Cyber security technical information

Author: admin

  • Political and Justice – 2020

    Wyden and Khanna proposed amending the Espionage Act of 1917 to protect journalists, whistleblowers, and security researchers who discover and disclose classified government information. (see below url) https://www.wyden.senate.gov/news/press-releases/wyden-and-khanna-introduce-bill-to-protect-whistleblowers-ensure-journalists-arent-targeted-for-publishing-classified-information- If you are also interested of cyber security information developing state. Perhaps you will seen the cyber security protection will be transform to preventive instead of defensive.…

  • Let’s review on cve-2019-11043, it is still valid today! (8th Mar, 2020)

    Preface: Let’s review on CVE-2019-11043, it is still valid today! An underflow vulnerability in versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 of PHP-FPM on Nginx. Background: Too many people have criticized the performance of Apache Server. And therefore , web application developers sometimes will decide turned their architecture focus to Event-driven…

  • PPP daemon vulnerable to buffer overflow due to a flaw in EAP packet processing – 5th Mar 2020

    Preface: PPP daemon (pppd) which is used to manage network connections between two nodes on Unix-like operating systems. The EAP extension to PPP was first defined in RFC 2284, now obsoleted by RFC 3748. Synopsis: A 17-year-old defect in Linux system found! The impact will be included dial-up modems, DSL broadband connections, and Virtual Private…

  • The CVE-2020-0688 vulnerability affects Exchange Control Panel (ECP) components. Maybe it fixed it. However, because OWA is Internet-oriented, you still worry about it. 5th Mar 2020

    Preface: To do the remedy of CVE-2020-0688, you need to install the security update in addition to the Cumulative Updates. Vulnerability Background: Microsoft using the same set of cryptographic keys on every Exchange Server installation. The keys being stored in plain text in a web.config file on every server. Details: Microsoft release the patch on…

  • Have you been renew and replace your current “Let’s Encrypt” certificate? 4th Mar 2020

    Preface: Certificates will begin being revoked at 3 PM EST. 4th Mar 2020 Security Focus: Due to design defect, Let’s Encrypt had to rush to inform users about the revocation the SSL server certification that’ll be completed in less than 24 hours. The SSL/TLS certificates will be revoke by tomorrow, March 4 (at 00:00 UTC…

  • Monthly news focus – Mar 2020

    Preface: Do you have doubt for the road map of application penetration test? I believe that it is a logical step. Sometimes, you will concerning the limit time windows for remediation for different of vulnerability result. The penetration tester will narrow down the work scope especially the high risk rating vulnerability item. Since this is…

  • Windows Kernel Elevation of Privilege Vulnerability + PWN-OS-FAKE UPDATE Windows 10 (Local) – FeB 2020

    Preface: You can load a custom dll in system32 via diaghub. Background: Starting from Windows 10, Microsoft introduced the Update Session Orchestrator service. As a regular user, you can interact with this service using COM, and start an “update scan” (i.e. check whether updates are available) or start the download of pending updates for example.…

  • tomcat ajp (cve-2020-1938) – vendor patched immediately. problem resolved. Feb 2020

    Preface: What is the best way for web server and the servlet container do a communications? Technical details: The ajp13 protocol is packet-oriented. A binary format was presumably chosen over the more readable plain text for reasons of performance. It communication between the web server and the servlet container. Vulnerability details: The vulnerability impact the…

  • OpenSMTPD (CVE-2020-7247) – How did it happen? 24th Feb 2020

    Preface: OPENSMTPD – plagued by numerous vulnerabilities. Most recently – CVE-2020-8794 Details: Qualys has found another critical vulnerability in OpenSMTPD.In normal circumstance, the adjacent side connects to the SMTP server and sends commands such as EHLO, MAIL FROM, RCPT TO. The SMTP server responds with a single or multiple lines of response: The client-side exploitation…

  • A retrospective album of BlackEnergy – Feb 2020

    Somewhere in time. This is 2015 – BlackEnergy2 exists in the form of a kernel-mode driver, which makes it harder for network administrators to discover the compromise. Black energy Group will mimics their custom tool(driver) thus made to look like a normal Windows component. They are interested in infecting Windows servers especially OPC server. But…