-
About WRECK DNS vulnerabilities – 15th Apr 2021
Background: DNS security awareness awaken by expert conduct a simple DNSsteal to do a demonstration show how to exploit unknown function feature on DNS function in few years ago.On April 2021, cyber security product vendor with security experts announce that a unknown TCP/IP Stack weakness in IoT.The difference in between DNS misuse function (DNSsteal) and…
-
Design limitation of iDS6 DSSPro Digital Signage System 6.2 – 6th Nov 2020
Preface: Digital signage’s content is powered by a media player or system-on-a-chip which pushes content to a display.Users can then manage the content with a content management system. Background: Design limitation of iDS6 DSSPro Digital Signage System 6.2 . The vulnerability cause by autoSave password function.Since it is a pure unencrypted http traffic, it let…
-
US Homeland security urge public alert on “Ripple20” Vulnerabilities (16th June 2020)
Preface: Baxter US, Caterpillar, Digi International, Hewlett Packard Enterprise, Intel, Rockwell Automation, Schneider Electric and Trek are impact by this vulnerability.There are more vendor which do not know the actual status. Vulnerability details:An attacker from outside the network taking control over a device within the network, if internet facing. There are more ways to exploit…
-
Discarded Tesla car parts contain information. Maybe you can buy it on eBay. Who can believe in the technological world? Even if no such incident occurs, the supplier can read your local data without your consent (8th May 2020)
Preface: The traditional method of disposing of hard drives is degaussing or incineration. Headline News: The manufacturer has a hardware disposal policy. The incidents encountered by Tesla may be due to improper handling of third parties. For more information about headline news, please refer to this link. https://www.hackread.com/user-data-found-in-tesla-car-parts-ebay/ Supplement: Should you have doubt about your…
-
Storm of Go language based malware – 6th May 2020
Preface: New Kaiji malware targets IoT devices via SSH brute-force. Background: Gobot is a framework for robotics, drones, and the Internet of Things (IoT), written in the Go programming language. Observation: Programmers usually choose Golang for building the communication layer within the IoT system. One of the biggest draws to Go is the fact that…
-
CVE-2019-12941 – AutoPi ( Wi-Fi/NB and 4G/LTE) devices wifi password vulnerability (Oct 2019)
Preface: Are you afraid of someone suddenly controlling your car? Background: AutoPi is a small device that plugs into the OBD-II port of your car. What is OBD-II port? OBD-II port of the car which gives the dongle access to the cars internal systems. AutoPi also provides a cloud service that lets you communicate with…
-
New generation of weapon iot+lora+Drone (2019)
Preface: Traditionally, only big country can have military weapon. Computer technology especially IoT devices not only replace human power. As we seen, IoT 4.0 is going to replace routine man power resources. Perhaps IoT technology also infiltrate in military arsenal . Details: On Sep, 2019. Drone attacks have set alight two major oil facilities run…
-
CVE-2019-10099 Apache Spark Unencrypted Data Vulnerability Aug 2019
Background: Apache Spark is the tailor made for big data industry.Spark’s advanced acyclic processing engine can operating as a stand-alone mode or a cloud service. Synopsis: Spark supports encrypting temporary data written to local disks. This covers shuffle files, shuffle spills and data blocks stored on disk (for both caching and broadcast variables). It does…
-
CVE-2019-11042 PHP flaw form a way to read past the allocated buffer. This may lead to information disclosure or crash. Aug 2019
Preface: We knew Python programming language has large footprint in IoT world. Have you heard PHPoC (PHP on Chip) – a programming language and an IoT hardware platform? So, PHP programming language still have survival space. Background: The EXIF headers tend to be present in JPEG/TIFF images generated by digital cameras. In order to read…
-
How smart of the smartcity, depends on your vulnerability management (CVE-2019-14462 & CVE-2019-14463) Aug 2019
Preface: Why should we driven Artificial Intelligence like a maniac? We are mankind! MODBUS techincal background: Modbus is a communication protocol developed by Modicon systems. In simple terms, it is a method used for transmitting information over serial lines between electronic devices. The device requesting the information is called the Modbus Master and the devices…