-
CISA urges to be vigilant! About GPS Daemon (GPSD) Rollover Bug (21st Oct, 2021)
Preface: If you are using a security token (fobs or software), when there is a problem with the NTP time source. This is unforeseen. Maybe there is nothing wrong with it. Or, in the worst case, similar you mistaken reset the NTP server time setting. Therefore, all your tokens should be suspended. Background: Because in…
-
Fastly CDN outage, perhaps not cyber attack (4th Oct, 2021)
Preface: In addition to cyber security attacks. Cloud service providers face different technical challenges, including software and hardware levels. Background: Fastly is a company that provides content delivery network (CDN) services, mainly providing host static content and quickly showing it to Internet users. Fastly peers with other Internet Service Providers (ISPs) and Content Networks with…
-
Stealth attack of UEFI bootkit (29th Sep 2021)
Preface: Digital spyware and monitoring tech that allows the user to covertly monitor a target’s communications, or collect personal data emitted from their devices. Background: FinFisher, also known as FinSpy, is surveillance software marketed by Lench IT Solutions plc, which markets the spyware through law enforcement channels. On August 6, 2014, FinFisher source code, pricing,…
-
Security Focus on Microsoft windows CMD Stack Buffer Overflow (19-09-2021)
Preface: Twenty years ago, content filter firewalls were not popular. A quick way to harden the Microsoft Internet Information server is to delete all cmd commands to avoid network attacks. Background: If you would like to run cmd in privileged mode. You have to do the following: type “CMD” you can hit Ctrl+Shift+Enter to open…
-
Unkown backdoor run on TCP 7614, virtual patching is one of the protective control methods (12th Sep, 2021)
Preface: Virtual patching acts as a safety measure against threats that exploit known and unknown vulnerabilities. Virtual patching works by implementing layers of security policies and rules that prevent and intercept an exploit from taking network paths to and from a vulnerability. Background: This is so called Evasion Techniques. One of the first techniques that…
-
Interested topic last week (AWS “AKIA” discussion) – 5th Sep, 2021
Preface: On 2014, Amazon Web Services (AWS) is asking those that write code and use GitHub to go back and check their work to make sure they didn’t forget to remove login credentials. The warning comes as news is circulating about the availability of nearly 10,000 AWS keys in plain sight on GitHub just by…
-
Another flaw prompted an urgent U.S. government warning and providing Guidance (Azure Cosmos DB) – 29th Aug 2021
Preface: Data scientists are big data wranglers, gathering and analyzing large sets of structured and unstructured data. Jupyter Notebooks allow data scientists to create and share their documents, from codes to full blown reports (Help them streamline their work). Background: Azure Cosmos DB built-in Jupyter Notebooks are directly integrated into the Azure portal and Azure…
-
CISA cyber Security Alert – About the May 2021 MS patch (21st Aug, 2021)
Preface: With Exchange Server vNext, Microsoft is phasing out the on-premise delivery model, making Exchange Server 2019 the last on-premise product version. Point of view: Perhaps quite a lot of people will be surprised of this notification. Since more and more organizations has been migrated the mail server to office 365. The patch issued on…
-
Kubernetes Hardening Guidance by NSA & CISA (3rd Aug 2021)
Preface: Docker helps to “create” containers, and Kubernetes allows you to “manage” them at runtime. What is Kubernetes Security? That is Cloud, Cluster, Container and code. Background: Kubernetes is commonly targeted for three reasons observing by NSA and CISA. They are data theft, computational power theft, or denial of service. Cyber attacks encountered in the…
-
DarkSide Ransomware ready to move. Operational Technology (OT) should staying alert (7-7-2021)
Preface: IDC report predicted that By 2024, 60% of industrial organizations will integrate data from edge OT systems with cloud-based reporting and analytics, moving from single-asset views to sitewide operational awareness. Background: PowerShell provides an adversary with a convenient interface for enumerating and manipulating a host system after the adversary has gained initial code execution.…