-
Outlook for Android – DOM based cross-site scripting (XSS) vulnerability (Nov 2019)
Preface: XSS attack can be either server-side or client-side. Vulnerability details: A vulnerability occurs on Outlook for Android that would allow an attacker to perform cross-site scripting (XSS) attacks on the affected systems and run scripts in the security context of the current user. The official announcement did not described in details. So my earlier…
-
TCP-pipelined queries flaw, causes to bypass tcp-clients limit (CVE-2019-6477)
Preface: To improve bandwidth utilization, an introduce of layer-4 relay(s) that enable the pipelining of TCP connections. Background: BIND 9 has evolved to be a very flexible, full-featured DNS system. On a server with TCP-pipelining capability,it is possible for one TCP client to send a large number of DNS requests over a single connection. Vulnerability…
-
looking back the malware evolutionary at 2019
Preface: Unlike C, C++ is an object-oriented programming language, following a programming model that uses objects that contain data as well as functions to manipulate the data. Word is an object-oriented program. Security focus: The malware author usually exploit some kind of arbitrary code execution or zero day. And therefore it have chances to evade…
-
Gun and bullet – SMBV1 and Ransomware (Nov 2019)
Preface: Starting from around 2012 the use of ransomware scams has grown internationally. Background: About 5 days ago, headline news of Bloomberg told that cyber criminals compromised the IT infrastructure for Mexican Petroleum. Meanwhile, hacker hopes to extract nearly $5 million from the company, with a final deadline of 30th November, 2019. Tremendous incident record:…
-
Interested in this vulnerability CVE-2019-5541?
Preface: As far as I know, VMware announced CVE-2019-5541 on April 2019. But the security update just released two days ago. Perhaps this products not in profitable area. But the flaw awaken quite a lot of people to concerning the weakness in virtual machine design. Background: VMware Workstation is for Windows/Linux while Fusion is for…
-
CVE-2019-0721, CVE-2019-1397, CVE-2019-1398, CVE-2019-1399 – Hyper-V Remote Code Execution Vulnerabilities
Preface: Virtualization in the virtualization platform. It is definitely a microsystem architecture. Technical background: Windows Sandbox requires a Type 1 hypervisor. Therefore, to run Sandbox on a virtual machine, nested virtualization must be enabled. Nested virtualization allows running Hyper-V on a virtual machine. In addition, it allows Windows Sandbox to run on a virtual machine.…
-
The arbitrary code execution (ACE) is on your wrist CVE-2019-8718
Preface: XNU is an operating system kernel developed by Apple Computer for the macOS operating system. It is part of the Darwin operating system. XNU is a hybrid kernel combining the Mach kernel . Background: IOKit – Gain user-space access to hardware devices and drivers. The IOKit object representing a hub device on the USB…
-
Nov 2019 – malware samples, staying alert!
Preface: The Trojan mostly arrive via email or spread from infected websites that users visit. Background: U.S. Cyber Command has released seven malware samples. The malware hash shown as below: a2a77cefd2faa17e18843d74a8ad155a061a13da9bd548ded6437ef855c14442 fdb87add07d3459c43cfa88744656f6c00effa6b7ec92cb7c8b911d233aeb4ac 738ba44188a93de6b5ca7e0bf0a77f66f677a0dda2b2e9ef4b91b1c8257da790 04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30 618a67048d0a9217317c1d1790ad5f6b044eaa58a433bd46ec2fb9f9ff563dc6 1ea6b3e99bbb67719c56ad07f5a12501855068a4a866f92db8dcdefaffa48a39 b6811b42023524e691b517d19d0321f890f91f35ebbdf1c12cbb92cda5b6de32 Our observation: VC++ method of injecting code into other programs is popular (see below): Put your code into…
-
When you receive a word document. Perhaps document contained evasion technique. But you can do a basic health check by yourself. Nov 2019
Preface: Hot topic in the city this week perhaps is uncover the secret of surveillance power. My focus: Perhaps quite a lot of reader are interested of the program code of the surveillance program ( sigs.py ). As far as we know, similar of surveillance program infection technique will be relied on email attachment (especially…
-
Apache solr 8.2.0 remote code execution (nov 2019)
Preface: Apache Solr is an application based on J2EE and uses Lucene libraries internally to provide user-friendly search as well as to generate the indexes. Background: Apache Solr powers the search and navigation features of many of the world’s largest internet sites. Vulnerability details: When an attacker can directly access the Solr console, he can…