Welcome to DR's note, your weekly dose of knowledge from Circuit Stitch.

 Today we will talk about Follina 

                What is Follina?  Follina or CVE-2022-30190 is a zero-day exploit that uses Microsoft Word documents to execute Powershell code on your computer.  In the original document, the file has other hidden files inside of it by the use of compression, it is a .rar file.  So that once the document file is executed or run, you would reach out to a website to grab an HTML file.  This file would then run automatically, it would start a hidden command prompt window.  This hidden window would shut down the msdt (Microsoft Diagnostic Tool) program, it would then go through looking for a certain file that is encoded.  It would then save that file, decode that file, bring that file to the current directory, and execute a file called rgb.exe.  At the moment the rgb.exe file is unknown, meaning the infosec community isn’t sure what this file did, but what we do know is this is a form of RCE.

                 What is RCE?  RCE stands for remote code execution, it basically means that an attacker can create a file or program which I will refer to in the rest of this as a payload.  The payload will then be transferred over to someone else’s computer via any number of ways; i.e. email, USB stick, download, etc.  Once the payload is on the target system, it will need to be executed for the RCE to take effect.  Now RCE can be a lot of things, once it’s executed it could create a shell that gives the attacker access to your machine, it could execute ransomware, could add your machine to a bot-net (a future DR note), a bitcoin miner. Suffice it to say a lot can happen to your machine if it is run.

                 Do we need to worry about Follina?  Yes and no, at the time of writing this Microsoft is saying that it will be detected by Defender (Microsoft’s anti-virus) and will be labeled as “Mesdetty” and “Mesdetty Launch”.  Now let me explain why you should and shouldn’t worry about this.  Like all modern cyber threats, you should have concern enough to keep an eye out for it, but as of right now it doesn’t seem to be much of a threat because it hasn’t been used against anyone.  Not saying it won’t be used in the future but currently, it was pointed out that at the time of writing this no one has been a victim of this attack. 

                If you want to know more about Follina or CVE-2022-30190, check out my sources at the bottom of the email.  Also if you have any questions or if you have any topics you’d like me to discuss on a future DR note, please email me and let me know.  I hope everyone has a great week and Be Awesome!

Welcome to DR's note, your weekly dose of knowledge from Circuit Stitch Blog

This week we will talk about email and how it works.

    At my job I had a snafu with email a couple of weeks ago, this made me think about emails and how they work.  So I researched it and thought I'd share my findings with you and give you a glimpse behind the curtain of what happens after you send an email out.  As we discover about email, we will use my email as an example to help understand it better.

   So what is an email?  Well email literally means electronic email, email is also a very old technology that is still used today.  At one point email was the equivalent of a text message today, now we use it for many reasons that I couldn't even list all of them here.  It may seem as simple as type out the sender, subject, and body.  Click send and off it goes straight to the sender, but there is a little more to it than that.  Let me explain, so after you do your part of putting in the sender, subject, and body of the email.  You click send, the magic happens.  First stop is the SMTP server.  SMTP stands for simple mail transfer protocol(the internet is made up of many protocols that dictate how things work and what purpose those things have, but that is a discussion for another day).  The SMTP server is like the post office, it will check your message to find out where it needs to go.  Unfortunately, this post office doesn't have a list of domains (address's, basically what is after the @ symbol).  So the SMTP server sends a message to the DNS (Domain Name System) server asking what the IP (Internet protocol) address is for, let's say hotmail.com.  If the DNS server knows the IP address it will send it back to the SMTP server, if not it has to go out to the internet to discover what the IP address for hotmail.com is.  Once it gets the IP address, it will also check out to see if that IP address has an MX (mail exchange) server, which means that that IP address is able to receive emails.  So now that the DNS server has all this info, it will go back to the SMTP server with it and hand over that information.  The SMTP server will then use that info to send the email over to the hotmail.com.com or 204.79.197.212 which is the IP address.  Once there it is redirected to the MX server, the MX server then directs it to the user's account.  The user's account will then use either IMAP (Internet Message Access Protocol) or POP (Post Office Protocol) in its retrieval of emails.  By user account, I mean what you use to access your email, whether it is Thunderbird or through the browser.  Then your user account will inform you that “You've Got Mail”.  Then you can read and access that email, simple, right?

    I hope this has helped you to understand what goes into sending an email, and had you gain a better knowledge of how these boxes we work with daily actually work.  If you have any topics you're interested in, let me know, maybe I do a DR note in the future on it.  Until next week, have a great day.

https://www.howtogeek.com/56002/htg-explains-how-does-email-work/