-
Our Future especially Smart City is waiting for 5G mobile communication. Does your body ready for 5G signal?
Preface: When mobile phone was born. Some of the people had concerning about the impact of electronic device to human health. As time goes by, seems we forget about it because we need smartphone now! Historical background: The FCC has established a policy for human exposure to radio frequency electromagnetic fields. Seems it looks fine,…
-
User opinion – Would you mind your user credential naked running? Facebook scandal (Mar 2019)
Preface: Do I Really Need To Encrypt Every File on My Computer? May be answer is simple, all depends on your data classification label….. The focus: Informed sources told that access logs showed some 2,000 engineers or developers made approximately nine million internal queries for data elements that contained plain text user passwords. What is…
-
Cisco managed to conduct the remediation of IP Phone 8800 Series vulnerabilities – 20th Mar 2019
Preface: Cisco has announcement yesterday that there are vulnerabilities found on IP Phone 8800 Series. About IP Phone 8800 Series: The Cisco IP Phone 8800 Series delivers HD video and VoIP communications, and integrates with your mobile device to meet your business needs. Vulnerability details are shown as below: Cisco IP Phone 8800 Series Path…
-
Do not ignore integer overflow attack. His power equivalent with torpedo.
Preface: Malware detection, SIEM and predictive technology enhance the detective and preventive control in cyber security world. However the hacker still have solutions to conduct infiltration thus compromise the system. Attacker exploit integer overflow do the evasion. From technical point of view. It is difficult to detect. Historical records of cyber attack who exploit integer…
-
CVE-2019-0804 Azure Linux Agent Information Disclosure Vulnerability (14th Mar 2019)
Preface: To speed up the deployment of your cloud computing readiness. Use the image deployment is faster than mounting an ISO and manually installing a VM.When system admin created images for an OpenStack provider, he will pre-installed cloud-init and haveged. Azure has similar feature, it is so called Azure WaLinuxAgent. Vulnerability detail: An information disclosure…
-
12th Mar 2019 – Intel® Software Guard Extensions SDK Advisory
Preface: Space Layout Randomization (ASLR) to defend against memory corruption attacks. However, Intel Software Guard Extension (SGX), it is capability protects selected code and data from disclosure or modification. From security point of view, it provides an advance protection than before. Vulnerability detail: Double free in Intel(R) SGX SDK for Linux before version 2.2 and…
-
Security Focus – CVE-2019-5513 VMware Horizon update addresses Connection Server information disclosure vulnerability: 14th Mar 2019
Preface: VMware Horizon Client for Android and iPhone makes it easy to work on your VMware Horizon virtual desktop and hosted applications from your smartphone. About security advisory annoucement by VMware: The VMware Horizon Connection Server contains an information disclosure vulnerability. Successful exploitation of this issue may allow disclosure of internal domain names, the Connection…
-
PHP EXIF exif_process_IFD_in_TIFF Method Arbitrary Code Execution Vulnerability
Preface: With the exif extension you are able to work with image meta data. PHP capable to update the date in the exif photo headers by script. The headers includes the following: Time taken,Time modified,The camera make,The camera model,.. Design objective of exif_process_IFD_in_TIFF: Parse the TIFF header. Vulnerability Found: When execute test script, Memcheck by…
-
Citrix Internal Network Hacked – Press release on Mar 2019
Preface: Citrix Systems, Inc. is an American multinational software company that provides server, application and desktop virtualization, networking, software as a service (SaaS), and cloud computing technologies. About data breach occurred on Dec 2018: Citrix says that the late 2018 attack appears to be distinct from the likely password-spraying attack that was the focus of…
-
CVE-2019-1723 Cisco Common Services Platform Collector Static Credential Vulnerability – 13th Mar 2019
Preface: The CSP-C’s basic function is to discover the network elements and collect information from those elements.Basically the design goal is to enhance the overall detective and preventive control in the IT infrastructure. Technical highlight: To perform the Network Discovery and Data Collection operations the CSP-C needs the following credentials: SNMP Read Only community,Telnet or…