-
Commonplace, smartphone OS vulnerability (22nd Dec 2022)
Preface: The software writes data past the end, or before the beginning, of the intended buffer. Typically, this can result in corruption of data, a crash, or code execution. Background: In the Android system, an application has at least one process, and each process has its own independent resources and memory space. Other processes cannot…
-
About GriftHorse Malware (30th Sep 2021)
Preface: Large portion of smartphone will not installed antivirus software. Even though it is installed. The antivirus vendor similar doing racing campaign with cyber criminals. Nowadays, vendor established malware sinkhole to find zero day vulnerability and existing cyber attack. If cyber criminals relies on software design limitation hiding itself on phone. Perhaps sinkhole not easy…
-
Reduce e-waste and achieve environmental protection: outdated iphone models – Security updates (14-06-2021)
Preface: To protect the safety of customers, Apple will not disclose, discuss or confirm security issues until the investigation is completed and patches or updated versions are provided. My observations on CVE-2021-30737: Background: PKINIT is a preauthentication mechanism for Kerberos 5 which uses X.509 certificates to authenticate the KDC to clients and vice versa.PKINIT requires…
-
Iphone 6s owner have serious operation problem after upgrade their IOS to 12.4.9. Do you think vendor will be fixed?
Preface: Vendor insists to fix the cyber security weakness of CVE-2020-27929 & CVE-2020-27930. However, this iOS upgrade action was caused the specify iPhone product encounter operation difficulties especially 6s. Observation 1: On 5th November, 2020, apple implement security update to enhance the cyber security protection on their products. This enhancement including an remediation action to…
-
Please be vigilant. Spyware will be installed on your phone at any time – Oct 2019
Preface: Since the spyware runs in a stealth mode, it will let you track the device without being detected. Background: Patroit Act empower law enforcement agency or related department can legally monitor the movements of suspect especially Terrorism. And therefore law enforcement agency will be used spyware monitor what’ the target movement. As time goes…
-
Reflection – Crafted emoji cause WeChat application (for Android) service crash.
Preface: When mobile computing born, cyber attack (botnet attack) and data leakage rapidly growth. Do you think this is the destiny. Observation: A proof of concept shown that a technical limitation occurs on TenCent WeChat 7.0.4 (android version). When a stranger send a craft emoji to WeChat user. The WeChat application will be crashed once…
-
Who is right, who is wrong. Who know?
Preface: Spy Chip Scandal Amplifies Concerns over Huawei’s 5G Equipment on last year (2018). Doubt – Is it safe to use Huawei phones and should the manufacturer be trusted to make 5G network equipment? Reality: A flaw discovered in an ASN.1 compiler, a widely used C/C++ development tool, could have propagated code vulnerable to heap…
-
Does QR Codes can pose a risk to your security and safety?
Preface:QR codes have become common in consumer advertising. Friendly speaking, it make your finger and mouth more relaxed! Is the QR code safe? Most risks with QR Codes stem from QR Codes not being readable to humans. Since the QR codes not being able to easily identify a code as the original where the problems…
-
Synopsis- NIST plan to retire SMS function deployed for two Factor Authentication
As of today, we are enjoying the security protection of 2 factor authentication with SMS-based one-time passwords (OTP). This protection mechanism was distributed widely. For instance, online banking, Visa,Master credit card online payment system and mobile application payment system. However NIST plan to retire SMS base 2 factor authentication. This decision has similar a open topic…
-
Integrated GPU may allow side-channel and rowhammer attacks – 03 May 2018 | Last revised: 03 May 2018
The side-channel attack looks never ending in CPU world. So called rowhammer attack jeopardize to the cyber security world today especially smartphone. The worst is that it can altering the information saved in a computer’s memory once attack successful. An academic paper describes an attack called “GLitch,” which leverages two different techniques to achieve a compromise…