-
Black Friday was happened in New Orleans on 13th Dec 2019
Preface: Once upon a time, without internet. The Black Friday virus through floppy disk infected to your MS-DOS and make a trouble to your personal computer. Background: New Orleans declared a state of emergency and shut down its computers after a cyber security event. During a press conference on 14th Dec 2019, Mayor Cantrell confirmed…
-
Gun and bullet – SMBV1 and Ransomware (Nov 2019)
Preface: Starting from around 2012 the use of ransomware scams has grown internationally. Background: About 5 days ago, headline news of Bloomberg told that cyber criminals compromised the IT infrastructure for Mexican Petroleum. Meanwhile, hacker hopes to extract nearly $5 million from the company, with a final deadline of 30th November, 2019. Tremendous incident record:…
-
Oct 2019 – The crisis of Indian nuclear power plant’s
Preface: In fact, of system design weakness, the chances of a hacker getting remote access to systems significantly intensifies. About Indian nuclear power plant’s network was hacked -They have confirmed its newest nuclear power plant was the victim of a cyber attack, exposing the vulnerability of one of the country’s most critical sectors to cyber…
-
ABout MasterCard data breach – Aug 2019
Preface: Still remember that when I was work in bank environment. Visa and Master payment solutions looks indeed secure. Those facilities are running in standalone machine. The communication protocol is the IBM SDLC communication. In order to communication with S390 mainframe. We setup data link switch in network switch and define VTAM major nodes on…
-
Have you heard of the “Capital one” data leak! July 2019
Cyber criminal is under arrested. She is accused of breaking into a “Capital One” computer facility and gaining access to 140,000 Social Security numbers, 1 million Canadian Social Insurance numbers and 80,000 bank account numbers. Security Focus : Cyber criminal is under arrested. She is accused of breaking into a “Capital One” computer facility and…
-
CVE-2019-1579 VPN solution impacts Uber, other enterprises may be at risk Jul 2019
Preface: The IoT will make the Taxi Industry change.The business concept of Uber is the industrial leader. Perhaps their concept and ideas are advanced and therefore cyber security are their major concerns. Vulnerability details: Palo Alto Networks PAN-SA-2019-0020 (CVE-2019-1579): Remote Code Execution vulnerability in GlobalProtect Portal/Gateway Interface, especially on SSL Web VPN Applications. Vendor do…
-
Orvibo smart home devices leak billions of user records – customer must staying alert – Jul 2019
Preface: If victim is not negligence. Can we give an excuse to him? Company background: Orvibo, a Chinese smart home solutions provider. Story begin: A technical report shown to the world that Orvibo (ElasticSearch cluster) leaked more than two billion user logs containing sensitive data of customers from countries all over the world.Does the admin…
-
Not a fashion famous brand. Hermes ransomware, the predecessor to Ryuk. NCSC Releases Advisory on Ryuk Ransomware.
Preface: The NCSC is investigating current Ryuk ransomware campaigns targeting organisations globally, including in the UK. In some cases, Emotet and Trickbot infections have also been identified on networks targeted by Ryuk. Technical details: Ryuk was first seen in August 2018. The Ryuk ransomware is often not observed until a period of time after the…
-
Microsoft Exchange server 2013 and new version of product are vulnerable to NTLM relay attacks (2019)
Preface: A privilege escalation is possible from the Exchange Windows permissions (EWP) security group to compromise the entire prepared Active Directory domain. Vulnerability details: A tool capable for performing ntlm relay attacks on Exchange Web Services (EWS). It spawns an SMBListener on port 445 and an HTTP Listener on port 80, waiting for incoming connection…
-
It is hard to judge it was a self defense or attack. New York Times cyber attack news – 16th Jun 2019