Potential Risk of CVE

Outlook for Android – DOM based cross-site scripting (XSS) vulnerability (Nov 2019)

Preface: XSS attack can be either server-side or client-side.

Vulnerability details: A vulnerability occurs on Outlook for Android that would allow an attacker to perform cross-site scripting (XSS) attacks on the affected systems and run scripts in the security context of the current user. The official announcement did not described in details. So my earlier attention focus in TaintTracking Configuration. However it looks that it is incorrect. The best way to fix DOM based cross-site scripting is use the right output method (sink). From technical point of view, XSS occurs when attacker inject client side script into web pages. So in order to fix this vulnerability. it should do a sanitization of user-supplied data.

Remedy: The security update addresses Microsoft Outlook for Android parses specially crafted email messages. Please refer to following URL for details – https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1460

Potential Risk of CVE

TCP-pipelined queries flaw, causes to bypass tcp-clients limit (CVE-2019-6477)

Preface: To improve bandwidth utilization, an introduce of layer-4 relay(s) that enable the pipelining of TCP connections.

Background: BIND 9 has evolved to be a very flexible, full-featured DNS system. On a server with TCP-pipelining capability,it is possible for one TCP client to send a large number of DNS requests over a single connection.

Vulnerability details: It was discovered that Bind incorrectly handled certain TCP-pipelined queries. A remote attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of service.

Observation: Before remedy apply, such design weakness may provide a pathway to cyber criminals conduct a denial of service attack. Perhaps it is easy to start the attack then suspened the DNS services. Eventhough you have defense control but cannot avoid. The official announcement and remedy solution can be find in following url. https://kb.isc.org/docs/cve-2019-6477

Virus & Malware

looking back the malware evolutionary at 2019

Preface: Unlike C, C++ is an object-oriented programming language, following a programming model that uses objects that contain data as well as functions to manipulate the data. Word is an object-oriented program.

Security focus: The malware author usually exploit some kind of arbitrary code execution or zero day. And therefore it have chances to evade the anti-defense mechanism detection.
The reason behind is that before reassemble of the modules, it do not take any action. But perhaps you have doubt?
How do they get another module? In modern defense technology, the machanism of the malware detector will be based on blacklist domain for the first piority. If attacker compromise a web site not included in domain blacklist. So, when download other module by http or https traffic might not detected by defense machanism. As a matter of fact, the http get and put action are frequently happens in our internet web browsing. Therefore you will understand that why does cyber criminals target to compromising a boutique shop style web site and social media. It was because the web sites still in white list before compromise.

Should you have interested to know more. F5 Lab has article for your reference. A Reference Guide to the Malware Family Tree – https://www.f5.com/labs/articles/education/banking-trojans-a-reference-guide-to-the-malware-family-tree

2019, cyber security incident news highlight, Under our observation

Gun and bullet – SMBV1 and Ransomware (Nov 2019)

Preface: Starting from around 2012 the use of ransomware scams has grown internationally.

Background: About 5 days ago, headline news of Bloomberg told that cyber criminals compromised the IT infrastructure for Mexican Petroleum. Meanwhile, hacker hopes to extract nearly $5 million from the company, with a final deadline of 30th November, 2019.

Tremendous incident record: EternalBlue leaked by the Shadow Brokers hacker group on April 14, 2017, one month after Microsoft released patches for the vulnerability. EternalBlue opened the door to one of the nastiest ransomware outbreaks in history, known as WannaCryptor.

Our point of view: Most older NAS devices do not support SMB version 2 or above, even though it can be do a firmware upgrade. But system admin sometimes lack of awareness or running out of labor resources. And therefore remains SMB V1 on the workstation. As a matter of fact, it let the small to medium size enterprise shot by ransomware. Even though manufacturing and petroleum industries you might found SMB v1 still alive in their place. Perhaps this is the story began.

For more information on headline news, please refer – https://www.bloomberg.com/news/articles/2019-11-13/a-hacker-wants-about-5-million-from-pemex-by-end-of-november

Potential Risk of CVE

Interested in this vulnerability CVE-2019-5541?

Preface: As far as I know, VMware announced CVE-2019-5541 on April 2019. But the security update just released two days ago. Perhaps this products not in profitable area. But the flaw awaken quite a lot of people to concerning the weakness in virtual machine design.

Background: VMware Workstation is for Windows/Linux while Fusion is for Intel Based Apple Computers only running Mac OS X 10.4.9 and later.

Type 1 hypervisors are commonly considered bare metal hypervisors, in that the hypervisor code itself runs directly on top of your hardware.
VMware Workstation is an example of a type 2 hypervisor. You can install it on top of an existing instance of Windows (and a number of Linux distributions).

Vulnerability details: VMware workstation and Fusion versions identified as victims to out-of-bounds write vulnerability in the e1000 virtual network adapter. The affected guest may allow to execute a malicious code on the hypervisor.

Supplement: The idea of heap buffer overflow is generally to achieve out-of-bounds write. According to the data of write, there are more specific subdivisions. For more details, please refer to attached diagram.

Official announcement – https://www.vmware.com/security/advisories/VMSA-2019-0021.html

Potential Risk of CVE

CVE-2019-0721, CVE-2019-1397, CVE-2019-1398, CVE-2019-1399 – Hyper-V Remote Code Execution Vulnerabilities

Preface: Virtualization in the virtualization platform. It is definitely a microsystem architecture.

Technical background: Windows Sandbox requires a Type 1 hypervisor. Therefore, to run Sandbox on a virtual machine, nested virtualization must be enabled. Nested virtualization allows running Hyper-V on a virtual machine. In addition, it allows Windows Sandbox to run on a virtual machine.

The Hyper-V vSwitch is a software-defined, layer-2, Ethernet network-traffic switch. It allows administrators to connect VMs to either physical or virtual networks. The adapter for the Hyper-V virtual switch is completely unbound from anything that the Windows Firewall has access to. Packets will pass through it without ever being inspected by the management operating system’s firewall.

Vulnerability details: An attacker could run malicious code on a guest operating system, which could cause the Windows Hyper-V host to execute arbitrary code. For the successful of the attack, hacker will run malicious code on a guest operating system. The attacker can do a escape of the VM sandbox once successful. Meanwhile the victim guest VM could cause the Windows Hyper-V host to execute arbitrary code.

Reference: Official announcement –https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1398

Potential Risk of CVE

The arbitrary code execution (ACE) is on your wrist CVE-2019-8718

Preface: XNU is an operating system kernel developed by Apple Computer for the macOS operating system. It is part of the Darwin operating system. XNU is a hybrid kernel combining the Mach kernel .

Background: IOKit – Gain user-space access to hardware devices and drivers. The IOKit object representing a hub device on the USB bus. It is a subclass of IOUSBDevice. A vulnerable implementation of IOInterruptEventSource on a workloop exists in IOUSBDeviceFamily.

Impact: Attacker can sending an USB control message to a target device exploit the vulnerability which lets the application to execute arbitrary code with kernel privileges.

Current Status:
– Entry added October 29, 2019
– Proof of concept release on 11th Nov 2019

Public safety

Nov 2019 – malware samples, staying alert!

Preface: The Trojan mostly arrive via email or spread from infected websites that users visit.

Background: U.S. Cyber Command has released seven malware samples. The malware hash shown as below: a2a77cefd2faa17e18843d74a8ad155a061a13da9bd548ded6437ef855c14442 fdb87add07d3459c43cfa88744656f6c00effa6b7ec92cb7c8b911d233aeb4ac 738ba44188a93de6b5ca7e0bf0a77f66f677a0dda2b2e9ef4b91b1c8257da790 04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30 618a67048d0a9217317c1d1790ad5f6b044eaa58a433bd46ec2fb9f9ff563dc6 1ea6b3e99bbb67719c56ad07f5a12501855068a4a866f92db8dcdefaffa48a39 b6811b42023524e691b517d19d0321f890f91f35ebbdf1c12cbb92cda5b6de32

Our observation: VC++ method of injecting code into other programs is popular (see below):

  1. Put your code into a DLL; then use the windows hook to map it to the remote program.
  2. Put your code into a DLL; then use CreateRemoteThread and LoadLibrary to map it to the remote program.
  3. Copy your code directly to the remote program without using a DLL (using WriteProcessMemory)

So, how can you protect yourself against malicious code? Staying alert!

Public safety

When you receive a word document. Perhaps document contained evasion technique. But you can do a basic health check by yourself. Nov 2019

Preface: Hot topic in the city this week perhaps is uncover the secret of surveillance power.

My focus: Perhaps quite a lot of reader are interested of the program code of the surveillance program ( sigs.py ). As far as we know, similar of surveillance program infection technique will be relied on email attachment (especially MS word document).

This underground cyber attack method was exposed by Kaspersky on November 5, 2019, and named Dark Universe, literally translating the Dark Universe.
Since this kind of surveillance program sometimes focus on evadsion technique. And therefore the earlier phase of infection do not insists to use the Malicious code . From technical point of view, when you open the word document you can do a health check by yourself on unknown word document.

MS Word document validation method (DIY) – Remove an embedded file or object

1.Open MS word document
2.Select the chart area and press Ctrl+C.
3.Select the location where you want to paste a picture of the chart, press Ctrl+Alt+V, and pick a Picture format.
4.Select the original embedded chart and press Delete.

— End —

Potential Risk of CVE

Apache solr 8.2.0 remote code execution (nov 2019)

Preface: Apache Solr is an application based on J2EE and uses Lucene libraries internally to provide user-friendly search as well as to generate the indexes.

Background: Apache Solr powers the search and navigation features of many of the world’s largest internet sites.

Vulnerability details: When an attacker can directly access the Solr console, he can make changes to the node’s configuration file by sending a POST request like /nodename/config.

Apache Solr integrates the “VelocityResponseWriter” plugin by default. The “params.resource.loader.enabled” option in the plugin’s initialization parameters is used to control whether the parameter resource loader is allowed to specify template in the Solr request parameter. This option default setting is false. When “params.resource.loader.enabled” is set to true, the user will be allowed to specify the loading of related resources by setting the parameters in the request, which means that the attacker can construct a threatening attack request on the server. A remote code execution will be occurred.

Current status: waiting for CVE reference number

antihackingonline.com