2nd Oct 2018 – Homeland security alert (Retail payment system security advisory)

US Homeland security urge banking industry especially payment gateway services provider staying alert of new round of malicious cyber attack of their system. Similar of cyber attack was happened in Taiwan. The heist draw the cash equal to $2.6m (£2.1m). Homeland security reveal how the technique let ATM machine like human vomiting. But this is the bank note. You and me like it.

The key item of this attack is prioritize to compromise the switching application server.  Then malicious applications generate a counterfeit response message using GenerateResponseTransaction1() or GenerateResponseTransaction2() function to response to the acquire with a counterfeit response message and drops the request before the payment switch application processes the message. As a result it fool the issuer with no knowledge of the transaction. Should you have interest of above details, please refer to below URL:

https://www.us-cert.gov/ncas/alerts/TA18-275A

Honeywell Mobile Computers with Android Operating Systems – CVE-2018-14825

Port of Barcelona and Port of San Diego suffers cyber attack on September 2018. The San Diego port indicated the ransomware attack is mainly an administrative problem and the port is open and operating as usual. Cyber attacker conducting cyber attack to logistic industry not new. Honeywell one of the Industrial Control Systems leading manufacturer. They found that a vulnerability occurs in their android mobile computer devices. Since the headline news last week did not mentioned about the vulnerability details. In order to avoid hacker trigger the attack and vendor not going to provide the vulnerabiity details. My observation is that Android has dangerous permission group which allow user to execute in special circumustances.

The details are shown on attach diagram. Should you have interest, please refer to diagram.

The techincal reference can found in below url:

https://www.honeywellaidc.com/en/-/media/en/files-public/technical-publications/multi-product/ALLSKU-AND-ENUS-ZY.pdf

Adobe Releases Security Updates – Oct 2018

Adobe Releases Security Updates – Oct 2018

Many years ago adobe has two main modules Adam and Eve. Now use….. It looks that adobe products hard to manage memory space. So the critical vulnerabilities happens again. It looks that the software patching hit rate in demanding today. It is better to consider virtual patching now.

Adobe offical announcement shown as below:

https://helpx.adobe.com/security/products/acrobat/apsb18-30.html