All posts by admin

Potential Risk of CVE

CVE-2019-7609 Do not contempt minor flaw, a alert signal for Big data analytic industry – 27th Mar 2019

Preface: Analyzing big data not so easy.

Synopsis: Analyzing big data not so easy. It requires knowledge of enterprise search engines for making content from different sources like enterprise database, social media, sensor data etc. searchable to a defined audience. Elasticsearch is one of the free and open source enterprise search software.

Vulnerability detail: The vulnerability exists because the affected software mishandles user-supplied input. An attacker could exploit this vulnerability by sending requests that submit malicious input to the affected software.

Causes: Timeline uses regular HTML DOM to render the timeline and items put on the timeline. This allows for flexible customization using css styling.
With the HTML DOM, JavaScript can access and change all the elements of an HTML document.
The design limitation allow the attacker to execute arbitrary JavaScript code on the system.

Remedy: Refer to URL – https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077

Potential Risk of CVE

Security Focus – Cisco design weakness – 27th Mar 2019

Preface: Vendor operate in high visibility, initiate fix vulnerabilities means they are more secure than other products.

Synopsis: From hardware appliance to software base. From Layer 3 to Layer 7, the growth of operations expanded, it is hard to avoid vulnerability occurs.

Vulnerability Details:
Cisco IOS and IOS XE Software Network-Based Application Recognition Denial of Service Vulnerabilities – https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-nbar

CVE-2019-1753: Cisco IOS XE Software Privilege Escalation Vulnerability – https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-iosxe-privesc

CVE-2019-1754: Cisco IOS XE Software Privilege Escalation Vulnerability – https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-iosxe-privesc

Remark: Perhaps the total numbers of high severity vulnerability has 19 items. The remaining is address denial of server and command injection. But the privileges escalation merely our focus this time. So the remaining do not display in this discussion.

Potential Risk of CVE

CVE-2019-3878: Uninett mod_auth_mellon ECP Authentication Bypass Vulnerability (26th Mar 2019)

Preface: The statistic by Netcraft in January 2019, Apache server coverage market reach 30.88%.

Technical background: Apache server not only contain web server service, it can config as a reserve proxy server to enhance the web infrastructure isolation level. Single sign-on authentication method growth significant in past few years. A popular web architecture model, setup Apache become reserve proxy service and thus integrate to single sign on (SAML) function.

Vulnerability detail: If Apache is configured as a reverse proxy with mod_auth_mellon for authentication, the authentication can be bypassed by adding SAML 2.0 ECP headers to the request.

Official announcement and security fixes: https://github.com/Uninett/mod_auth_mellon/releases

2019, cyber security incident news highlight

Headline News: ASUS Live Update software encounter Advanced Persistent Threat (APT) groups implant backdoor – 26th Mar 2019

Preface (Attack roadmap): Asus Live Update software installed on laptops and PCs encounter cyber attack in between June and November 2018. Hacker implant a backdoor into the live update software!

Observation: ASUS, it configures the network using dynamic host configuration protocol and then makes a plain HTTP request to a remote server to check if a newer version of the UEFI BIOS firmware is available than the version currently running in the system. Thus, there’s no SSL protection nor verification that it’s actually talking to the correct remote server.

Official announcement: ASUS response to the recent media reports regarding ASUS Live Update tool attack by Advanced Persistent Threat (APT) groups (below URL for reference): https://www.asus.com/News/hqfgVUyZ6uyAyJe1

Potential Risk of CVE

Found CVE-2018-18252, Capmon enhance their privilege command handling technique in new version.

Preface: In order to avoid cyber attack and insider threat. The monitoring feature is a critical feature in IT world.

Background: CapMon monitors and collects information from the infrastructure and applications. The system does not require installation of extra software on other units in the network. CapMon IT monitoring has a Web based user interface, ensuring fast access to the various functionalities.

Vulnerability details:
Design weakness in this software – all priviliges commands “only” grants local administrator privilege. There is a command that allows for even higher privilege escalation – namely the “CALScriptDRUN” command.
The fact is that an issue was discovered in CapMon Access Manager 5.4.1.1005. CALRunElevated.exe provides “NT AUTHORITY\SYSTEM” access to unprivileged users via the –system option.

Should you have interest, please refer to Improsec analytic report, url shown as below: https://improsec.com/tech-blog/cam1

Potential Risk of CVE

Front end secure, back end negligent! RSA® Authentication Manager – CVE-2019-3711

Preface: RSA Authentication Manager delivers intelligent, transparent, behind-the-scenes authentication to enhance every secure access scenario.

Product advantage: Take full advantage of virtualization in your organization to ease deployment, administration, and on-going system management.

Vulnerability details:
RSA Authentication Manager versions prior to 8.4 P1 contain an Insecure Credential Management Vulnerability. A
malicious Operations Console administrator may be able to obtain the value of a domain password that another Operations Console administrator had set previously and use it for attacks.
Hints: Please refer to attached diagram.

Remedy:
Install RSA Authentication Manager version 8.4 P1 and later version.

Blockchain

Coinbase acquisition hits controversial!

Preface: Coinbase announced that it had acquired Neutrino, a blockchain intelligence startup on Feb 2019. This acquisition aim to analyzing data on public blockchains, Neutrino will help us prevent theft of funds from peoples’ accounts, investigate ransomware attacks, and identify bad actors.

Market status: A tremendous worries by cryptocurrency users because the Neutrino (acquired company) run by Former Spyware Developers. And the Neutrinos key staff have been involved with Hacking Team.

Recalling memories: Do you still remember Italian surveillance company exploit CVE-2013-0633. The attacks Involving DaVinci. HackingTeam sold the zero-day exploit to the parties carrying out these attacks or if they acquired the zero-day exploit that allowed them to install DaVinci from a different source. Hacking team responsible the above action.

In the meantime, no further status update. Should you have interest of this news, please refer headline news by Bloomberg (see below): https://www.bloomberg.com/news/articles/2019-03-04/coinbase-risks-user-losses-after-buying-firm-with-spyware-ties?srnd=cybersecurity

Public safety

Our Future especially Smart City is waiting for 5G mobile communication. Does your body ready for 5G signal?

Preface: When mobile phone was born. Some of the people had concerning about the impact of electronic device to human health. As time goes by, seems we forget about it because we need smartphone now!

Historical background: The FCC has established a policy for human exposure to radio frequency electromagnetic fields. Seems it looks fine, the specifics policy defined, right? However if you review related policy (see below url). You might have doubt? Does our existing policy synchronize with modern technology? https://www.fcc.gov/general/radio-frequency-safety-0

About vulnerability: The medical industry not specify such technology will be potentially harmful to human body. But brain cancer, salivary cancer, acoustic neuromas and two other types of cancer go up with cell phone use. It was strange that European countries are the leader to promoting healthcare. However it looks that they are also the technology supporter. Regarding to strategic project plan especially infrastructure of the country. The major elements should be included in design phase but I did not seen the renewal policy of Human Exposure to Radio Frequency Electromagnetic Fields.

Data privacy

User opinion – Would you mind your user credential naked running? Facebook scandal (Mar 2019)

Preface: Do I Really Need To Encrypt Every File on My Computer?
May be answer is simple, all depends on your data classification label…..

The focus: Informed sources told that access logs showed some 2,000 engineers or developers made approximately nine million internal queries for data elements that contained plain text user passwords.

What is the objective of external audit?
The objective of external audit is for the auditor to express an opinion on the truth and fairness of IT operations.

Doubt? From information security point of view, developer role should not access production environment especially data. Meanwhile what is the job role for engineers? Seems the job role very messes.

Headline News: https://www.bbc.com/news/technology-47653656

Potential Risk of CVE

Cisco managed to conduct the remediation of IP Phone 8800 Series vulnerabilities – 20th Mar 2019

Preface: Cisco has announcement yesterday that there are vulnerabilities found on IP Phone 8800 Series.

About IP Phone 8800 Series: The Cisco IP Phone 8800 Series delivers HD video and VoIP communications, and integrates with your mobile device to meet your business needs.

Vulnerability details are shown as below:

  • Cisco IP Phone 8800 Series Path Traversal Vulnerability – https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190320-ipptv
  • Cisco IP Phone 8800 Series File Upload Denial of Service Vulnerability – https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190320-ipfudos
  • Cisco IP Phone 8800 Series Authorization Bypass Vulnerability – https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190320-ipab
  • Cisco IP Phone 7800 Series and 8800 Series Remote Code Execution Vulnerability – https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190320-ip-phone-rce
  • Cisco IP Phone 8800 Series Cross-Site Request Forgery Vulnerability – https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190320-ip-phone-csrf

Synopsis of 2 items of vulnerability: Perhaps Cisco did not provides the vulnerability details on CVE-2019-1716 and CVE-2019-1763. However there are hints let’s we can speculate those issues. Web applications are highly vulnerable to input validation errors. Inputting the invalid entry “!@#$%^&*()” on a vulnerable web application may cause performance issues or denial of service on a vulnerable system or invalid passwords such as “pwd’” or “1=1— ” may result in unauthorized access.