-
Perhaps the Meltdown & Spectre vulnerabilities in CPU equivalent to human immunodeficiency virus (HIV)?
Preface: Human immunodeficiency virus infection and acquired immune deficiency syndrome (HIV/AIDS) is a spectrum of conditions caused by infection with the human immunodeficiency virus (HIV). Background: On July 2017, Meltdown was discovered independently by Jann Horn from Google’s Project Zero, Werner Haas and Thomas Prescher from Cyberus Technology, as well as Daniel Gruss, Moritz Lipp,…
-
CVE-2018-4878 against South Korean Targets. See whether is it true?
In July 2017, Adobe announced that it would end support for Flash Player in 2020, and continued to encourage the use of open HTML5 standards in place of Flash. The announcement was coordinated with Apple, Facebook,Google,Microsoft,and Mozilla. If you would like to know what is the flash vulnerability actual destructive power. Let review the suggestion…
-
Advantech WebAccess/SCADA – CVE-2018-5443 – CVE-2018-5445
Preface: SCADA systems are the backbone of many modern industries, including: Energy, Food and beverage, Manufacturing, Oil and gas, Power, Recycling, Transportation, Water and waste water,….etc SCADA evolution: The first generation of SCADA system relies with mainframe computers. As time goes by, the evolutionary of SCADA build on top of open system foundation (Unix) in…
-
Cisco Aggregation Services Router 9000 Series IPv6 Fragment Header Denial of Service Vulnerability
Cisco Aggregation Services Router 9000 Series IPv6 Fragment Header Denial of Service Vulnerability https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180131-ipv6 IPv6 design limitation highlights by Cisco on 2013 RSA conference. Since ICMP header is in 2nd fragment. Defense mechanism especially RA guard no cue where to find (see my cartoon picture). Perhaps stateful firewall can doing the defense. Meanwhile, this issue…
-
Cisco Adaptive Security Appliance Remote Code Execution and Denial of Service Vulnerability
Cisco Adaptive Security Appliance Remote Code Execution and Denial of Service Vulnerability (below url for reference) severity level – critical https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1 We heard denial of service vulnerability to UTM firewall device in frequent. It looks that there is no any strange or feeling surprise. However similar XML Exploit method not new, it announced in RSA…
-
Doubt – $530 million cryptocurrency heist
As we know the most common cryptocurrencies are Bitcoin, Ethereum,Ethereum Classic, Monero, Litecoin, OmiseGO, Ripple & Zcash. Fundamentally NEM Smart Asset System more secure than bitcoin. The NEM Blockchain utilizes a Proof-of-Importance calculation (rather than Bitcoin’s Proof-of-Work or PIVX’s Proof-of-Stake) to accomplish accord through a procedure that boosts dynamic support in the system. NEM is…
-
My speculation – How’s coincheck loses ¥58 billion dollars value of cryptocurrency
Incident background: Japan-based company said hackers broke in at 02:57am local time on Friday (12:57pm EST on Thursday, 25 January). Financial lost: ¥58 billion dollars value of cryptocurrency Cryptocurrency type: NEM (XEM) Victim: coincheck.com Cyber attack historical incident record The most recent cryptocurrency heist happened on February 2014. The victim firm is Mt. Gox. A…
-
CVE-2018-0486 Staying alert with your single sign-on application especially IDP vulnerability
CVE-2018-0486: Shibboleth(SAML IDP) open source vulnerability is currently awaiting analysis. For more details, see below url for reference: https://nvd.nist.gov/vuln/detail/CVE-2018-0486 During my penetration test engagement in past. I was surprised that no matter airline , financial and retail industries web online application solutions are deployed open source single-sign on resources. An incident occurred in Equifax which…
-
Apple enforce Meltdown and Spectre vulnerabilities remediation
About Apple security updates announcement (see below url for reference) https://support.apple.com/en-us/HT208463 About security updates announcement, the objectives is going remediate multiple vulnerabilities.As usual, apple released security update but no descriptions are available yet. Perhaps without detail information provided by vendor (Apple). However I was speculated that the remediation step will be focus on the following protection…
-
Lawful interception – How’s your personal privacy value today?
Cloud computer platform looks like a fight carrier in the data world. Meanwhile, the data stored inside the cloud are under cloud protection. However different country implement different data protection law and data custodian policy. Perhaps development countries unaware this topics last decade. However big data upgrade his political position progressively. It looks that government…