SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)
SANS Stormcast Friday, April 25th: SMS Gateway Scans; Comvault Exploit; Patch Window Shrinkage; More inetpub issues;
Apr 25, 2025
06:38
AI Summary
AI Chapters
Episode notes
Podcast summary created with Snipd AI
Quick takeaways
- Recent scanning activities targeting Teltonika SMS Gateways reveal attackers exploiting default credentials and validating access by sending test messages internationally.
- A significant rise in exploitation trends indicates that around 25% of newly disclosed vulnerabilities are attacked within just one day of their announcement.
Deep dives
Attacks Targeting SMS Gateways
Recent scanning attempts on honeypots indicate that attackers are trying to exploit SMS gateways created by Teltonica. These devices facilitate IP-based connections to send SMS messages through a straightforward API, often defaulting to common usernames and passwords such as 'user1' and 'user_pass'. In addition to these defaults, the attackers have shown interest in other passwords, including a peculiar string 'P8XR', which did not yield any useful information through searches. The attackers are validating the success of their connections by sending test messages to their own phone numbers located in Saudi Arabia and Belgium.
Remember Everything You Learn from Podcasts
Save insights instantly, chat with episodes, and build lasting knowledge - all powered by AI.
