-
Advisory on PHP Vulnerabilities – 12th Oct 2018
The Multi-State Information Sharing & Analysis Center (MS-ISAC) has released an advisory on multiple Hypertext Preprocessor (PHP) vulnerabilities today (refer below url): https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-php-could-allow-for-arbitrary-code-execution_2018-113/ Perhaps PHP program version will make you frustrated. Why? The vulnerabilities addressed by MS-ISAC only for Version 7.2.11 & Version 7.1.23. However there is another fix coming soon (see below): PHP 7.1.24…
-
Five publicly available tools, which have been used for malicious purposes – Oct 2018
US-Cert urge that there are total five publicly available tools, which have been used for malicious purposes in recent cyber incidents around the world (see below): Remote Access Trojan: JBiFrost Webshell: China Chopper Credential Stealer: Mimikatz Lateral Movement Framework: PowerShell Empire C2 Obfuscation and Exfiltration: HUC Packet Transmitter RSA found a malware in 2017 and…
-
Could ring 2 have the same momentum as a IoT backdoor?
Preface: In x86 protected mode, the CPU is always in one of 4 rings. The Linux kernel only uses 0 and 3: 0 for kernel 3 for users Hidden janitor living in your computer SMM is triggered through a System Management Interrupt (SMI), a signal sent from the chipset to the CPU. During platform initialization,…
-
About cyber security threats in aero industry – Oct 2018
DHS has few critical cyber security announcement few days ago. Some technical articles may bring the practitioner attentions. Do you read technical article “Threats to Precision Agriculture” yet? My personal opinion is that the prediction of cyber attack scenario not only happen in agriculture. It may have happen in aero industry. Real-time kinematic (RTK) positioning…
-
3rd Oct 2018 – Do you think they are APT 38?
The cyber attack hot topic we focus retail payment system (Fastcash campaign) and adobe product vulnerabilities this week. However an additional cyber security alert announced by DHS. Yes, it is a APT cyber attack activities. APT processes require a high degree of covertness over a long period of time. If you habit to observe the…
-
Hypothesis – About the cyber attack on Port of Barcelona (Sep 2018)
We heard that the Port of Barcelona suffers an attack of hackers last week (20th Sep 2018). The logistics and transportation industry lure hackers’ interest because they can extort ransom. There is no official or incident details announcement till today. The following details merely my personal imagination of this incident. Any resemblance to actual events…
-
It is a hurricane, but it happen in cyber world – Multiple vulnerabilities in PHP (Sep 2018)
The United States and Asia were hit by hurricanes. It looks that the similar situation is happen in cyber world. MS-ISAC Releases Advisory on PHP Vulnerabilities urge technology world to staying alert. For more details, please refer below hyperlink: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-php-could-allow-for-arbitrary-code-execution_2018-101/ Hacker exploit the PHP design weakenss (Arbitrary Code Execution or RCE) for attack must fulfill…
-
Sep 2018 – Veeam MongoDB left unsecured, 440 million records exposed
Sanitization process is important in IT world. If without correct validation, it may allow malicious code pass to trust boundary. As a result it may causes remote code execution, SQL injection, trigger Zero day attack, ….etc. So…… Headline News this week. Should you have interest, my picture can tell my speculation. https://www.scmagazine.com/home/news/veeam-mongodb-left-unsecured-440-million-records-exposed/ Vulnerability looks scary!…
-
Security Notification – Modicon M221 (Sep 2018)
Because many industries requires monitoring and control capabilities that SCADA offers. In most uses, SCADA is used to manage a physical process of Electric, Gas and water Utilities.We heard cyber security alert in SCADA facilities so far. As a citizen we cannot immagine how worst will be the incident happened. For instance once SCADA PLC…
-
British Airway announcement – 7th Sep 2018 (380,000 customers’ bank details stolen from website)
The Spokesman of British Airways said around 380,000 payment cards had been compromised and it had notified the police.He stated that they suspected that hacker stolen customers’ bank details through official website and or mobile apps. However the stolen data didn’t include travel or passport details. If there is european citizens become a victims of…