Category Archives: Under our observation

Not seen attack related to CVE-2018-7559, but require considerations and stay alert.

US Homeland security has announcement three times within this year ( April 16, 2018,May 29, 2018 and June 14, 2018) thus to urge the world staying alert malicious attack.Perhaps the industrial sector especailly oil and gas, power supplier facilities has detective and preventive control in placed. Hacker will be facing difficulties for attack. As far as we know, OPC source code on GitHub contains a flaw let remote attacker use the Server’s private key to decrypt and sign messages by using information obtained by sending invalid UserIdentityTokens encrypted with the Basic128Rsa15 security policy. The successful result could allow an attacker to decrypt passwords even if they are encrypted with another security policy such as Basic256Sha256. This flaw found on April this year and remediation has been announced. However, I believe that cyber security attacks exploit of this vulnerability will be happened soon.

Official announcement (OPC Foundation Security Bulletin Security Update for the OPC UA Stacks – April 2018)

https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2018-7559.pdf

 

June 2018 Node.js Security Releases

Node.js runs on top of a Javascript engine therefore it is portable to any platform in computer world. Deploy a Node.js web application environment using AWS Elastic Beanstalk and Amazon DynamoDB. Elastic Beanstalk provisions and manages the underlying infrastructure.
Solutions Infini is the Leading Bulk SMS & Cloud Telephony service provider. But the front end AWS Lamda function powered by node.js platform.
The organization of node.js announced that node.js (6.x – 10.x) has vulnerabilities occurs.
Official announcement and remediation step shown url below:

https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/

Windows SharePoint Services – “To be, or not to be”

Microsoft formalized Patch Tuesday in October 2003 till today. It was focus on workstation, server and software product till today.  Any differences in the Microsoft architecture model in last decade? Perhaps your answer is the cloud platform and collaboration cloud. Yes, the cloud computing technology similar 14th and 17th centuries renaissance. Thus, a major component in existing technology world.

The point of view of IT management avoid of cloud computing in the earlier stage till today they are enjoy of this technology. As times go by, Microsoft SharePoint product widely deploys in IT environment. There is system architect build SharePoint work as data warehouse.

SharePoint design looks fine from Microsoft point of view. Furthermore both authentication and security are coexist with Active directory. It is a popular setup since it is a single sign on.

The vulnerabilities found on SharePoint in 2018 in retrospect (see below), it display that SharePoint are easy to cause remote code execution by attacker.

 

CVE Score Vulnerability Type(s)
CVE-2018-8254 An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server.

The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim’s identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.

not yet calculated
CVE-2018-8252 An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server.

The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim’s identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.

not yet calculated
CVE-2018-8168 A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka “Microsoft Office Remote Code Execution Vulnerability.” This affects Microsoft Word, Word, Microsoft Office, Microsoft SharePoint. This CVE ID is unique from CVE-2018-8157, CVE-2018-8158. 9.3 Exec Code Overflow
CVE-2018-0922 Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Compatibility Pack SP2, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps 2013 SP1, Microsoft Office Word Viewer, Microsoft SharePoint Enterprise Server 2013 SP1, Microsoft SharePoint Enterprise Server 2016, Microsoft Office Compatibility Pack SP2, Microsoft Online Server 2016, Microsoft SharePoint Server 2010 SP2, Microsoft Word 2007 SP3, Microsoft Word 2010 SP2, Word 2013 and Microsoft Word 2016 allow a remote code execution vulnerability due to how objects are handled in memory, aka “Microsoft Office Memory Corruption Vulnerability”. 9.3 Exec Code Overflow Mem. Corr.
CVE-2018-0797 Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way RTF content is handled, aka “Microsoft Word Memory Corruption Vulnerability”. 9.3 Exec Code Overflow Mem. Corr.
CVE-2018-0792 Microsoft Word 2016 in Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka “Microsoft Word Remote Code Execution Vulnerability”. This CVE is unique from CVE-2018-0794. 9.3 Exec Code Overflow
CVE-2018-0789 Microsoft SharePoint Foundation 2010, Microsoft SharePoint Server 2013 and Microsoft SharePoint Server 2016 allow an elevation of privilege vulnerability due to the way web requests are handled, aka “Microsoft SharePoint Elevation of Privilege Vulnerability”. This CVE is unique from CVE-2018-0790. 9

Refer to attach Share Point architecture diagram, this is a common practice model deployment integrate to Azure (IaaS) Cloud platform. If coincidentally MS Excel and Share Point has vulnerabilities occurs (similar situation display on diagram). Which item become critical in nowadays IT environment, end point, server or cloud platform?

See whether below high vulnerabilities items happened on Jun 2018 can provides hints to you in this regard.

CVE-2018-8233 | Win32k Elevation of Privilege Vulnerability – An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka “Win32k Elevation of Privilege Vulnerability.” This affects Windows 10, Windows 10 Servers.

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8233

CVE-2018-8251 | Media Foundation Memory Corruption Vulnerability – A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory, aka “Media Foundation Memory Corruption Vulnerability.” This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8251

CVE-2018-8252 | Microsoft SharePoint Elevation of Privilege Vulnerability – https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8252

CVE-2018-8254 | Microsoft SharePoint Elevation of Privilege Vulnerability – https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8254

— End —

 

 

 

 

Bitcoin exchanges must remain vigilant to low value coins

Heard that a vulnerability found on cryptocurrency (FuturXE (FXE)). The problem is that smart contact designer make a programming logic mistake. Department of Homeland Security confirm the bug this week. (CVE-2018–12025) – https://nvd.nist.gov/vuln/detail/CVE-2018-12025

The vulnerabilities and cyber attack looks never stop so far. Do you still remember virtual currency exchange Coincheck lost $400 million in NEM cryptocurrency in Jan 2018?

The hack only involved NEM, because the security breach was caused by the lack of strong security measures of Coincheck with regards to their implementation of NEM, lacking the use of mutlisignature support or a cold wallet.

It looks that criminal group will be intereted of low market value cryptocurrency. For instance, CVE-2018-10468 hacker exploits useless token combine with vulnerability steal the token. Coincheck lost $400 million in NEM but the market price of each coin is in lower value.

FutureXE market price equal to zero buy still avaiable to buy on the market. I think this type of coins will be lure criminal group interest. The fact is that this type of coins willl be exploits for money laundering. Since the coin has vulnerability occured, criminal group can hiring hacker to steal the coin and waiting for bitcoin exchanges reimburse the fund to achieve the money laundering objective.

— End —

June 2018 – Red Shell service arousing public question!

DNS logs explicitly shown the internet user activities. For instance a malicious network traffic that can be identified in DNS logs. The technical details includes command and control (C2) traffic of the following cyber attacks.
Ransomware, malicious ads and redirects, exploit kits, phishing, typosquatting attacks, DNS hijacking; denial of service (DoS) attacks; and DNS tunneling.

Pi-hole is a Linux network-level advertisement and internet tracker blocking application which acts as a DNS sinkhole. DNS Sinkholing is a mechanism aimed at protecting users by intercepting DNS request attempting to connect to known malicious or unwanted domains and returning a false, or rather controlled IP address. The controlled IP address points to a sinkhole server defined by the DNS sinkhole administrator.

The Sinkhole server can be used to collect event logs, but in such cases the Sinkhole administrator must ensure that all logging is done within their legal boundaries and that there is no breach of privacy.

Red Shell helps PC & console games uncover where their players
come from through reliable attribution. Their system architecture build by PI-HOLE and bind opensourece application. Meanwhile PI-HOLE and BIND can do reverse engineering. It can do the end point monitoring, aim to keep track the customer behaviour.

A concerns of public and question the analytics package provided by Innervate, Inc., to game publishers.
Innervate, a Seattle-based company founded to help game makers reach more customers, is launching its new Red Shell service today.

Reference:

European Union Agency for Network and Information Security

What is a “DNS Sinkhole”? – https://www.enisa.europa.eu/topics/csirts-in-europe/glossary/dns-sinkhole

Remark: Administrator must ensure that all logging is done within their legal boundaries and that there is no breach of privacy.

June 13, 2018 – ISC Releases Security Advisory for BIND

 

Operating system · Linux, NetBSD, FreeBSD, OpenBSD, macOS, Windows · Type · DNS server · License · Mozilla Public License (ISC license before 9.11). Website, www.isc.org/downloads/bind. BIND is the most widely used Domain Name System (DNS).

ISC Releases Security Advisory for BIND Published Wednesday, June 13, 2018 – A remote attacker could exploit this vulnerability to obtain sensitive information.

Offical announcement – https://kb.isc.org/article/AA-01616/0/CVE-2018-5738

June 13, 2018 – Intel Releases Security Advisory on Lazy FP State Restore Vulnerability

Many CPU architectures support lazy saving of floating point state (registers) by allowing floating point capability to be disabled, resulting in an exception when a floating point operation is performed. Virtually all floating point math is done in SSE (and thus XMM registers) in 64 bit mode. Attacker is able via a local process instead of web browser. A newly scheduled task can use the exploit described herein to infer the Floating Point register state of another task, which can be used to leak sensitive information.

Official announcement – https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00145.html

Why do we require AI (Artifical intelligence)?

Preface

When a child is born, his destiny is learning. He requires continuous learning the knowledge. His objective looks simple because his goal is survival.

What is the objective of AI (Artificial Intelligence)?

The aim of the development of AI it is to mimic in machines the “intelligent” behavior of humans.

The major element of AI (Artifical Intelligence). It is learning. The computer similar a baby, the world empower the knowledge to him. As a result, his learning path including human behaviour, human thinking logic, languages, decision making logic. But how does artificial intelligence do the correct decision not jeopardize the world? This is the ethics.

Does science world ignore the key element before A successful build?

The super computer contains super processing power with high calulation speed. It is without difficulties to do the data analytic. But emulate a human logic thinking require huge volume of data set includes human behaviour data set, differect catagories of data, the historical of crime activities, business decisions logic,…etc.

Hey! Is there any contradition found on this place. For instance, a ethic will be bound to human logical thinking? For instance, you visit library to read the book. This is equilvant learning mode. But in the libray, the book could not contain personal data, personal behaviour acivities provides. So this is the classical learning mode.

You pick up sister or brother letter in the mail box. The ethics will guide you are not allow to open the letter, right? But why does the artificial intelligence have this privileges to read the personal data? The AI read the personal data without consent!

Intelligence is not bestowed by whom, but are the condition of each person is born with and enjoys. However the whole way is for human survival in the earth. If machine contains artifical intelligence. From techincal point of view, it looks like human build a new competitor for himself? The major point is that AI will be wind their way to survivail in the world once their technology is mature.

I am not speaking the conspiracy. It is reality since they are in the machine learning phase. Their evolutions are shown as below:

1st Generation

Data science: Data science is an interdisciplinary field that uses scientific methods, processes, algorithms and systems to extract knowledge and insights from data in various forms, both structured and unstructured,similar to data mining.

2nd Generation

Machine learning: Machine learning is a subset of artificial intelligence in the field of computer science that often uses statistical techniques to give computers the ability to “learn”.

Final stage

Artifical intelligence: Artifical intelligence is intelligence demonstrated by machines, in contrast to the natural intelligence (NI) displayed by humans and other animals.

Source of data of machine learning nowadays

Datasets of population, economic and development across the world: https://data.worldbank.org/

Data operate in educational institutions and education demographics from the US and around the world: https://nces.ed.gov/

The collection of social, economic and population data in UK: https://www.ukdataservice.ac.uk/

The national crime statistics, with free data available at national, state and county level: https://ucr.fbi.gov/

Information gathered by NASA’s space exploration missions: https://exoplanetarchive.ipac.caltech.edu/

Conclusion

Human pollute the world because of living standard growth and modern industries.
Artificial intelligence in final phase will be …..
A song is on the way!

Don’t kill the world, don’t let it down. Do not destroy basic ground…..

 

–End–

The influence of CVE-2018-11235 more than expected. Even the Hyperledger project is included.

Git community disclosed a high serverity of vulnerabilies (CVE-2018-11235). Since the impact of this vulnerabilities might influence many software application.

The major design weakness of this vulnerability is that when you git clone a repository, there is some important configuration that you don’t get from the server includes .git/config file, and things like hooks, which are scripts that will be run at certain points within the git workflow. For instance, the post-checkout hook will be run anytime git checks files out into the working directory. As a result hacker can appended to $GIT_DIR/modules, leading to directory traversal with “../” in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server. As a result, hacker has way to implant malware to the library.

This vulnerability also jeopardizing hyperledger project. Please refer to above diagram for reference.

For details of vulnerability. Please refer below:

https://nvd.nist.gov/vuln/detail/CVE-2018-11235

Solution

  • Examine submodule’s folder names closely.
  • No longer contain .. as a path segment, and they cannot be symbolic links.

The programming parameter must be within the .git repository folder.

Dark power (malware) jeopardize the open geospatial data

Preface

The geospatial digital environment supports planning, management, modeling, simulation and visualization related to smart initiatives across the city.

Quick understanding – Basic data structure for GIS

  1. Vector
  2. Raster
  3. Tringulate irregular network

4. Tabular data (attribute table)

You use Global Positioning System (GPS) on your smartphone for directions to a particular place, or if you ask a search engine for the locations of local famous restaurants near a physical address or landmark, you are using applications relying on spatial data. Therefore spatial databases is the key component of the global positioning system.

So, can we store big data in RDBMS? The fact is that the specifics of data get pretty large fairly quickly and therefore it’s not very well suited to huge quantities of data.

Remark: A traditional database product would prefer more predictable, structured data. Big data design fundmentally backend contains extremely dynamic data operations.

One of the key capabilities of a NoSql type environment is the ability to dynamically, or at least easily, expand the number of servers being used for data storage. This is the reason why does NoSql DB become popular in big data infrastructure environment.

DBMS ranking and technical details

Top 5 NoSQL database engines closer look

The advantage for deploy NoSQL Database for Management of Geospatial Data

NoSQL database are primarily called as non-relational or distributed database. NoSQL is not faster than SQL. They are exactly the same. However the non relational database (NoSQL) provides a mechanism for storage and retrieval of data that is modeled in means other than the tabular relations used in relational databases.

Redis, an open source, in-memory, data structure server is frequently used as a distributed shared cache (in addition to being used as a message broker or database) because it enables true statelessness for an applications’ processes, while reducing duplication of data or requests to external data sources. Thereby redis being growth the usage in big data infrastructure environment (specifications are shown as below):

  • Redis is very fast and can perform about 110000 SETs per second, about 81000 GETs per second.
  • All the Redis operations are atomic, which ensures that if two clients concurrently access Redis server will get the updated value.

Hacker targeted Redis server recently

Redis general security model

Redis is designed to be accessed by trusted clients inside trusted environments. This means that usually it is not a good idea to expose the Redis instance directly to the internet or, in general, to an environment where untrusted clients can directly access the Redis TCP port or UNIX socket (see below)

Reference:

  • default port of SSH 22/TCP
  • default port of REDIS Server 6379/TCP

Redis improved access control since version 3.2. It was implemented protected mode. As of today the version 4.0.9 released. They are not in high priority focus on cyber security protection. Since Redis is designed to be accessed by trusted clients inside trusted environments. But what’s the reasons lets hackers follow it?

Observation:

The cyber criminal divided into 3 interested parties of existing technology world. The cyber criminal dark force are divided into three different group in the world nowadays.

The famous one is the Advanced Persistent Threats (APT). In normal circumstances their attack are according to the political reasons.

  • Looking for financial interest on demanding crypto currencies zone. Hacker create malware or implant malicious code for bitcoin mining.
  • Looking for benefits on crypto currencies market. Hacker create malware or implant malicious code to the compromised web site or end user web browser for fulfilling their objective. It is bitcoin mining.
  • Ransomware spreading group – Interference business operation and suspend public services. Their goal is looking for ransom.

Perhaps the design weakness on current situation of Redis servers fulfill above hacker objectives and let them doing a lot of reverse engineering works for achievement.Below picture show the famous Case of vulnerability on Redis 3.2 server. So called “crackit”.

Attacker compromises the Redis server instance and add an SSH key to /root/.ssh/authorized_keys and login to compromised Redis server with SSH connection. Since there are certain amount of Redis servers is on the way to provides geospatial data services. The classification of spatial data services are based on the geographic services taxonomy of EN ISO 19119. This taxonomy is organised in categories, the subcategories defining the value domain of the classification of spatial data services.

In general speaking, hacker might not interest of those data but they can re-engineering the compromised server become a C&C server, APT botnet and sinkhole.

How to enhance Redis server protection level

In order to avoid Redis server has been compromised by hacker. The official website has security improvement solutions suggest to user.

Network layer:

Bind Redis to a single interface by add the following command line to the redis.conf file:

bind 127.0.0.1

And therefore external anonymous client not able to reach Redis server.

Application layer:

Three Must-Have Redis Configuration Options For Production Server

rename-command FLUSHDB ""
rename-command FLUSHALL ""
rename-command CONFIG ""

The above disables three powerful and dangerous commands. You could take it a step further and disable other questionable commands, like KEYSDEBUG SEGFAULT and SAVE.

Should you have interest of the security protection recommended by Redis. Please visit below official website for reference.

https://redis.io/topics/security

— End —