-
CVE-2019-1002101: Vulnerabilities found in Kubernetes’ kubectl cp command (3rd May 2019)
Preface: Some supercomputers in the world, they are also using Kubernetes. Technical background: kubectl controls the Kubernetes cluster manager.Make use of “kubectl cp” command is able to copy files and directories to and from containers. Vulnerability details: An attacker can fool a user to use the kubectl cp command to copy and store a malicious…
-
2nd May 2019 – Don’t let you SAP facility become a cyber attack target
Preface: Heard that estimated total of 1,000,000 SAP production systems could currently be at risk of being hacked. Technical details: When you configure sap router (saprouter) to allow remote (from the Internet) connections via the SAP GUI. The original design will add entries to the route tables for TCP port 3300, 3301, and 3303 the…
-
Do you have any concerns on multiple vulnerabilities in WPA3 Protocol? (Arp 2019)
Preface: WPA3 protocol aim to enhance Wi-Fi security protection. Yes, it does. But something wrong with him this time. Technology Synopsis: The very damaging DoS attack consists of clogging one peer with bogus requests with forged source IP addresses. Due to computationally intensive nature of modular exponentiation, the DH key exchange is highly vulnerable to…
-
Unknown vulnerability Found Affecting Intel CPUs – 5th Mar 2019
Preface: So called Spoilter, a vulnerability given by Intel CPU design limitation. If hacker successful exploit such vulnerability. They can conduct “Rowhammer” attack for privileges escalation. Vulnerability detail: The speculative execution function of Intel’s processors aim to increase the performance of a CPU. Meanwhile it caused Intel CPU vulnerability issues in the past. A new…
-
Security Focus – CVE-2019-0626 Microsoft Windows DHCP Server Remote Code Execution Vulnerability (12th Feb 2019)
Preface: This vulnerability is included in MS Patch Tue this week. However the vulnerability is more critical than others. Since threat actor can be conduct a remote code execution through social engineering. Technical highlight: The official announcement told that attacker could exploit the vulnerability by sending a DHCP packet that submits malicious input to the…
-
Marvell Avastar wireless SoCs have multiple vulnerabilities – 5th Feb 2019
Preface: The Marvell 88W8897A SoC (System on a Chip) is the industry’s first 802.11ac chip to combine Bluetooth 4.2, mobile MIMO (Multi-input Multi-output), transmit beamforming, and with built-in support for all screen projection technologies. Technology Background: Computer design primary focus on memory usage. Even though without an exception in SoC (System on a Chip) design.…
-
Microsoft Exchange 2013 and newer are vulnerable to NTLM relay attacks – 28th Jan 2019
Preface: EWS Push Subscription, you will get notifications as long as you respond to the server and acknowledge that you received the notification. The CERT Coordination Center (CERT/CC) announcement – 29th Jan 2019: Microsoft Exchange 2013 and newer are vulnerable to NTLM relay attacks Vulnerability detail: Exchange allows any user to specify a desired URL…
-
Who can you trust in the Internet world? Security Issues with LOAD DATA LOCAL in MySQL DB.
Preface: Some organizations that use MySQL include GitHub, US Navy, NASA, Tesla, Netflix, WeChat, Facebook, Zendesk, Twitter, Zappos, YouTube,…etc Background: Technology writer Ionut Ilascu alert that there is command in MySQL server could be use for steal the personal and web server data without a high level evasion technique. Technical overview: Security Issues with LOAD…
-
Simple and powerful evasion technique – Threat actor will be exploit MS word document.
Preface: Preface: Threat Intelligence vendor (FireEye) alert that Global DNS Hijacking Campaign rapidly growth. This storm affected dozens of domains belonging to government, telecommunications and internet infrastructure entities across the Middle East and North Africa, Europe and North America. Synopsis: More information about the impact of this cyber attack.. Please refer to below url for…
-
Analysis Reports by US Homeland Security – Legitimate open source remote administration tool re-engineer by threat actor as APT way of attack – Dec 2018
Preface: Quasar, a legitimate open-source remote administration tool. It is a fast and light-weight remote administration tool coded in C#. Background: APT actors have adapted Quasar and created modified minor (1.3.4.0) and major (2.0.0.0 and 2.0.0.1) versions. Since the re-engineering Quasar client will be mimics a Mozilla Firefox 48 browser running on Windows 8.1 or…