-
Are you worried about UEFI BIOS attacks? (19th Jan, 2021)
Preface: Quite a lot of UEFI vulnerabilities and hardware misconfigurations have been found in past. This is an alert signal. As a matter of fact, the problem is that it’s very difficult to get malicious code into UEFI systems. Background: Reading the first sector from a disk and loading it to 0x7C00 is a BIOS…
-
CVE-2021-24122 Apache Tomcat Information Disclosure (14th Jan 2021)
Synopsis:What is a Reparse Point? According to official information by Microsoft, In NTFS Filesystem, there is a concept called “reparse point. The traditional NTFS junctions and Win10 “Unix-like” symlinks are two different kinds of reparse points.Starting in Windows 10, version 1607, for the unicode version of this function (FindFirstFileW), you can opt-in to remove the…
-
CVE-2020-27780 – Linux-pam vulnerability – Improper Authentication (18th Dec 2020)
Background: Linux pam originated from the open source implementation of the software DCE-RFC of Sun, a well-known manufacturer later acquired by Oracle. PAM is called Pluggable Authentication Modules, which can be inserted into authentication modules. Various authentication modules and plug-ins can be dynamically introduced for authentication without reloading the system, very flexible. Vulnerability details: When…
-
CVE-2021-3006 (Loopring(LRC) Protocol Incident)- If you are passionate about cryptocurrency. You should be alert of this. (4th Jan 2021)
Background: In November 2020, lots of DeFi platforms in Ethereum encounters a security incident, such as Pickle Finance, 88mph. What Is Decentralized Finance (DeFi)?By deploying immutable smart contracts on Ethereum, DeFi developers can launch financial protocols and platforms that run exactly as programmed and that are available to anyone with an Internet connection. What Are…
-
To avoid malware misuse “PACKET_MMAP” function,from Linux environment. CISA Releases Free Detection Tool for Azure/M365 Environment (29th Dec 2020)
Preface: Neither shellcode or shellcode injection have anything to do with shell scripting. It is a sophisticated way of finding a vulnerable spot on the cyber security layer of an organization and exploiting it for malicious purposes. Background: Azure Sphere is a secured, high-level application platform with built-in communication and security features for internet-connected devices.…
-
Reminder: For those who are using it (SCO Openserver) 28th Dec 2020
Preface: Today’s web design tools are quite mature, and you can complete large websites without even touching HTML syntax. Maybe the vulnerability can happen in this way! What’s HTTP Method?OPTIONS, GET, HEAD, POST, PUT, DELETE, TRACE, CONNECT What is the difference between GET and POST?In HTTP GET Method, it is not allowed to pass data…
-
Before the end of 2020, there are two important notes to remind Citrix users (22nd Dec 2020)
Preface: Many companies, especially law firms, and financial institutions will choose Citrix thin client functions. The decision seems to be correct, because their function looks perfect. For example, TCP offloading and network security protection. However, in order to cope with on demanding digital technology market. As a result, they are involved in some technologies and…
-
CVE-2020-4829 – AIX owner should be staying alert! (14th Dec 2020)
Preface: When I was young, there were two giants in the mid-range system market. They are IBM and Sun Micro. Over the time, IBM won this market. To this day, the business world likes to use IBM AIX OS the most. Background: About twenty years ago, a well known buffer overflow vulnerabilities discovered in Kerberos…
-
FireEye detected APT activities go through Solarwinds product – 13th Dec 2020
Preface: SolarWinds Orion is an IT performance monitoring platform that helps businesses manage and optimize their IT infrastructure. Vulnerability details: SolarWinds.Orion.Core.BusinessLayer.dll is signed by SolarWinds. However, when connection come from trusted vendor (valid signature ) which carry malware. Existing design do not have defense mechanism. Impact: CISA has determined that this exploitation of SolarWinds products…
-
Chakra scripting engine countdown. However, you still need to patch (11th DEc 2020)
Preface: Microsoft Edge no longer uses Chakra. Microsoft will continue to provide security updates for Chakracore 1.11 until 9th March 2021 but do not intend to support it after that. Background: Chakra, a JavaScript engine that powers Windows applications written in HTML/CSS/JS and used to power Microsoft Edge. ChakraCore supports Just-in-time (JIT) compilation of JavaScript…