-
Security Advisory for Vulnerabilities in QNAP (Q’center) Virtual Appliance – Jul 2018
QNAP’s Network Attached Storage(NAS) is the friend from SME users. Even thought IT Dept, they are also satisfy with NAS. Since the price is affordable and provides plug and play function. It is common that NAT on firewall will be deploy with Hide NAT. As a result your QNAP’s will be receive the new patch…
-
25th JUl 2018 – Malicious Cyber Activity Targeting ERP Applications (Stay alert!)
A consulting firm observe that the abuse of the SAP Invoker Servlet rapidly increase (built-in functionality in SAP NetWeaver Application Server Java systems (SAP Java platforms)). The fact is that customer may not aware or encounter technical difficulties to remediate a former vulnerability. May be a new attack (former vulnerability + Zero day) let…
-
Lost of civilization – Enterprise MDM solution may not detect these apps
The installation packages of Android apps (.APK files) are deploy with.ZIP files. Because of the fundemental design concept. It let malware has way for infection. Yes, threat actor can place a malicious DEX file at the start of the APK file. But V2 signing mechanism can avoid above types of infection. However of the compatiblity…
-
23rd Jul 2018 – Bluetooth vulnerability
Elliptic Curve Diffie Hellman (ECDH) make man in the middle attack difficult since hacker would not be able to find out the shared secret and therefore it looks secure. The public keys are either static (and trusted, say via a certificate) or ephemeral (also known as ECDHE, where final ‘E’ stands for “ephemeral”). Ephemeral keys…
-
Security Alerts! July the 22nd the Apache Tomcat team released three security vulnerabilities.
-
Ethereum carrier Solidity shield – Call abuse vulnerability (CVE-2018-14087)
An Integer Overflow is the condition that occurs when the result of an arithmetic operation, such as multiplication or addition, exceeds the maximum size of the integer type used to store it. Ethereum hits such vulnerability in frequent. The solidity programming language rescue Ethererum in the cryptocurrency world. But no prefect things in the world.…
-
A vulnerability has been identified in IEC 61850 system configurator – CVE-2018-4858
When a lot of cyber security Guru focusing the nuclear power and critical facilities. It looks they also requires to includes the power substation. From techincal point of view, control central will be hardening both console and network environment. But how about the configuration console for substation? Does it allow install the configuration software (IEC…
-
20th Jul 2018 – Win32/Emotet return again!
Strange! A Trojan (Win32/Emotet) found on 2014. It looks that similar of cyber attack comes again. Published Jul 23, 2014 (Trojan:Win32/Emotet) – https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Emotet This threat can steal your personal information, including your banking user names and passwords. It is usually installed when you open a spam email attachment or click on a malicious link in…
-
Defending the Power Grid From Hackers – Jul 2018
Cyber defense facilities today are very strong and effecive to fight against different of cyber attacks. Even though stealer deploy DNS steal technique to exfiltrate the data from a firm. Anti cyber technology have their way to quarantine and deny such activities. Perhaps you said the IoT devices attack that wreaked hovac worldwide. It is…
-
If you are the cisco SD WAN /iWan customer, you should stay alert! 18th Jul 2018 (Cisco security advisories)
Intelligent WAN (iWAN) is a Cisco SD-WAN product that was built from an existing Cisco product (also called iWAN). How do you deploy Cisco SD-WAN? • Cloud-based management and vAnalytics dashboard • Virtual or physical secure routers for on-premise or cloud • In-house IT or managed service with service providers or system integrators • Capital…