-
Automatic DNS registration and autodiscovery boots up cyber attacks – Sep 2018
Have a look back of the LLMNR technical feature, NetBIOS and Link-Local Multicast Name Resolution (LLMNR) are Microsoft’s name resolution protocols for workgroups and domains designed primarily for name resolution in the LAN. When DNS resolution fails, Windows systems use NetBIOS and LLMNR to search for names. These protocols are designed only for local connections.…
-
Amazon Web Services (AWS) CLI weak security – CVE-2018-15869
The amazon-ebs Packer builder is able to create Amazon AMIs backed by EBS volumes for use in EC2. Found design weakness on Amazon Web Services (AWS) that CLI could provide weaker than expected security, caused by the failure to require the –owners flag when describing images. By setting similar image properties, a remote attacker could…
-
Node JS CVE – Aug 2018
Retropective of the programming history, JavaScript was used primarily for client-side scripting, in which scripts written in JavaScript are embedded in a webpage’s HTML and run client-side by a JavaScript engine in the user’s web browser. Node js programming technique lets developers use JavaScript to write command line tools thus transfer script programming function to…
-
Quick overview – Microsoft windows task scheduler design weakness
It’s hard to imagine the destructive power of a privilege escalation vulnerability? Security Guru found zero day or system design weakness in Windows OS system. It looks that zero day not rare issue but this time the first pier of announcement was not the vendor. May be we wait for next Patch Tue to do…
-
Invalid certificate on your remote access endpoint or a MITM attack presenting an invalid certificate compromise your workstation.
We heard cyber attack causes privileges escalation. Thus technology expert in creative way discover many solution to avoid such behavior happen. Perhaps we are focusing the patch management, antivirus signature update, malware detector yara rules. A silent way similar penetrate to your end point devices, even though server side will be compromised of this attack.…
-
Aug 2018 – CVE-2018-8273 | Microsoft SQL Server Remote Code Execution Vulnerability
Above vulnerability looks complicated. It is only effect SQL server 2016 and 2017. I do a debug on the download file. Found the following syntax “ntdll.dll RtlEnterCriticalSection”. It looks that the software patch focus on PageHeap, which is intended for debugging of memory overhead. In Microsoft SQL server 2016 and 2017 environment, each IAM and…
-
Do not contempt CVE-2018-6973 (VMware workstation)-Out-of-bounds-write-14thAug2018
-
8th Aug 2018 – ISC Releases Security Advisory for BIND
If you are easy nervous, seems IT job not suitable for you! The Domain Name System (DNS) is the backbone of the modern internet. The workstation similar a blind people searching the correct pathway in the dark. ISC releases security advisory for BIND yesterday. My roughly statistic shown to me that this is the third…
-
Aug 2018 – Do not contempt this vulnerability (CVE-2018-5390)
The hardware vendors deploy Linux OS on demand growth. Even though your firewall appliances, malware detector, load balancer, network L2 and L3 switch and IoT devices are the Linux. The attacker found a tricks recently. If source device feeds tiny packets completely out of order. The parameter (tcp_collapse_ofo_queue()) might scan the whole rb-tree. As a…
-
Aug 2018 – Similar to establish new challenge in IT world, mingw-w64 design limitation!
Address space layout randomization (ASLR) is a computer security technique involved in preventing exploitation of memory corruption vulnerabilities. ASLR function like the last line of defense of the system against cyber attack. Recently, security expert comment that the software application developer might not following guideline issue by CPU vendor. The fact is that an error…