Celebration 2019! Coming Soon! But…? The most serious data breach in 2018… So far, do you know where they are?

Preface: The internet contains at least 4.5 billion websites that have been indexed by search engines. But may be more data not shown there?

Technical background – Dark Web Synopsis:
What is dark web? It is the part of the World Wide Web that is only accessible by means of special software, allowing users and website operators to remain anonymous or untraceable.The dark web is a huge marketplace for stolen data and personal information.

Attack surface:

So far, social media companies have often experienced data breaches. However, the healthcare industry is the priority attack target.

Data theft action:Once the company has been hacked. the situation will be as follow

  1. the data will be posted to dark web immediately
  2. if company management not intend to pay for ransom. they will sell the data in dark market.

Expert findings:
Please refer below url for reference: https://www.network-box.com/front_newsletter

Behind growth of APT attack

Preface: The objective of an APT attack is usually to monitor network activity and steal data. But the APT historical records shown that there are APT attacks intend to damage the network or organization.

APT might not easy to detect:
VM handler able to relocate and move code because of ASLR (address space layout randomization) applied. Example shown below for refernce.
For example the instruction AND has opcode 0x17 when you print.
The 32-bit code to run is stored entirely into the variable section with the value at offset 5 specifying the number of bytes to be copied and executed.
However the ability of conditional opcodes, the variable part can contain the next JIT packet ID or the next relative virtual address (RVA) where code execution should continue. So it such a way increase the difficult to detect the malware behaviour.

Prevention:
In order to fight against APT activities. Try to understand their goal of action. For example, we can learn from security report. For more details, please find below URL for reference.

Kaspersky Threat predictions for 2019 – https://www.brighttalk.com/webcast/15591/340766?utm_source=kdaily&utm_medium=blog&utm_campaign=gl_Vicente-Podz_organic&utm_content=link&utm_term=gl_kdaily_organic_link_blog_Vicente-Podz

Schneider Electric Security Notification – Nov and Dec 2018

Preface: Business Insider predicts business spending on IoT solutions will hit $6 trillion by 2021.

Technical background: EcoStruxure is Schneider Electric’s IoT-enabled, plug-and-play, open, interoperable architecture and platform, in Homes, Buildings, Data Centres, Infrastructure and Industries.

Vulnerability details:
Security Notification – Embedded Web Servers for Modicon V2 : https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2018-327-01-Embedded-Web-Servers-Modicon-V2.pdf&p_Doc_Ref=SEVD-2018-327-01

Security Notification – Power Monitoring Expert, Energy Expert : https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2018-347-01+Power+Monitoring+Expert+and+Energy+Expert.pdf&p_Doc_Ref=SEVD-2018-347-01

Comment: Not only a phishing scam trigger a URL redirection vulnerability. It also causes awaken product design weakness let multiple vulnerability occurs. It is a array effect. Since modicon and PLC products contains design limitations. The total 3 layers will be compromised once attack successful implement their phishing scam.

vRealize Operations updates address a local privilege escalation vulnerability – CVE-2018-6978 (18-12-2018)

Preface: Open a command prompt and type the following commands in sequence. Download vSphere PowerCLI from the Download page of the VMware Web site and install the vSphere PowerCLI software.

Technical background:
VMware vRealize Operations will help customers derive even more value from a “Self-Driving” approach to operations management. For instance:

  • Intent-Driven Continuous Performance Optimization
  • Efficient Capacity Management
  • Intelligent Remediation

Vulnerability:
VMware vRealize Operations (vROps) could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper permissions of support scripts. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to gain root privileges on a vROps machine.

Remedy: https://www.vmware.com/security/advisories/VMSA-2018-0031.html

In regard to general relativity, is there a way to open the wormhole or black hole secret?

Preface: If it is possible to do the space-time travel. So, what is your expectation?

Technical synopsis:

How Long Would It Take To Get To Jupiter? Jupiter made of gas. However, we may travel to Europa, one of its moons. Travel time to Jupiter takes around 6 years. If we use “wormholes“, you can reach distant places in the universe in a flash.

Remark: Europa (Jupiter II) is the smallest of the four Galilean moons orbiting Jupiter.

About wormhole: According to the general theory of relativity, black hole is the result of the curving of spacetime caused by being composed of dense mass.

In 1935, Albert Einstein and physicist Nathan Rosen use the theory of general relativity prove that widely separated black holes can be connected by a tunnel through space-time. It is a conjecture in physics stating that entangled particles are connected by a wormhole.

Since White holes are not proved to exist. It is considered by some physicists to be the mathematical answer to the general equations of relativity. Perhaps no method expose the while holes in the moment. But the practice of scientific development and research keen to hypothesize boldly, and prove it carefully. Whereby, all depends on your interest to this subject matter.

The mathematics theory proof that if we use “wormholes”, you can reach distant places in the universe in a flash. But how to figure out the wormhole?

Unconfirmed technical details but it might enhance the exploration level if it is genuine

Nikola Tesla was a Serbian-American inventor, electrical engineer, mechanical engineer, and futurist who is best known for his contributions to the design of the modern alternating current electricity supply system. He is the man behind the magnetic field unit. In 1921, Einstein and Tesla both two remarkable scientists meet up during RCA meeting (Marconi RCA radio station).

Perhaps Tesla spends his research and development man hours in magnetic field, frequency and vibration. But have you heard a statement mentioned that if you knew the magnificence of the three, six and nine, you would have a key to the universe. And the people claimed that the above statement was told by Nikola Tesla.

Reminder to reader

Since related information couldn’t found in Tesla original document. Besides, Telsa pass away in 1942 and it is hard to prove the integrity of the information. However this theory was display on a paper. This drawings was found in an antique shop at central Phoenix Arizona by artist (Abe Zucca). See below:

From mathematical point of view, above drawing shown the following hints.

  1. The multiples of 2 form a hexagon shape (⬡) as we go around the spiral.
  2. Multiples of 3 give us diamonds shape (◇).
  3. Multiples of 5 (when we go all the way out to 144) give us a more complex star shape (☆).
  4. The prime 11 spirals out from the center.

Above items of detail is the real story of Multiplication chart, but it hasn’t prove that the idea of chart belongs to Tesla. But do you agree with the idea shown below?

Not easy to programming above graph, right? Seems following the direction of Multiplication chart do not shown it is a key to the universe. Am I wrong? May be I am not a mathematician so it cannot understand the background of the reason!

Hypothesize boldly, and prove it carefully

Einstein-Rosen bridges proof that wormhole in between black hole and white hole. A vortex around of the black hole contained a strong X-ray. Since it is a vortex so it is a circle shape. The center of the black hole is the gravitational singularity, meaning that at that point, all the concepts of three-dimensional space will disappear.

Reference: The world we see with our eyes similar to be 3-D but it is actually made up of too many dimensions. We accept the 3D concept everywhere because it defines various equations and theories.

Assumption:

If we apply map to multiplication criteria into black hole theory. May be we can find out some interest topics (see below):

I assumed 9 is a constant with the following formulation (refer to below diagram).

A vortex around of the black hole contained a strong X-ray. And therefore the black hole is in circle shape. And we can receive a quantification value. That is 360° degrees.

So, we can apply above mathematics theory.

360=3+6+0=9

I apply above mathematics assumption to above equivalent table (multiplication table created by the artist). Refer to below diagram. You will find that two line intercept point is not in the middle of the circle. When you comparing my prediction with existing detected back hole (see below picture). See whether is there coincidence of the current detected black hole Sagittarius A? The location of the black hole and sun looks have similarity. It is magic!

Conclusion:

Draft out above idea merely for personal interest. From technical point of view, the formula not in precise way and might have error. But the practice of scientific development and research keen to hypothesize boldly, and prove it carefully. Perhaps my prediction is not factual. But from my personal point of view, it is a good start.

Supplement: A theoretical proposal by Greenleaf et al. presented a strategy to build a wormhole for electromagnetic waves. Based on metamaterials, it could allow electromagnetic wave propagation between two points in space through an invisible tunnel.



Multiple Vulnerabilities in WIBU-SYSTEMS WibuKey Network server management

Preface: Over 3,000 companies around the world to protect intellectual property and other digital content deployed WibuKey Digital Rights Management (DRM) solution.

Technical background: Keep documents safe and stay compliant, while protecting your digital assets without impacting productivity. Digital Right Management (DRM) solution is a file-based security system that prevents exposure of sensitive and confidential files by trusted insiders, business partners, customers and unauthorized people.

Vulnerabilities details: Cisco Telos security expert has discovered a vulnerability in WibuKey WIBU-SYSTEMS WibuKey.sys, which can be exploited by malicious, local users to gain escalated privileges.

Remedy solution: https://www.wibu.com/support/user/downloads-user-software.html#download-216

Microsoft Windows MsiAdvertise Product function vulnerable to privilege escalation via race condition – 20th DEC 2018

Preface: MsiAdvertiseProduct function enables the installer to write to a script the registry and shortcut information used to assign or publish a product.

Vulnerability details:
Due to improper validation, the affected function can be abused to force installer service into making a copy of any file as SYSTEM privileges and read its content, resulting in arbitrary file read vulnerability.
A race condition occurs when two or more threads can access shared data and they try to change it at the same time. Because the thread scheduling algorithm can swap between threads at any time, you don’t know the order in which the threads will attempt to access the shared data. As a result it create a chance to attacker to access the shared data. Perhaps the access control list might lost control in such circumstances.

Remedy: Vendor did not release the patch yet since this is a new exploit (Zero-day).

Comment: Suggest to observe Event ID 11707 or 1033 in your SIEM.

Remark: Windows logs has several different events when you install or uninstall software. The Installation events are Event ID of 11707 or 1033.

Wishing you a Merry Christmas and a safe cyber prosperous new year!

OpenSource user mode file system for Windows, software driver contains a stack-based buffer overflow – 20th Dec 2018

Preface: Dokan is a user mode file system for Windows. It allows anyone to safely and easily develop new file systems on Windows operating systems.

Technical details: When you want to create a new file system on Windows you need to develop a file system driver. Developing a device driver that works in the kernel mode on Windows requires highly technical skills. By using Dokan, you can create your own file systems very easily without writing device drivers. Dokan is similar to FUSE (Linux user mode file system) but works on Windows.

Vulnerability synopsis: A Dokan file driver contains a stack-based buffer overflow

Remedy: https://github.com/dokan-dev/dokany/releases

Wishing you a Merry Christmas and a safe cyber prosperous new year!

CVE-2018-8653 | Scripting Engine Memory Corruption Vulnerability

Preface: “I Saw Mommy Kissing Santa Claus” is a famous Christmas song.But perhaps that it is the hacker kissing your Internet Explorer web browser before christmas time. Above description has similarity because both two people are the famous guy in the world.

Detail description:
ChakraCore is the core part of Chakra, the high-performance JavaScript engine that powers Microsoft Edge and Windows IE applications written in HTML/CSS/JS. ChakraCore supports Just-in-time (JIT) compilation of JavaScript for x86/x64/ARM, garbage collection, and a wide range of the latest JavaScript features.

Vulnerability found on 20th Dec 2018:
Microsoft Internet Explorer contains a memory corruption vulnerability in the scripting engine JScript component, which can allow a remote attacker to execute arbitrary code on a vulnerable system.

Workaround: Restrict access to JScript.dll execute following command syntax.
cacls %windir%\system32\jscript.dll /E /P everyone:N
cacls %windir%\syswow64\jscript.dll /E /P everyone:N

Official announcement display in below url: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8653

Cyber security practitioner must stay alert! (Cisco security advice) – 19th Dec 2018

Preface: Firewall solutions are essential to protect organizations from potential cyber threats. HTTPS is used to make communication between the server and the browser secure.

Key factor of Cyber security:
It is hard to avoid vulnerability will be occured in digital products today. But the most critical issue is that how to know and the efficiency of remedy solution.

Cisco discover a vulnerability occurs in their ASA product on 19th Dec 2018:
A vulnerability in the authorization subsystem of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, but unprivileged (levels 0 and 1), remote attacker to perform privileged actions by using the web management interface.

Remedy solution:
Please refer to Cisco official announcement https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181219-asa-privesc