-
CVE-2023-23931 – cryptography (7th Feb 2023)
Preface: PyCrypto is no longer under active development (project is dead – 2015). For details, see the link – https://github.com/pycrypto/pycrypto/issues/173“cryptography” is a package which provides cryptographic recipes and primitives to Python developers. The goal is for it to be your “cryptographic standard library”. It supports Python 3.6+ and PyPy3 7.2+. Background: “cryptography” is a package…
-
Whether it is the last round of remediation on CVE-2022-26373? Intel’s Enhanced Indirect Branch Restricted Speculation (eIBRS) – 6th Feb 2023
Preface: CVE-2022-26373 technical detail has released to public on 9th Aug 2022. Till end of Jan, 2023 it still has update on this vulnerability. For example, Red Hat fixed this vulnerability in their product Enterprise Linux 7 on 3rd Nov 2022. Since then it conducting the remediation to their product line. Perhaps the remediation on…
-
What is the value of the Trusted Execution Environment (TEE) ? (20th JAN 2023)
Preface: Some said, found malware lets cybercriminal remotely manipulate your Android. Background: The full name of TEE is trusted execution environment, which is an area on the CPU of mobile devices (smart phones, tablets, smart TVs). The role of this area is to provide a more secure space for data and code execution, and to…
-
Potential threat of ChatGPT (Artificial intelligence) – 19th JAN 2023
Preface: OpenAI was founded by Elon Musk, Sam Altman, Ilya Sutskever, Greg Brockman, Wojciech Zaremba and John Schulman in Nov 2015. ChatGPT is a chatbot launched by OpenAI in November 2022. It is built on top of OpenAI’s GPT-3 family of large language models, and is fine-tuned with both supervised and reinforcement learning techniques. Background:…
-
Headline news: FAA system outage disrupts thousands of flights across U.S. (12th Jan 2023)
Preface: Thousands of flights across the U.S. were delayed Wednesday after a Federal Aviation Administration pilot alert system failed overnight, prompting a nationwide halt to departures. said CNBC news. Headline news – https://www.cnbc.com/2023/01/11/faa-orders-airlines-to-pause-departures-until-9-am-et-after-system-outage.html Background: The Department of Homeland Security published the following opinion piece four years ago. The GPS system is now considered a “crosssector…
-
Cyber Défense from narrow to broad (5th Jan 2023)
Preface: Sustainability is a buzzword in the modern world in recent years. It applies to business, culture…even our education. A slogan, keep learning. Maybe it’s the Cantonese mantra, One is never too old to learn. Perhaps it also apply to cyber security protection. Background: In last twenty years, computing technology driven growth of the world.…
-
Apple’s new lock mode. Do you think it is for protection against spyware or to prepare for new EU regulations (WhatsApp, iMessage and other apps for communication)? 7-7-2022
Preface: The UK GDPR is the UK General Data Protection Regulation. It is a UK law which came into effect on 01 January 2021. It sets out the key principles, rights and obligations for most processing of personal data in the UK, except for law enforcement and intelligence agencies.On 28 June 2021, the EU approved…
-
hiccup, web server load balancing solution 3rd May 2022
Preface: Online banking cannot lack of load balancing solution today. However in terms of life cycle of operation system and software libaries , Java language development platform and on-demand custom fuctions. Does it bother the load balancing functions? The most challenging parts is the layer 7 load balancing. Perhaps you can do the healt check…
-
Get rid of crafted Modbus traffic to bother your defense mechansim – 21st JAN 2022
Preface: Le Rouge et le Noir – Not a bad guy is good guy. If, the vulnerability is due to an integer overflow when handling Modbus traffic. Is it an early warning? Background: The reason Modbus was so successful was the fact that it could be so readily understood by non-programmers. Engineers who built glue…
-
RAT targeting Nginx. Can we say that NGINX is secure than Apache? (2-12-2021)
Preface: dlopen() The function dlopen() loads the dynamic shared object (shared library) file named by the null-terminated string filename and returns an opaque “handle” for the loaded object. Background: NGINX Plus provides a supported and tested version.Starting at $2500 per year. NGINX is an open source software. Dynamic modules add functionality to NGINX Plus such…