Qualcomm scrambles to address a vulnerability in its Adreno GPU, already under exploitation, highlighting the urgent need for security updates.
AI Snips
Chapters
Transcript
Episode notes
Windows SSH Backdoor Example
- Xavier discovered malware exploiting the SSH client on Windows systems, similar to long-known Linux threats.
- It uses an SSH config file to connect to a remote C2 server and forward a shell, opening a backdoor over port 443.
Detect SSH Over Port 443
- Monitor network traffic for unusual SSH usage, especially SSH over port 443.
- Such anomalous SSH activity should trigger alerts to detect potential backdoors.
CA Distrust Highlights Security Flaws
- Google Chrome will distrust Chunghwa Telecom and Netlock CAs after July 31, 2025, for poor certificate handling.
- These incidents highlight the criticality of timely revocation and transparency in certificate authority operations.