Monthly Archives: September 2019

IoT, Public safety

New generation of weapon iot+lora+Drone (2019)

Preface: Traditionally, only big country can have military weapon. Computer technology especially IoT devices not only replace human power. As we seen, IoT 4.0 is going to replace routine man power resources. Perhaps IoT technology also infiltrate in military arsenal .

Details: On Sep, 2019. Drone attacks have set alight two major oil facilities run by the state-owned company Aramco in Saudi Arabia. Refer to diagram, Drone integrate with Lora can increasing the control effective distance. If trouble maker is going to attack improtant facilties, they have more choices today. In last decade, APT cyber attack is the major channel to detroy the critical facilities. But APT attack rare to destroy the infrastructure. If enemy insists to destory the infrastructure. The setup of IoT, Lora and Drone can do it.

Can Drones be Detected by Radar? All newer radars are equipped and have the ability to locate even the smallest drones in the air. May be in future, all the critical facilities especially oil facilitiy, Power grid require to install Radar system.

Prediction: We heard APT cyber attack against critical facilities (especially power grid and oil facilities) by far. It looks that a hybrid attack (IoT+Lora+Drone) will be use in future.

Potential Risk of CVE

cve-2019-11660 Data protector privilege escalation via omniresolve (Sep 2019)

Prefect: People prefer Veeam because the interface is easier, and Data Protector is difficult in comparison.

Product details: Data protector is a backup and disaster recovery solution for large, complex, and heterogeneous IT environments.

Vulnerability details: A potential vulnerability has been identified in Micro Focus Data Protector. The vulnerability could be exploited by a low-privileged user to execute a custom binary with higher privileges.

Our comment:
Above vulnerability might focus on Data protector server installed on Linux OS platform.
If authorized user exploit the power of SUID/GUID files on Linux, they can enable a file to have one of those bits, to shared the privileges. If a file has a SUID bit to run as root, it has the power to do everything that root can.

Reference: The omniresolve command reads the filesystem structures locating the physical disks (on Windows)
or volumes (on UNIX)on which a filesystem object resides. If the files reside on a logical volume which is a part of a volume group(diskgroup),all volumes in a volume group are displayed.

Status & remedy: versions 10.00, 10.01, 10.02, 10.03, 10.04, 10.10, 10.20, 10.30, 10.40 are affected. Require update Micro Focus Data protector to 2019.08 (A.10.50) or a higher version.

Science

Who lives on the moon?

A myth from ancient China. The story tells a woman who lives on the moon. But the astronauts have never seen her. Because she lives in the interior of the moon.

The density of lunar rocks brought back by Apollo’s lunar landing plan is much larger than that of the Earth’s rocks. It can be seen that the density of the moon is astonishing. If we speculate according to this phenomenon, the center of the moon should be a core composed of large-density matter.

Considering the distance in between center and surface of the Lunar will be short than earth. Coupled with its total mass, gravity is much larger than we think. However the gravity of lunar merely 1/6 from earth. It seems that the lunar gravity has nothing to do with its density and mass. This shows what? This only shows that the moon is a huge hollow sphere.

Happy Mid-autumn Festival

Potential Risk of CVE

Schneider Electric Security Notification – CVE-2019-6811 (Sep 2019)

Product background: The Modicon Quantum Ethernet I/O (QEIO) automation platform is designed to meet the requirements of both the industrial automation and process industries.

Vulnerability details: An Improper Check for Unusual or Exceptional Conditions (CWE-754) vulnerability exists, which could cause denial of service when the module receives an IP fragmented packet with a length greater than 65535 bytes. The module then requires a power cycle to recover.

Additional info: The maximum packet length for IPv4 = 65,535 bytes but the size is limited due to the physical layers MTU( 1500 for Ethernet). So to send larger packets it would require fragmentation.

IP fragmentation is an Internet Protocol (IP) process that breaks packets into smaller pieces (fragments), so that the resulting pieces can pass through a link with a smaller maximum transmission unit (MTU) than the original packet size. The fragments are reassembled by the receiving host.

Remark: Scapy is a tool to generate your own packets.

Affected Product – Quantum 140 NOE771x1 version 6.9 and earlier.

Remediation: This vulnerability is fixed in version 7.0

Healthcare industry

Dejablue vulnerability – Impact on Siemens Health Products (10th Sep 2019)

For healthcare, cyber attacks can have ramifications beyond financial loss and breach of privacy.

Preface: For healthcare, cyber attacks can have ramifications beyond financial loss and breach of privacy.

Background: The DejaBlue vulnerabilities are in the early stages of the RDP connection. The flaws precede the authentication phase, thereby there is no need for passwords of keys to breach the system and eventually can lead to remote code execution.

DejaBlue vulnerability trigger medical device manufacturer alert! People relies on doctor do the medical surgery to remediate their weakness of the health. But the medical industry itself also require cyber security doctor to remedy their product design weakness. It is fair. Siemens pioneer to introduce first computed tomography scanner in 70’s. In 1980 the first manufacturer to made the magnetic resonance imaging (MRI) scanner. As of today, their design has been intergarte with computing technology. And therefore the zero day and vulnerability happen in cyber world will become their pain!

Official announcement: SSA-187667: DejaBlue Vulnerabilities – Siemens Healthineers Products – https://cert-portal.siemens.com/productcert/pdf/ssa-187667.pdf

Potential Risk of CVE

CVE-2019-15292 Linux Kernel up to 5.0.8 atalk_proc.c atalk_proc_exit memory corruption

Background: Appletalk support allows your Linux machine to interwork with Apple networks. Below components conduct the specified functions.

  • sysctl_net_atalk.c: sysctl interface to net AppleTalk subsystem.
  • ddp.c: AppleTalk DDP protocol for Ethernet ELAP (ethertalk).
  • atalk_proc.c: proc support for Appletalk

The Use-After-Free vulnerability is related to above three components. Even though you do not use ApplyTalk, attacker by sending a request that submits malicious input to the targeted system. A successful exploit could allow the attacker to execute arbitrary code.

In the Linux kernel version 2.6.23, the /proc/sys/vm/mmap_min_addr tunable was introduced to prevent unprivileged users from creating new memory mappings below the minimum address. To enable it, add or amend the following entry in the /etc/sysctl.conf file: vm.mmap_min_addr = 4096

Security Focus: What is NULL pointer dereference flaws in the Linux? NULL pointer dereference flaws in the Linux kernel can often be abused by a local, unprivileged user to gain root privileges by mapping attacker-controlled data to low memory pages.

But above adjustment cannot resolve these vulnerabilities. It was because if alloc_disk fails in pcd_init_units, cd->disk will be NULL, however in pcd_detect and pcd_exit, it’s not check this before free.It may result a NULL pointer dereference.

Remedy: Kernel.org has released remedy at the following link – https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6377f787aeb945cae7abbb6474798de129e1f3ac

Potential Risk of CVE

Quick and Dirty – walk through CVE-2019-15846

Preface: Quite a lot of cyber security expertise provides their explanation on vulnerability on Exim (A local or remote attacker can execute programs with root privileges). I will do a quick and dirty way to explain. Should you have interested, please refer below:

a. Connect to Exim with TLS and send an SNI that ends with backslash-null.
*unescaped-backslash bug in string_printing2()

b. We exploit the backslash-null bug in string_interpret_escape().

Hints: Brainstorm on above matter
When you do a malloc, it gives you a pointer to a block of memory in the heap
char *p=malloc(2048) – Virtual memory allocated 2048
strcpy(p,”123”) – Although only 3 bytes are used, the memory still allocates 2048 bytes of physical memory for it.
free(p) – Through the virtual address, find the physical page corresponding to it, release the physical page, and release the linear region.use this heap overflow to overwrite the header of a free malloc chunk.

c. use this heap overflow to overwrite the header of a free malloc chunk.

d. allocate this enlarged malloc chunk, and use it to overwrite large parts of the heap (the already-allocated malloc chunks) with arbitrary data:

e. Overwrite the “id” string: (by overwriting “id” with “/../../../../../../../../etc/passwd”)

Official announcement:

Download and build a fixed version:

    Tarballs: https://ftp.exim.org/pub/exim/exim4/
    Git:      https://github.com/Exim/exim.git
              - tag    exim-4.92.2
              - branch exim-4.92.2+fixes
Potential Risk of CVE, Public safety

CIS Center for Internet Security Urge PHP customer aware of Multiple Vulnerabilities in PHP. Because it could allow for Arbitrary Code Execution. Sep 2019

Preface: Network security experts may hesitate to answer a question. What is it? Which programming language is easy to write. But there are no loopholes.

CIS Center for Internet security announcement: Multiple Vulnerabilities in PHP Could Allow for Arbitrary Code Execution

For more information, please refer URL – https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-php-could-allow-for-arbitrary-code-execution_2019-087/

Our Observation: One of the component to Jeopardize your PHP website is the “arbitrary-php-extension”. An experimental has been proofed. After loading custom made PHP extension, each request will be able to execute a piece of your own PHP code. If you need to customize the request argument arbitrary_php to something else, you can modify the value of REQUEST_NAME in (arbitraryphp/extinitial/pre_request.h). Parameter can be find on attached picture.

Potential Risk of CVE

The Unforgettable computer architecture – I do not mind it has vulnerability occur. Sep 2019

Preface: Quite a number of people think that Mainframe computer no longer exist anymore. However they are still alive.

Background: A 3270 Emulator is a terminal emulator that duplicates the functions of an IBM 3270 mainframe computer terminal on a PC or similar microcomputer.

Vulnerability details: There is Missing SSL Certificate Validation in the pw3270 terminal emulator before version 5.1.

Impact: TLS/SSL certificate validation flaw, leading to attackers in a MitM position being able to affect confidentiality, integrity and availability of traffic between the client and host, including credentials used.

Remedy: Upgrade to version 5.1. For more information, please visit the following URL – https://pkgs.org/download/pw3270

Potential Risk of CVE

Reflections on the Connection Between SSH client and SSH service Daemon – CVE-2019-1580 (PAN-OS – Palo Alto Networks)

Preface: No matter “WAF” or a traditional Layer 3 firewall. The SSH service daemon will be installed because such service is not uncommon.

Vulnerability details: Memory corruption in PAN-OS 7.1.24 and earlier, PAN-OS 8.0.19 and earlier, PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow a remote, unauthenticated user to craft a message to Secure Shell Daemon (SSHD) and corrupt arbitrary memory.

Additional:

In the current version of the NDcPP there is a cryptographic Security Functional Requirement (SFR) called FCS_SSH*_EXT.1.8.
If your solution involves an OpenSSH server or client, you might be surprised to find out that OpenSSH’s “RekeyLimit” option does not actually fulfill this requirement according to the Application Note. OpenSSH’s RekeyLimit’s volume limiter will rekey on data volume only when one of the incoming or outgoing meets or exceeds the defined limit. It does not check the aggregate.

From technical point of view, attacker is able to consume ssh service daemon memory resources. For instance when using OpenSSH as client, simply enter ~R (capital R!) and rekeying will take place. If they intend to increase the re-key times, the specify process will be in trouble!

Remedy: Only accept SSH connection with trust IP address and trust network.