-
Have you heard of the “Capital one” data leak! July 2019
Cyber criminal is under arrested. She is accused of breaking into a “Capital One” computer facility and gaining access to 140,000 Social Security numbers, 1 million Canadian Social Insurance numbers and 80,000 bank account numbers. Security Focus : Cyber criminal is under arrested. She is accused of breaking into a “Capital One” computer facility and…
-
CVE-2019-1579 VPN solution impacts Uber, other enterprises may be at risk Jul 2019
Preface: The IoT will make the Taxi Industry change.The business concept of Uber is the industrial leader. Perhaps their concept and ideas are advanced and therefore cyber security are their major concerns. Vulnerability details: Palo Alto Networks PAN-SA-2019-0020 (CVE-2019-1579): Remote Code Execution vulnerability in GlobalProtect Portal/Gateway Interface, especially on SSL Web VPN Applications. Vendor do…
-
Orvibo smart home devices leak billions of user records – customer must staying alert – Jul 2019
Preface: If victim is not negligence. Can we give an excuse to him? Company background: Orvibo, a Chinese smart home solutions provider. Story begin: A technical report shown to the world that Orvibo (ElasticSearch cluster) leaked more than two billion user logs containing sensitive data of customers from countries all over the world.Does the admin…
-
Not a fashion famous brand. Hermes ransomware, the predecessor to Ryuk. NCSC Releases Advisory on Ryuk Ransomware.
Preface: The NCSC is investigating current Ryuk ransomware campaigns targeting organisations globally, including in the UK. In some cases, Emotet and Trickbot infections have also been identified on networks targeted by Ryuk. Technical details: Ryuk was first seen in August 2018. The Ryuk ransomware is often not observed until a period of time after the…
-
Microsoft Exchange server 2013 and new version of product are vulnerable to NTLM relay attacks (2019)
Preface: A privilege escalation is possible from the Exchange Windows permissions (EWP) security group to compromise the entire prepared Active Directory domain. Vulnerability details: A tool capable for performing ntlm relay attacks on Exchange Web Services (EWS). It spawns an SMBListener on port 445 and an HTTP Listener on port 80, waiting for incoming connection…
-
It is hard to judge it was a self defense or attack. New York Times cyber attack news – 16th Jun 2019
-
It will jeopardizing 400,000 Linux system in the world – Exim Releases Security Patches (alert issued in Jun 2019)
Preface: Exim is growing in popularity because it is open source. Background:It’s the default mail transport agent installed on some Linux systems.It contain feature likes: Lookups in LDAP servers, MySQL and PostgreSQL databases, and NIS or NIS+ services. Vulnerability details: The vulnerability was patched in Exim 4.92, released on February 10, 2019. The vulnerable code…
-
Did you have trouble accessing internet on Sat (8th Jun 2019 GMT+8)
Synopsis: The users were temporarily unable to reach adjacent countries internet web sites for short period of time (less than 1 – 3 minutes) due to an issue of Internet BGP backbone. Description: On Sat, I was surprise that some internet web site looks unstable. It is not only happens on a single web site.…
-
As of May 9, 2019, even “Virustotal” did not have his record! where is he from?
Preface: The Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) have identified a malware variant— so called ELECTRICFISH. Technical details: The malware implements a custom protocol like “Tor browser”. The aim to allows traffic by-pass defense mechanism in between source and a destination Internet Protocol (IP) address. The malware continuously attempts…
-
2nd May 2019 – Don’t let you SAP facility become a cyber attack target
Preface: Heard that estimated total of 1,000,000 SAP production systems could currently be at risk of being hacked. Technical details: When you configure sap router (saprouter) to allow remote (from the Internet) connections via the SAP GUI. The original design will add entries to the route tables for TCP port 3300, 3301, and 3303 the…