-
Security focus – Fileless malware execution with powershell (27-08-2020)
Preface: Modern Cyber Defense solution without difficulties detect malicious activities. For instance, applications need approved permissions before installation; and security software can scan files to be written, read, and/or executed to check for known signatures. But we still heard data breach incident occurred. Why? Detail description: On 26th Aug, 2020, US Homeland security published articles…
-
Learn about ATM technology through NCR vulnerabilities (26th Aug 2020)
Preface: A few years ago, ATM attackers might have the opportunity to compromise ATM machines through this method (Raspberry Pi + Python + Wifi). It looks that it is not possible right now. Study Road Map: From a security perspective, the design weaknesses disclosed by the vendor this time are divided by 3 types.– Insufficient…
-
A rapid development of China Cyber Security Law
Preface: Data allows organizations to more effectively determine the cause of problems. Data allows organizations to visualize relationships between what is happening in different locations, departments, and systems. Background: Perhaps of the Big Data powerful functions. On July 3, 2020, the Standing Committee of the National People’s Congress (NPC) published the draft Data Security Law…
-
CVE-2020-7711- Pure Go repositories (goxmidsig) vulnerability – 23-08-2020
Preface: SAML 2.0 implementation for Service Providers based on etree and goxmldsig, a pure Go implementation of XML digital signatures. Background: “nil” in Go that represents zero values for pointers, interfaces, channels, maps, slices and function types. Vulnerability Details: A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be…
-
CVE-2020-8620 can be transformed as a tool to bother DNS sinkhole function – 23 Aug 2020
Preface: BIND (Berkeley Internet Name Domain) is the most commonly used DNS software on the Internet today. DNS servers that use BIND as server software account for about 90% of all DNS servers. Technical background: The BIND nameserver is based on a custom event queueing system that wraps around the libuv library (http://libuv.org) for performing…
-
Remote Access Trojan: BLINDINGCAN – 19th Aug 2020
Preface: The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have identified a malware variant—referred to as BLINDINGCAN—used by North Korean actors. Techincal details: Perhaps the official report already provide the details. In short, the key point is that APT group exploit the Microsoft Word vulnerability (CVE-2017-0199). As such, APT…
-
Do not use insecure deserializer BinaryFormatter – 19th Aug 2020
Preface: SharePoint is a web-based collaborative platform that integrates with Microsoft Office.So called WebParts”gadgets” that provide new functionality when added to a page. Background: On July 14, 2020, Microsoft released a security update to fix the vulnerabilities found in the .NET Framework, Microsoft SharePoint and Visual Studio. A proof of concept shown that attacker can…
-
Ransomware hits Jack Daniel’s, said Bloomberg News – August 15, 2020
Preface: Whiskey production involves multiple procedures carried out in potentially hazardous atmospheres. LB Remote I/O System connects sensors and actuators to the DCS via PROFIBUS. In terms of application, DCS is suitable for whisky production and complex control processes. Incident background: Brown-Forman Corp., a manufacturer of alcoholic beverages including Jack Daniel’s and Finlandia, said it…
-
Apache release security advisory for struts 2 (aug 2020)
Preface: Struts2 OGNL is the expression language. OGNL is tightly coupled in Struts2 and used to store form parameters as java bean variables in ValueStack and to retrieve the values from ValueStack in result pages. ActionForm has the following responsibilities:Perform data security verification to prevent malicious data from entering the application. Vulnerability details: However, it…
-
New Linux malware – aka Drovorub (13th Aug 2020)
Preface: New Linux malware silently conducting the attack. The FBI and NSA issue joint security alert. Official announcement – https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF Remedy: To prevent attacks, the agency recommends that US organizations update any Linux system to a version running kernel version 3.7 or later, “in order to take full advantage of kernel signing enforcement,” a security…