-
Fake apps embedded ultimate spyware are being infect smartphones especially Android – Dec 2018
Preface: Blackhat conference held 3rd to 6th December 2018 in London. A topic awaken people bring attention to the smartphone security awareness especially Android OS. Technical details:Cyber security expert observe that a malform type of counterfeit apps spreading via watering hole websites and phishing emails. Targets were likely approached directly and encouraged to visit the…
-
CVE-2018-19966:Xen Union Data Structure Guest OS Users Privilege Escalation Vulnerability
Preface: Xen Project is a hypervisor using a microkernel design, providing services that allow multiple computer operating systems to execute on the same computer hardware concurrently. Vulnerability description:The vulnerability is due to an interpretation conflict for union data structure associated with shadow paging.The XSA-240 introduced a new field into the control structureassociated with each page…
-
Cisco Security Advisory – Texas Instruments Bluetooth Low Energy Denial of Service and Remote Code Execution Vulnerability – Last Updated: 13th Dec 2018.
Preface: Key component of smart city are the IoT devices. The communication protocol of the IoT devices are Lora, SigFox and NarrowBand (NB). Background: In realistic, smart city cannot lack of wifi setup for assistance. So, WiFi is one the key component in this family (Smart City). Vendor Cisco follow up TI BLE chips vulnerability…
-
Facebook 6.8 million users’ private photos leaked – Suspected it was happened in developers environment.
Facebook looks bad luck this year. It is better to invite Chinese Feng Shui master provides suggestion. Yes, it is kidding. Perhaps Facebook intend to improve their image. It immediately let’s public know what is happening in the moment. It is talking about 6.8 million users’ private photos leakage. But suspected that the loophole was…
-
Pixars Tractor – Vulnerability Note VU#756913 (13th Dec, 2018)
Preface: As time goes by, an evolution in technology offers best-of-class in rendering for both VFX and feature film animation. What does VFX stand for?Visual effects (abbreviated VFX) is the process by which imagery is created or manipulated outside the context of a live action shot in film making. RenderMan offers a combination of unbiased…
-
Something 101 – Are you aware Docker containers safety?
Preface: Docker’s introduction of the standardized image format has fueled of interest in the use of containers in the enterprise recently. A Docker container look likes a Virtual machine. It is without antivirus or malware detector facilities install to Docker container platform. Is that secure? On the market, there is no such product available in…
-
CVE-2018-1002105 (kubernetes) : authentication/authorization bypass in the handling of non-101 responses – Dec 2018
Preface: Since we launched it in 2014, Kubernetes running strong. It is becoming “the Linux of the cloud,” according to Jim Zemlin, Executive Director of the Linux Foundation. Analysts estimate that 54 percent of Fortune 100 companies use Kubernetes across a spectrum of industries including finance, manufacturing, media, and others. Giant will sick as normal…
-
Microsoft Patch Tuesday (Highlights) – 11th Dec 2018
Preface: Remote code execute and Privileges escalation are the critical vulnerabilities topics which lure end user attentions. On patch Tuesday (remedy program) issued by Microsoft this week. Their product design limitation contains priviliges escalation vulnerability. CVE-2018-8611 – Vulnerability details:With reference of CVE-2018-8611 inform customer that exploit this vulnerability, an attacker would first have to log…
-
Amazon Web Services (AWS) FreeRTOS security advisory – Dec 2018
Preface: A Real-Time Operating System is a Necessity for IoT. FreeRTOS is a real-time operating system kernel for embedded devices that has been ported to 35 microcontroller platforms. It is distributed under the MIT License. Amazon Web Services (AWS) FreeRTOS vulnerabilities checklist: CVE-2018-16522 Remote code execution CVE-2018-16525 Remote code execution CVE-2018-16526 Remote code execution CVE-2018-16528…
-
Functional issues let remediation solution require fallback – Cisco Prime License Manager SQL Injection Vulnerability 10th Dec 2018
Background: On 28th Nov 2018, a SQL injection vulnerability found on Cisco Prime License Manager. Vendor (Cisco) with immediate action release the patch to remediate this design weakness. Technical issue found on patch: Update (2018-December-10): Installing the ciscocm.CSCvk30822_v1.0.k3.cop.sgn patch may cause functional issues. Workarounds are available for some of these issues. Rolling back this patch…