-
Microsoft Releases Security Advisory for Windows Hello for Business – 3rd Dec 2019
How Windows Hello for Business works? It lets Windows 10 users who have devices with fingerprint readers or special cameras log into Windows via fingerprint or facial recognition. Use cases: Client systems which joined to Kerberos based domains like Active Directory (AD) can use Windows Hello for Business authentication to replace password based authentication and…
-
Quite a lot of people saying the IoT security today. Even though Apple computer they also headache!
Background: XPC is a type of iOS IPC. Through XPC, an app can communicate with some system services. mediaserverd (/ usr / sbin / mediaserverd) is a daemon process launched by the root process launchd, and its description file is com.apple.mediaserverd.plist stored in / System / Library / LaunchDaemon directory, when the system starts, it…
-
Suspect that Domain whitelist accept “WILDCARD” domain feature causes 3rd party takeover Azure user account.
Preface: The OAuth 2.0 Authorization Framework (RFC 6749, October 2012) Technical background: In the traditional Client-Server architecture, when the Client wants to fetch the protected resources (Protected Resoruce), it is necessary to present the account and password of the user (Resource Owner) to the Server. OAuth introduces an authentication layerThe Client will get an Access…
-
Python will be replaced Excel in banking environment. But do not contempt the bug in excel? Nov 2019
Preface: When you walk through trading floor area, you can see trader writing Python code, said chief digital officer at Nomura. Background: Perhaps the popularity of the excel usage in trading floors are coincidence. I believe that DDE and Marco functions driven this trend in in past. Audit team found out that a data handling…
-
Do not contempt CVE-2019-11932 attack. It can jeopardize the Android software applications world!
Preface: CVE record summarized by human. Perhaps sometimes might have typo! Vulnerability description: A double free vulnerability in the DDGifSlurp function in decoding.c in libpl_droidsonroids_gif before 1.2.15, as used in WhatsApp for Android before 2.19.244, allows remote attackers to execute arbitrary code or cause a denial of service. However CVE-2019-11932 is a vulnerability in the…
-
How we focus design weakness?
Preface: Flaws that require root access are not considered security issues in existing policy. If we are not using cloud computing concept. It is acceptable. But we need cloud system! Security focus: Turkish information security specialist found a design weakness in Windows kernel design. According to the vendor’s Bug Bounty program rules, flaws that require…
-
Outlook for Android – DOM based cross-site scripting (XSS) vulnerability (Nov 2019)
Preface: XSS attack can be either server-side or client-side. Vulnerability details: A vulnerability occurs on Outlook for Android that would allow an attacker to perform cross-site scripting (XSS) attacks on the affected systems and run scripts in the security context of the current user. The official announcement did not described in details. So my earlier…
-
TCP-pipelined queries flaw, causes to bypass tcp-clients limit (CVE-2019-6477)
Preface: To improve bandwidth utilization, an introduce of layer-4 relay(s) that enable the pipelining of TCP connections. Background: BIND 9 has evolved to be a very flexible, full-featured DNS system. On a server with TCP-pipelining capability,it is possible for one TCP client to send a large number of DNS requests over a single connection. Vulnerability…
-
looking back the malware evolutionary at 2019
Preface: Unlike C, C++ is an object-oriented programming language, following a programming model that uses objects that contain data as well as functions to manipulate the data. Word is an object-oriented program. Security focus: The malware author usually exploit some kind of arbitrary code execution or zero day. And therefore it have chances to evade…
-
Gun and bullet – SMBV1 and Ransomware (Nov 2019)
Preface: Starting from around 2012 the use of ransomware scams has grown internationally. Background: About 5 days ago, headline news of Bloomberg told that cyber criminals compromised the IT infrastructure for Mexican Petroleum. Meanwhile, hacker hopes to extract nearly $5 million from the company, with a final deadline of 30th November, 2019. Tremendous incident record:…