Preface: When Meltdown and Spectre discovered, the tech community questioned chip security. Security Focus: A new class of unprivileged speculative execution attacks to leak arbitrary data across address spaces and privilege boundaries (e.g., process, kernel, SGX, and even CPU-internal operations). Who is he? Side-channel attack targeting Intel chips, allowing hackers to effectively exploit design flaws…

Preface: Sometimes while designing a software, you might have a requirement to hold some data (for reprocessing at later stage) for some duration. Some software do it within the memory in which they are running while others may create a temporary file for this purpose. Technical background: The original design of Trend Micro able transform…

Preface: Patching is a routine job in Cloud services provider. The job is similar do bathing with your puppy. Background: There are five virtual appliances (OVA) used for Horizon DaaS; Service Provider, Tenant, Desktop Manager, Resource Manager and Access Point. Vulnerability details: An unauthorized user with network access to port 427 on an ESXi host…

How Windows Hello for Business works? It lets Windows 10 users who have devices with fingerprint readers or special cameras log into Windows via fingerprint or facial recognition. Use cases: Client systems which joined to Kerberos based domains like Active Directory (AD) can use Windows Hello for Business authentication to replace password based authentication and…

Background: XPC is a type of iOS IPC. Through XPC, an app can communicate with some system services. mediaserverd (/ usr / sbin / mediaserverd) is a daemon process launched by the root process launchd, and its description file is com.apple.mediaserverd.plist stored in / System / Library / LaunchDaemon directory, when the system starts, it…

Preface: The OAuth 2.0 Authorization Framework (RFC 6749, October 2012) Technical background: In the traditional Client-Server architecture, when the Client wants to fetch the protected resources (Protected Resoruce), it is necessary to present the account and password of the user (Resource Owner) to the Server. OAuth introduces an authentication layerThe Client will get an Access…