Category Archives: Under our observation

Potential Risk of CVE, Under our observation

Drupal core – Highly critical – Remote Code Execution (Mar 2018)

March 29, 2018 admin 1 Comment

Drupal core installation can serve as a simple Web site, a single- or multi-user blog, an Internet forum, or a community Web site providing for user-generated content. The risk calculator shown that it is highly critical according NIST Common Misuse Scoring System (NISTIR 7864). Two critical factors told us the following:

All data can be modified or deleted
All non-public data is accessible

It is indeed nightmare! Drupal user must do the patching immediately. Otherwise there is a new round of data leakage incident will be happened soon!

Official announcement: Drupal core – Highly critical – Remote Code Execution

https://www.drupal.org/sa-core-2018-002

Potential Risk of CVE, Under our observation

CVE-2018-5148: Mozilla Foundation Security Advisory 2018-10 Use-after-free

March 27, 2018 admin

Hi Folks, homeland security urge computer users stay alert of web browser (FireFox) vulnerability. The design flaw could let the attacker execute a denial-of-service condition. I review the vulnerability details. It state the following. A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a reference counted one. This results in a potentially exploitable crash. But I have different imagination of this flaw. In short, please refer below diagram for reference.

To be or not to be? But it is better to conduct the security update now. For more details, please refer below url for reference.

https://www.mozilla.org/en-US/security/advisories/mfsa2018-10/

Potential Risk of CVE, Under our observation

CVE-2017-18225 – See whether does it affect Cisco jabber iPhone and Android client product?

March 26, 2018 admin 10 Comments

IP telephony integration to IT infrastructure is a main trend in last decade. Following the security best practice, the IP telephony system should be isolated and far away from data network. However there are end user function requirement which causes unified communications manager integrate with Active directory services. A useful function will be activated after active directory integration. For instance a track record will be shown individual communication history. Meanwhile it will enhance the monitor and control process (SOX 403 monitoring and control). Perhaps a pin does not have two points and therefore it is hard to avoid vulnerability happen. For example, Cisco IP telephone working with Microsoft TSAPI last decade. But most recently Android and iPhone growth rapidly. IP telephony vendor will be make use of open source unintentionally. An XMPP client is any software or application that enables you to connect to an XMPP for instant messaging with other people over the Internet. Cisco official announce that there is a vulnerability found on Jabber client from November 2017 (CVE-2017-12361).

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-jabber2

The jabber design flaw has been identified this month. The issue is that vulnerability might allow local users to gain privileges by leveraging access to this account and then waiting for root to execute one of these programs. In the meantime, we do not receive announcement release by Cisco (Jabber Security Vulnerabilities CVE-2017-18225). But we keep our eyes open, see whether does it affect Cisco jabber iPhone and Android client product?

CVE-2017-18225 vulnerability details shown as below:

https://security.gentoo.org/glsa/201803-07

Ransomware, Under our observation, Virus & Malware

Threat actor intend to stop your antivirus program – 2018

March 24, 2018 admin 1 Comment

Just heard that there is a new attack method use by ransomware. The malware intend to stop and disable your workstation antivirus process. Since no antivirus protection, threat actor is free to do their task. Perhaps the defense vendor pay the focus on Ring 0 attack (kernel). Meanwhile new generation AV software implement behavioral detection analysis. So is there any space for threat actor?Yes, the ring 3 looks provides space to threat actor. They may find a way to evade the detection.

For instance:

List all loaded DLL libraries in current process.
Find entry-point address of every imported API function of each DLL library.
Remove the injected hook JMP instruction by replacing it with the API’s original bytes.

Should you have interest to receive a high level understanding, please refer above diagram for reference.

Potential Risk of CVE, Under our observation

Citrix XenServer Multiple Security Updates – CVE-2016-2074,CVE-2018-7540&CVE-2018-7541

March 21, 2018 admin

Citirix XenServer is a hypervisor platform that enables the creation and management of virtualized server infrastructure.Since modern defense machanism can effectively protected cyber attack. However if the threat actor re-engineering their attack method integrate with rare system bug. The overall suituation will become worst. Hypervisor locate in the middle in between VM and hardware. VM relies on this isolation to avoid ring-0 attack. But now solution released so I am not going to say anymore.

Be quick to read below url if you are the Citrix XenServer end user.

Citrix XenServer Multiple Security Updates

https://support.citrix.com/article/CTX232655

Under our observation

Stay Alert when you download Tencent game apk on unofficial web site!

March 21, 2018 admin

Tencent games are now kings in the Chinese gaming area. The most famous game named “王者榮耀” breaking the record.The total number of downloads exceeded 200 million, and the number of registered users exceeded 200 million. The annual revenue in 2016 was RMB 6.8 billion. Perhaps it is a popular game and therefore it lure the treat actor target on this application (apk). For interest, I download this apk file on internet but not in official website. Found that there are total of 2 files which trigger alert. It was strange that the security alert triggered by file (midaspay.zip). As far as I know Midas is a Tencent’s mobile payment module. However it is hard to understand what is the goal to embedded a advertisement feature? Adware technically is not malicious, but there is nothing good about it. So when you download this hottest game. Be remind yourself stay alert. Please go to the official web site. For more details. Please refer below picture for reference. Good night! Zzzzzzzz

Potential Risk of CVE, Under our observation

Flaw and practices – AMD CPU design flaw more worse than the other product!

March 14, 2018 admin

The threat actor spending their effort to re-engineering the vulnerabilities of Meltdown and Spectre. Their objective is relies on design flaw convert as a cyber attack solution including data extraction and collect the user credential. However it is still in development phase. Today, AMD vulnerabilities looks harm the IT world. Since the proof of concept shown positive result. The AMD covered GPU market so far. Perhaps this time the flaw happened in the design of CPU. It is hard to imagine that once the criminal group convert this flaw successful as attack tool.How the worst will be happened!

Should you have interest, please download the white paper in below URL.

https://safefirmware.com/amdflaws_whitepaper.pdf

Cyber War, Under our observation

New detection of technology. Will it be let Antivirus firm embarrassing?

March 11, 2018 admin 1 Comment

Retrospectively, the IT technology defense mechanism especially behavior analysis and cloud machine learning model are powerful. The threat actors looks difficult to masquerade themselves to start the infiltration. In order to fight against crime. The law enforcement might have to doing the surveillance or scrutiny the suspects. Since it is not a secret, a professional software house assists law enforce to doing the surveillance. Yes, it is FinFisher. Heard a rumors that Turkish government is going to enforce the cyber security in their country. Perhaps Finfisher is expensive and therefore they are chosen the other way. They deployed Sandvine PacketLogic middleboxes in five regions across the country. It is a man-in-the-middle. A question you will be ask. If anti-virus vendor found the malicious activities which handle by law enforcement. Do you know how they can do? Does it take quarantine action or remaining silent? It looks that a contradiction will be happened more and more in future! Or the law enforcement will be deployed advance technique to masquerade themselves evade the detection?

Potential Risk of CVE, Under our observation

CVE-2018-7642 – GNU Binutils 2.30

March 10, 2018 admin

Are you aware of CVE-2018-7642? Bug found GNU Binutils 2.30 on 24th Feb 2018. However it noted to my interest that Binutils 2.30 released on 27th Jan 2018. But 3 weeks later, found a system bug causes system crash. The flaw is that it lack of check if “sym” is null. The bug was fixed on 28th Feb 2018. But I was wondering that GNU Binary Utilities, or binutils, are a set of programming tools for creating and managing binary programs, object files, libraries, profile data, and assembly source code. So if you are using GNU Binutils version 2.30, you must be staying alert! Perhaps the design flaw only encounter system crash. But it is under my observation.

Potential Risk of CVE, Under our observation