-
New variant of the Zebrocy (smqft_exe & sespmw_exe). They are design to perform various functions on the compromised system, said USCERT (3rd Nov 2020)
Preface: Some expert comment that because of Go language programming file will be large than usual. It might have possibilities to evade virus scanning. So malware author like to use. Perhaps this is not the major factor. Background: In July 2019, a security researcher found nearly 10,700 unique samples of malware written in Go programming…
-
Boeing, U.S. regulator made series of errors ahead of 737 Max crashes: congressional report (SeP 2020)
Preface: From logical point of view, if input only relies on a standalone source (sensor). The integrity of the result all relies on the total amount of variable factors. Perhaps sensor install on airplane is a IoT device. So it lure my interest. Background: Traditionally the older (NG) 737 variants did not have fly-by-wire technology,…
-
APT developing new evasion technique to conducting cyber attack – 23rd Sep 2020
Preface: The APT organization provides a hard-to-detect malware to attack other hostile campus. Synopsis: The evasion technique found recently by security expert team is that APT 29 exploit the design weakness of detection machanism. They do a re-engineering to covert a zip file to JPEG.“This technique works because JPEG files are parsed from the beginning…
-
Remote Access Trojan: BLINDINGCAN – 19th Aug 2020
Preface: The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have identified a malware variant—referred to as BLINDINGCAN—used by North Korean actors. Techincal details: Perhaps the official report already provide the details. In short, the key point is that APT group exploit the Microsoft Word vulnerability (CVE-2017-0199). As such, APT…
-
New Linux malware – aka Drovorub (13th Aug 2020)
Preface: New Linux malware silently conducting the attack. The FBI and NSA issue joint security alert. Official announcement – https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF Remedy: To prevent attacks, the agency recommends that US organizations update any Linux system to a version running kernel version 3.7 or later, “in order to take full advantage of kernel signing enforcement,” a security…
-
Currently, only a few antivirus vendors can successfully detect it. Preventive control should be apply. (03-08-2020)
Preface: In 2017, Honeypot detected that malware spread a new payload targeting 60001 TCP port. The ultimate goal is the JAWS Web Server & MVPower DVR. It turns out that there will be a Shell Command Execution vulnerability. Security expert has doubt on IoT device especially DVR which make use of TCP 60001 port. Observation:…
-
Sometimes he is a friend, but suddenly….(MAR-10296782-1.v1 – SOREFANG) – 29th Jul 2020 [Recently goal: Targeting COVID-19 Research, Vaccine Development ]
Preface: It looks that who have vaccine of COVID-19 will be grant the dominance of the world. Reference: DVC APIs will help you to implement modules on the server and client side of a Remote Desktop Services connection that communicate with each other.A remote code execution vulnerability exists in Remote Desktop Services. When an unauthenticated…
-
Australia (ACSC) urges local citizens to be vigilant against cyber attacks. The so-called copy-paste compromises – 18th June 2020
Preface: Australia’s government and institutions are being targeted by ongoing sophisticated state-based cyber hacks, Prime Minister Scott Morrison says. Mr Morrison did not name specific cases but said it had spanned “government, industry, political organizations, education, health, essential service providers and operators of other critical infrastructure”. 19th June 2020 Technical details: Long story short. The…
-
US Homeland security urge public alert on “Ripple20” Vulnerabilities (16th June 2020)
Preface: Baxter US, Caterpillar, Digi International, Hewlett Packard Enterprise, Intel, Rockwell Automation, Schneider Electric and Trek are impact by this vulnerability.There are more vendor which do not know the actual status. Vulnerability details:An attacker from outside the network taking control over a device within the network, if internet facing. There are more ways to exploit…
-
us homeland security alert – design weakness of universal plug and play – 9th jun 2020
Preface: Universal Plug and Play (UPnP) is a set of networking protocols that permits networked devices, such as personal computers, printers, Internet gateways, Wi-Fi … Review historical event: Mirai is an IoT botnet that was designed to exploit vulnerabilities in IoT devices for use in large-scale DDoS attacks.In September 2016, the Mirai malware launched a DDoS…