-
For Malicious Cyber Activity, US Homeland Security provides visibility to the world – 13th May 2020
Preface: It is impossible to rely on small group of expert to track malicious activities on the Internet. In fact, it needs strong financial support. This is reality, maybe this is a long-running game. Background: US Homeland Security issue an evaluation article on hostile country malware and phishing attacks motion. Perhaps you may ask? Can…
-
Remedy on CVE-2020 -11651, CVE-2020 -11652 VMware vRealize Operations Manager addresses Authentication Bypass and Directory Traversal vulnerabilities – 12th May 2020
Preface: If application do not defenses against directory traversal attacks, so an attacker can request the following URL: hxxp://xxx[.]com/loadImage?filename=../../../etc/passwd Vulnerability details: The VMware Application Remote Collector (ARC) introduced with vRealize Operations Manager 7.5 can integrate with Salt (SaltStack). However the vulnerabilities (CVE-2020-11651 and CVE-2020-11652) found in saltstack this month will be impact VMware operation simultaneously.…
-
From imagination point of view – The assembly process of Coronvirus kill chian – 10th May 2020
Preface: The pandemic virus has killed about 211,000 people. Is it an artificial product or created by nature? My story can tell: Population growth, it is hard to avoid has a cold. The symptom causes cough & sneeze.However the main problem is the sputum. Perhaps we are the living in modern civilization. However the spit…
-
Discarded Tesla car parts contain information. Maybe you can buy it on eBay. Who can believe in the technological world? Even if no such incident occurs, the supplier can read your local data without your consent (8th May 2020)
Preface: The traditional method of disposing of hard drives is degaussing or incineration. Headline News: The manufacturer has a hardware disposal policy. The incidents encountered by Tesla may be due to improper handling of third parties. For more information about headline news, please refer to this link. https://www.hackread.com/user-data-found-in-tesla-car-parts-ebay/ Supplement: Should you have doubt about your…
-
Storm of Go language based malware – 6th May 2020
Preface: New Kaiji malware targets IoT devices via SSH brute-force. Background: Gobot is a framework for robotics, drones, and the Internet of Things (IoT), written in the Go programming language. Observation: Programmers usually choose Golang for building the communication layer within the IoT system. One of the biggest draws to Go is the fact that…
-
SaltStack has released a security update to address critical vulnerabilities affecting Salt versions prior to 2019.2.4 and 3000.2 (1st May 2020)
Product background: If you have one hundred servers, so it makes sense to use Puppet(open source DevOps systems management tool)for centralizing and automating the configuration management process. SaltStack itself is an open source infrastructure centralized management platform. Compared with other commercial products, its deployment and configuration are slightly more complicated. Vulnerability details: SaltStack has released…
-
Alert users that a previously disclosed Oracle WebLogic Server remote code execution vulnerability (CVE-2020-2883) is being exploited in the wild. (3rd May 2020)
Preface: Perhaps my alert late for 3 days, but the specify vulnerability hide himself in webLogic product for few years! Vulnerability details: Alert users that a previously disclosed Oracle WebLogic Server remote code execution vulnerability (CVE-2020-2883) is being exploited in the wild. You can read the official announcement in following link – https://blogs.oracle.com/security/apply-april-2020-cpu One of…
-
VMware ESXi patches address Stored Cross-Site Scripting (XSS) vulnerability (CVE-2020-3955) – 28th Apr 2020
Preface: Perhaps when you do the web scan or web penetration test. XSS will be easy to find out. However people has contempt this matter. How to avoid XSS happen? 1. Input should filter characters especially < > & ‘ ” . 2. Whitelisting and input validation are more commonly associated with SQL injection, they…
-
Juniper harden itself. Avoid log event services daemon encountered injection attack – 28th Apr 2020
Preface: Friendly speaking, the similar types of attack apply to all Linux base devices including firewall. The impact of this vulnerability – If J-Web is enabled, the attacker could gain the same level of access of anyone actively logged into J-Web. If an administrator is logged in, the attacker could gain administrator access to J-Web.…
-
An Official remediation was released (Avoid SQL injection attack encountered in Sophos XG Firewall) – 26th April 2020.
Preface: The modern user friendly functions installed on firewall impact his defense function. Background: When device provide web page input user credential, perhaps it will facing injection attack. Yes, it is. No matter, SQL injection or command injection. Especially like firewall design. It is capable support and integrate of LDAP authentication or standalone authentication mode.…