-
Jul 2018 – What’s up involving LabCorp Cyber Security incident ?
Headline News said a global laboratory company suspect encounter cyber attack this month (Jul 2018). LabCorp a leading global life sciences company, aim to provides diagnostic, drug development and technology-enabled solutions for more than 115 million patient encounters per year. As of today, we did not heard any official announce the details. However the news on…
-
12th Jul 2018 – ISC Kea 1.4.0 failure to release memory may exhaust system resources
CVE-2018-5739: ISC Kea 1.4.0 failure to release memory may exhaust system resources Hook/Hook Point – used interchageably, this is a point in the code at which a call to user functions is made. Each hook has a name and each hook can have any number (including 0) of user functions attached to it. Store leases…
-
Jun 2018 – ALL NIPPON Airways Security Advisories
ALL NIPPON Airways Security Advisories Airline application and protocol are proprietary in past 2 decades. The Airline terminal guarantee the reliability. Any counterfeit transaction or cyber attack no way to happen there. As times goes by, Airline industry react to develop mobile apps to expand the business function goal to cope with modern world. Japan airline…
-
Found buffer overflow, integrate overflow & memory corruption in redis – Jun 2018
If you have a database of geo-located data, what is the appropriate database setup? The geospatial require fastest database so Redis is one of the option.Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache and message broker. It supports data structures such as strings, hashes, lists, sets, sorted…
-
Heads-up: Low-end Wi-Fi router vulnerability – 24th May 2018
Botnet from earlier phase relies on workstations engage the attack convert to smartphones in last few years. Most likely the security enhancement in workstations and smartphones improved. The threat actors found the new victims today.It is a low-end wireless router. So below items are the guidance: Never trust input Prefer rejecting data to filtering data…
-
The US Securities and Exchange Commission (SEC) new guidance
Big country versus Big discussion: The US Securities and Exchange Commission (SEC) released a statement urge high-ranking executives not to trade stocks before the disclosing breaches, major vulnerabilities, and other cybersecurity related incidents. New guidance – https://www.sec.gov/rules/interp/2018/33-10459.pdf Meanwhile Intel release guidance this week (details of availability and schedule for microcode update). For more details, please…
-
Staying alert – vulnerability found on ABRT in 2015 – CVE-2015-1862
As times go by, Linux especially Fedora replace the position of microsoft windows. This status no popular in personal PC however investment bank environement especially broker and forex exchange trading firm might using intensively. A vulnerabiity found on 2015 but the status of fedora bugzilla display that this is not a bug. My idea is…
-
Alert: Cisco CVE-2018-0125,CVE-2018-0117,CVE-2018-0113,CVE-2018-0116
Staying alert – Your Cisco products Cisco RV132W and RV134W Remote Code Execution and Denial of Service Vulnerability – CVE-2018-0125 (Critical) https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-rv13x Cisco Virtualized Packet Core-Distributed Instance Denial of Service Vulnerability – CVE-2018-0117 (High) https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-vpcdi Cisco UCS Central Arbitrary Command Execution Vulnerability – CVE-2018-0113 (High) https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-ucsc Cisco Policy Suite RADIUS Authentication Bypass Vulnerability – CVE-2018-0116…
-
Merry X’mas 2017
Christmas evolved over two millennia into a worldwide religious and secular celebration. We sing the song (Silent night, holy night) tonight. Let’s celebrate Christmas honoring the birth of Jesus Christ. Our friend computer system also say celebration but it is a hex code (48 61 70 70 79 42 69 72 74 68 64 61…
-
Assurance level of 3rd party software – Part 1
Preface As we know google did the 3rd party application assurance last few months. Their objective is intend to fight against unknown malicious code embedded in software. Hidden malicious code history Metamorphic code (Win32/Simile) was born on 2002 written in assembly language which target Microsoft software operating system products. As time goes by, the 2nd…