-
headline news – cyber attackers from exploiting web servers via web shell malware. 23rd Apr 2020
Preface: Web shells are a well-known attacker technique, but they are often difficult to detect because of their proficiency in blending in with an existing web application. Details: to gain root access to server. Web shells malware are frequently chosen by APT group; however these are just a small number of known used web shells.…
-
Buffer Overflow (SEH Bypass), perhaps it is easy to encounter in medical software system (20th Apr 2020)
Preface: IoT Enterprise runs on 32-bit and 64-bit x86 chipsets with support for Universal Windows Platform (UWP) apps as well as Classic Windows(e.g. Win32 and .NET) applications. Perhaps you will discover plenty of medical devices still use 32 bit windows application. Recent security alert on medical product: The ‘DICOM Viewer 2.0’ capable of handling all…
-
winducms – attacker exploit php feature cause sql injection and REC (20th Apr 2020)
Preface: Why we found vulnerability on apps in frequent? Fundamentally, apps goal provided services and function. Even though you said it is a design weakness. But protection control should relies on other separate service or component. It will increase the difficulties for attacker when you install the antivirus(malware) on your mobile phone. Vulnerability background: Windu…
-
Centreon – Remote code execution can be configured via Poller (18th Mar 2020)
Preface: Centreon Engine allows you to schedule periods of planned downtime for hosts and service that you’re monitoring. So if design weakness occurs in this place. It provides a way to attacker for exploit. Background: Centreon is an open source IT monitoring solution by Centreon. It is easy to install and you can deploy within…
-
Political and Justice – 2020
Wyden and Khanna proposed amending the Espionage Act of 1917 to protect journalists, whistleblowers, and security researchers who discover and disclose classified government information. (see below url) https://www.wyden.senate.gov/news/press-releases/wyden-and-khanna-introduce-bill-to-protect-whistleblowers-ensure-journalists-arent-targeted-for-publishing-classified-information- If you are also interested of cyber security information developing state. Perhaps you will seen the cyber security protection will be transform to preventive instead of defensive.…
-
Monthly news focus – Mar 2020
Preface: Do you have doubt for the road map of application penetration test? I believe that it is a logical step. Sometimes, you will concerning the limit time windows for remediation for different of vulnerability result. The penetration tester will narrow down the work scope especially the high risk rating vulnerability item. Since this is…
-
A retrospective album of BlackEnergy – Feb 2020
Somewhere in time. This is 2015 – BlackEnergy2 exists in the form of a kernel-mode driver, which makes it harder for network administrators to discover the compromise. Black energy Group will mimics their custom tool(driver) thus made to look like a normal Windows component. They are interested in infecting Windows servers especially OPC server. But…
-
Staying alert of Emotet infection, even though you are a Mac User. Feb 2020
Preface: Apple Mac OS as not as easy to compromised compare with other popular operation system. Details (A): Emotet is malware originally engineered as a banking Trojan designed to steal sensitive information. It is a modular malware variant which is primarily used as a downloader for other malware variants such as TrickBot and IcedID. But…
-
Vulnerabilities in VMware (RMI communication in vRealize Operations for Horizon) are also apply for those vendor who is using RMI in Java environment. (20th Feb 2020)
Preface: JMX is often described as the “Java version” of SNMP (Simple Network Management Protocol). Synopsis: A vulnerability in the Java Management Extensions (JMX) management agent included in the Java Runtime Environment (JRE) may allow a JMX client running on a remote host to perform unauthorized operations on a system running JMX with local monitoring…
-
Hacker exploit Coronavirus Crisis, send scam email to different industries – 18th Feb 2020
Synopsis: a. Attackers disguise their scam email as an official (WHO) alert issued by the Centers for Disease Control Health Alert Network. (Targeting individuals from the United States and the United Kingdom) b. Attackers disguise their scam email as an alert of Coronavirus status, they are target to shipping industry. Description: About the attack to…