-
Design weakness found 1 year ago (Jan 2019), but the details expose today! Fortinet FortiSIEM 5.2.5 / 5.2.6 Hardcoded Key (Jan 2020)
Preface: Stupid Solutions to Stupid Problems: Hardcoding Your SSH Key in the system. Vulnerability background: FortiSIEM 5.2.5 / 5.2.6 could use the hardcoded password to log in to the underlying system via Secure Shell (SSH). This means that anyone with access to any FortiSIEM image (to copy the SSH private key) can authenticate successfully via…
-
In order to avoid MS ‘.Group’ file handling RCE vulnerability. Think it before click – Jan 2020
Preface: Perhaps you would say the ‘.group’ file handling is the design defect. So hacker exploit social engineer trigger this vulnerability (GROUP FILE URL FIELD CODE EXECUTION). Do you agree? What is a GROUP file? The file is located inside this location: C:\Program Files\Windows Mail. Vulnerability details: Microsoft Windows is prone to a remote code-execution…
-
Phishing email compromised the reputation of company, Microsoft take legal action
Preface: Microsoft products cover a wide range. Perhaps quite a lot of people queries design weakness of their products. But they have capabilities to protect it own. Background: The cyber criminal exploit Microsoft official domain name to made phishing email and goal to increase the possibility to open the email. Meanwhile the malicious infection technique…
-
IoT zone staying alert! HomeAutomation 3.3.2 design weakness exposed (Authentication Bypass, CSRF / Code Execution & Cross Site Request Forgery) – 1-1-2020
Preface: Sometimes lighting can become a security safeguard. Perhaps the lighting system will help you figure out whether intruder jump to your garden at night. Synopsis: It is hard to avoid the digital transformation trend integrate to your daily life. As the matter of fact, they are on board already. For instance the remote controlled…