-
Fileless Malware Advisory – 17 JUl 2019
Preface: Stolen account information of nearly 750 million users was available for sale on the dark web after hackers breached 24 popular websites. The stolen data, released in two batches, includes names, email addresses and hashed passwords. Description: Spear phishing email with URL to an archive file containing a .lnk file can misleading receiver to…
-
CVE-2019-13115(Jul 2019) libssh2 – client-side C library,Integer Overflow Vulnerability
Preface: Because telnet is not secure, people rely on SSH. Due to design limitations, SSH2 replaces SSH. In fact, SSH2 still has room for improvement. Technical Background – libssh2 is a client-side C library, which enables applications to connect to an SSH server. A vulnerability in client-side C library – The vulnerability was triggered when…
-
Squid proxy & reverse proxy users staying alert! CVE-2019-12527, CVE-2019-12525 & CVE-2019-12529 (Jul 2019)
Differences Between Forward Proxy and Reverse Proxy:The main difference between the two is that forward proxy is used by the client such as a web browser whereas reverse proxy is used by the server such as a web server. Forward proxy can reside in the same internal network as the client, or it can be…
-
Redis vulnerabilities CVE-2019-10192 & CVE-2019-10193: staying alert!
Preface: Fileless malware can resides within volatile storage components such as memory. About Redis: Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache and message broker. It supports data structures such as strings, hashes, lists, sets, sorted sets with range queries, bitmaps, hyperloglogs, geospatial indexes with radius queries…
-
CVE-2019-13470 MatrixSSL ASN.1 Handling Out-of-Bounds Read Vulnerability – Jul 2019
Preface: The product of MatrixSSL is used by many companies. Since MatrixSSL design in low memory footprint. Whereby, they can partner with smart city infrastructure and IoT devices. Vulnerability details: A vulnerability in MatrixSSL could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. Our speculation: x509…
-
Tiny world and tiny storm – CVE-2018-20815,CVE-2019-10638 & CVE-2019-10639
Preface: Cyber attack similar real world. There are different types of ideas and concepts in the world make humans become extreme. So we have war and different arguments. Besides, there are bacteria and virus try to infect our body. Kernel like tiny world, they also hits above circumstances. Vulnerability details: CVE-2019-10639 – Linux Kernel IP…
-
it might be new path way in cyber attack. yes, it is uefi.
Preface: UEFI has slowly come to replace BIOS. Whereby Intel schedule to completely replace BIOS with UEFI on all chipsets by 2020. Quote: Firmware is software, and is therefore vulnerable to the same threats that typically target software. Technical details: From technical point of view, EFI Runtime services are usually located below 4GB. As a…
-
Multiple high vulnerabilities in Advantech WebAccess/SCADA -CVE-2019-10989,CVE-2019-10991 & CVE-2019-10993
Preface: Cyber Security expert not suggest access SCADA Dashboard from external area (internet). But we can use VPN establish connection then sign on as a workaround. Background: Advantech WebAccess/SCADA is a browser-based SCADA software package for supervisory control, data acquisition and visualization. Vulnerability details: In WebAccess/SCADA Versions 8.3.5 and prior, multiple heap-based buffer overflow vulnerabilities…
-
China raised the security level for its vessels heading through the Strait of Malacca. Perhaps cyber security vulnerabilities causes shipping traffic jam in that place! Jul 2019
Preface: The string of attacks last month on tankers near Hormuz. It alerting to related industry and countries about bottleneck on supply chain. Quote: The head of Indonesian Maritime Security Agency, said it’s looking into the issue. And it doesn’t see why China raised the alert status? From technical point of view: As a matter…
-
CVE-2019-10141 Red Hat OpenStack openstack-ironic-inspector Introspection SQL Injection Vulnerability – JUl 2019
Preface:The cloud can be managed with a web-based dashboard or command-line clients, which allow administrators to control.At the same time it lures the arrival of cyber attackers. Product background: Red Hat OpenStack Platform provides the foundation to build a private or public Infrastructure-as-a-Service (IaaS) cloud on top of Red Hat Enterprise Linux. Vulnerability details: A…