-
Das U-Boot Self-Referential DOS Partition Table Infinite Recursion Vulnerability Aug 2019
Vulnerability details: A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data. Introduction: Das U-Boot a popular primary bootloader, it widely used in embedded devices to fetch data from different sources and run the…
-
Multiple high vulnerabilities in Advantech WebAccess/SCADA -CVE-2019-10989,CVE-2019-10991 & CVE-2019-10993
Preface: Cyber Security expert not suggest access SCADA Dashboard from external area (internet). But we can use VPN establish connection then sign on as a workaround. Background: Advantech WebAccess/SCADA is a browser-based SCADA software package for supervisory control, data acquisition and visualization. Vulnerability details: In WebAccess/SCADA Versions 8.3.5 and prior, multiple heap-based buffer overflow vulnerabilities…
-
IoT world hiccups – CVE-2019-12951 Mongoose parse mqtt() Function Heap-Based Buffer Overflow Vulnerability – Now fixed – Jun 2019
Preface: Smart City look like a housekeeper. The sensor is his eye.But do you have question? He is a man or she is a woman. Background: Mongoose is a cross-platform embedded web server and networking library with functions including different protocol (TCP, HTTP, WebSocket, Server MQTT client and broker). What is MQTT? MQTT is a…
-
Country to country APT attack mechanism not complex, believe that it exploit design flaw instead of backdoor – Jun 2019
Preface: It was the best of times, it was the worst of times, it was the age of wisdom, it was the age of foolishness, … Synopsis: Mongoose is a cross-platform embedded web server and networking library with functions including different protocol (TCP, HTTP, WebSocket, Server MQTT client and broker). Since the footprint is small…
-
Vulnerability might jeopardize IoT world – CVE-2019-10160 Python Security Regression Unicode Encoding Vulnerability (Jun 2019)
Preface: IoT device similar a delivery arm of robotic concept. They are the python language heavy duty users. Python language married with IoT devices – For IoT, there has been a variant of python called Micropython , that lets you program for IoT in Python. Additionally, developer can use Raspberry Pi to program your IoT…
-
Security Focus – CVE-2018-13888
Preface: This design flaw has attracted me. Perhaps the supplier has no formal remediation solution yet. But the impact of this vulnerability seems to be broad! Vulnerability detail: There is potential for memory corruption in the RIL daemon due to the following reason. The location of dereference of memory is outside the allocated array length…
-
Marvell Avastar wireless SoCs have multiple vulnerabilities – 5th Feb 2019
Preface: The Marvell 88W8897A SoC (System on a Chip) is the industry’s first 802.11ac chip to combine Bluetooth 4.2, mobile MIMO (Multi-input Multi-output), transmit beamforming, and with built-in support for all screen projection technologies. Technology Background: Computer design primary focus on memory usage. Even though without an exception in SoC (System on a Chip) design.…
-
Japan government is going to conduct penetration to citizen smart home devices. Feb 2019.
Japan is going to execute infiltration to citizens smart home devices. Do you think what is the goal? Whether they are aware of 3rd party (enemy) has been completed a surveillance program in their country or they are avoid to become a botnet victim? CNN Headline News: https://edition.cnn.com/2019/02/01/asia/japan-hacking-cybersecurity-iot-intl/index.html
-
The vulnerability of the Internet of Things 4.0 has attracted the interest of the APT Group in the enemy country.
Preface: Maybe this is a trend! If we are going to the next generation world (IoT 4.0). At the same time, the APT Group is also sniffing the cybersecurity loopholes in that place! Technical background: In business world we understand the function of broker. A similar situation in computer world, we so called gateway vs…
-
Security Notification – Schneider EVLink Parking (Dec 2018)
Preface: Electric vehicles (EVs) have no tailpipe emissions. Replacing conventional vehicles with EVs can help improve roadside air quality and reduce greenhouse gas emissions. Technical background: Level 2 electric car chargers deliver 10 to 60 miles of range per hour of charging. They can fully charge an electric car battery in as little as two…