-
MS CryptoAPI spoofing flaw – 15th Jan 2020
Preface: We are all scared of Ransomware! Background: crypt32.dll is a type of DLL file, with extension of .dll. It is associated with Crypto API32 and is used to run Crypto API32 based applications. Certain sophisticated video games and software applications use crypt32.dll to get access to certain API functionality, as provided by Windows. Vulnerability…
-
In order to avoid MS ‘.Group’ file handling RCE vulnerability. Think it before click – Jan 2020
Preface: Perhaps you would say the ‘.group’ file handling is the design defect. So hacker exploit social engineer trigger this vulnerability (GROUP FILE URL FIELD CODE EXECUTION). Do you agree? What is a GROUP file? The file is located inside this location: C:\Program Files\Windows Mail. Vulnerability details: Microsoft Windows is prone to a remote code-execution…
-
Phishing email compromised the reputation of company, Microsoft take legal action
Preface: Microsoft products cover a wide range. Perhaps quite a lot of people queries design weakness of their products. But they have capabilities to protect it own. Background: The cyber criminal exploit Microsoft official domain name to made phishing email and goal to increase the possibility to open the email. Meanwhile the malicious infection technique…
-
IoT zone staying alert! HomeAutomation 3.3.2 design weakness exposed (Authentication Bypass, CSRF / Code Execution & Cross Site Request Forgery) – 1-1-2020
Preface: Sometimes lighting can become a security safeguard. Perhaps the lighting system will help you figure out whether intruder jump to your garden at night. Synopsis: It is hard to avoid the digital transformation trend integrate to your daily life. As the matter of fact, they are on board already. For instance the remote controlled…
-
Wish you a Merry Christmas 2019 (cyberX’mas).
I believe that the most annoying cyber security attack is the ransomware. We known that unplug or power off is one of the way to suspend the attack spread out. Yes, agree. Another way to avoid the infection of ransomware is think it over before open unknown email. Yes, During Xmas time you defense idea…
-
Python will be replaced Excel in banking environment. But do not contempt the bug in excel? Nov 2019
Preface: When you walk through trading floor area, you can see trader writing Python code, said chief digital officer at Nomura. Background: Perhaps the popularity of the excel usage in trading floors are coincidence. I believe that DDE and Marco functions driven this trend in in past. Audit team found out that a data handling…
-
Nov 2019 – malware samples, staying alert!
Preface: The Trojan mostly arrive via email or spread from infected websites that users visit. Background: U.S. Cyber Command has released seven malware samples. The malware hash shown as below: a2a77cefd2faa17e18843d74a8ad155a061a13da9bd548ded6437ef855c14442 fdb87add07d3459c43cfa88744656f6c00effa6b7ec92cb7c8b911d233aeb4ac 738ba44188a93de6b5ca7e0bf0a77f66f677a0dda2b2e9ef4b91b1c8257da790 04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30 618a67048d0a9217317c1d1790ad5f6b044eaa58a433bd46ec2fb9f9ff563dc6 1ea6b3e99bbb67719c56ad07f5a12501855068a4a866f92db8dcdefaffa48a39 b6811b42023524e691b517d19d0321f890f91f35ebbdf1c12cbb92cda5b6de32 Our observation: VC++ method of injecting code into other programs is popular (see below): Put your code into…
-
When you receive a word document. Perhaps document contained evasion technique. But you can do a basic health check by yourself. Nov 2019
Preface: Hot topic in the city this week perhaps is uncover the secret of surveillance power. My focus: Perhaps quite a lot of reader are interested of the program code of the surveillance program ( sigs.py ). As far as we know, similar of surveillance program infection technique will be relied on email attachment (especially…
-
Security focus -malicious cyber activity 1 st November 2019
Preface: U.S Homeland security released a report that urge the public to protect computer facilities to avoid Trojan attack. The Trojan found on 2014 which continuous upgrade itself in last half decade. Background: Trojan.Hoplight is a Trojan horse that opens a backdoor on the compromised computer. It may also download potentially malicious files. Security focus:…
-
Oct 2019 – The crisis of Indian nuclear power plant’s
Preface: In fact, of system design weakness, the chances of a hacker getting remote access to systems significantly intensifies. About Indian nuclear power plant’s network was hacked -They have confirmed its newest nuclear power plant was the victim of a cyber attack, exposing the vulnerability of one of the country’s most critical sectors to cyber…