-
Hong Kong Broadband Network customer staying alert! 17th Feb 2020
Synopsis: The threat actors hidden their email phishing package anywhere. As common we know, email phishing scam foot print are wide in area. But the antivirus and malware solution vendor setup blacklist domain name and content filtering function has reduced the infection ratio of malware and ransomware. It looks that the similar of idea to…
-
FIFO project problem tracker – SEND_FILE_WITH_HEADER Use-After-Free (Feb 2020)
Preface: The security of FIDO deployment largely depends on the choice of underlying security subsystems and their implementation. Background: An ioctl , which means “input-output control” is a kind of device-specific system call. There are only a few system calls in Linux (300-400), which are not enough to express all the unique functions devices may…
-
F-secure internet gatekeeper 5.40 (heap overflow) – 30th Jan 2020
Preface: Heap overflows are exploitable in a different manner to that of stack-based overflows. Memory on the heap is dynamically allocated at runtime and typically contains program data. Product background: F-Secure Internet Gatekeeper for Linux, aim to serve for small and medium business cyber security protection services. It capable to scanning incoming and outgoing including…
-
Digital transformation – coronavirus phishing scam email – Feb 2020
Synopsis: Staying alert especially to healthcare and pharmaceutical industry. Condemn this phishing scam email similar to harm ordinary people during this period of time. Observation: A sample phishing email detected last Tuesday, by email filter expert firm (Mimecast), shows cyber criminal send email with malicious links and PDFs that claim to contain information on how…
-
Can it be remedied or is it a enigma? – JAN 2020
Preface: User Account Control (UAC) is a fundamental component of Microsoft’s overall security vision. UAC helps mitigate the impact of malware. Synopsis: UAC Bypass Using eventvwr.exe was exploited by malware in 2017. Microsoft fixes Eventvwr.exe UAC Bypass Exploit in Windows 10 Creators Update. In Windows 10 Creators Update preview build 15007, Microsoft seems to have…
-
Are there other similarly vulnerability component like ws2ifsl.sys in Windows?
Preface: You found an error in somewhere, sometimes will be expanded your idea of thinking. Synopsis: Ws2ifsl.sys is found in the C:\Windows\System32\drivers directory. In many cases, a driver creates a symbolic link and its name can be used as a file name for CreateFileA, but this is not the case with ws2ifsl. It only calls nt!IoCreateDevicewith the…
-
Design weakness found 1 year ago (Jan 2019), but the details expose today! Fortinet FortiSIEM 5.2.5 / 5.2.6 Hardcoded Key (Jan 2020)
Preface: Stupid Solutions to Stupid Problems: Hardcoding Your SSH Key in the system. Vulnerability background: FortiSIEM 5.2.5 / 5.2.6 could use the hardcoded password to log in to the underlying system via Secure Shell (SSH). This means that anyone with access to any FortiSIEM image (to copy the SSH private key) can authenticate successfully via…
-
In order to avoid MS ‘.Group’ file handling RCE vulnerability. Think it before click – Jan 2020
Preface: Perhaps you would say the ‘.group’ file handling is the design defect. So hacker exploit social engineer trigger this vulnerability (GROUP FILE URL FIELD CODE EXECUTION). Do you agree? What is a GROUP file? The file is located inside this location: C:\Program Files\Windows Mail. Vulnerability details: Microsoft Windows is prone to a remote code-execution…
-
about ransomware attack on Maastricht University – 24th Dec 2019
Preface: Maastricht University (UM) encountered serious cyber attack,” the university announced on Christmas Eve, December 24, 2019. Synopsis: Not known the root cause but if ransomware can spread out in a quick way most likely it exploit of the Microsoft SMB Protocol. Perhaps it is affected by RYUK Ransomware ! Other than that Maastricht University…
-
CVE 2019-19492 (FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml) Remote command execution – Last update: 26th Dec 2019
Preface: FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a versatile software implementation that runs on any commodity hardware. Background: FreeSWITCH listens on port 8021 by default and will accept and run commands sent to it after authenticating. By default commands are not accepted from remote hosts.…