The threat actor spending their effort to re-engineering the vulnerabilities of Meltdown and Spectre. Their objective is relies on design flaw convert as a cyber attack solution including data extraction and collect the user credential. However it is still in development phase. Today, AMD vulnerabilities looks harm the IT world. Since the proof of concept shown positive result. The AMD covered GPU market so far. Perhaps this time the flaw happened in the design of CPU. It is hard to imagine that once the criminal group convert this flaw successful as attack tool.How the worst will be happened!

Should you have interest, please download the white paper in below URL.

https://safefirmware.com/amdflaws_whitepaper.pdf

Potential Risk of CVE

Mozilla Releases Security Updates for Firefox Published March 13, 2018

March 13, 2018 admin

Use After Free and Out-of-bounds Write vulnerabilities totally appears in Firefox web browser. It looks that there are more vulnerabilities found! The code for all projects in the Mozilla family (such as Firefox, Thunderbird, etc.) … Contains images and CSS files to skin the browser for each OS (Linux, Mac and Windows) … Support code for calling JavaScript code from C++ code and C++ code from JavaScript code, using XPCOM interfaces. So the hit rate of above vulnerabilities indeed possible and it make Firefox unsafe. In short, please see below url for reference. It is a official announcement.

https://www.mozilla.org/en-US/security/advisories/mfsa2018-06/

Potential Risk of CVE

CISCO vulnerabilities checklist – Mar 2018

March 13, 2018 admin 1 Comment

As of this month, Cisco found more vulnerabilities just this month. It looks that network equipment provider will be felt Microsoft pain since they have web server and java applet. For more details, please refer below:

CVE-2018-0087 – A vulnerability in the FTP server of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to log in to the FTP server of the device without a valid password. (High)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-wsa

CVE-2018-0220 – A vulnerability in the web-based management interface of Cisco Videoscape AnyRes Live could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. (Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-val

CVE-2018-0219 – A vulnerability in the web-based management interface of Cisco Unified Computing System (UCS) Director could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ucs

CVE-2018-0217 – A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authenticated, local attacker to perform a command injection attack on an affected system.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-staros

*CVE-2018-0224 – A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authenticated, local attacker to execute arbitrary commands with root privileges on an affected operating system. (Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-staros1

*CVE-2018-0209 – A vulnerability in the Simple Network Management Protocol (SNMP) subsystem communication channel through the Cisco 550X Series Stackable Managed Switches could allow an authenticated, remote attacker to cause the device to reload unexpectedly, causing a denial of service (DoS) condition.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-550x

CVE-2018-0223 – A vulnerability in DesktopServlet in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based interface.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-sm

CVE-2018-0208 – A vulnerability in the web-based management interface of the (cloud based) Cisco Registered Envelope Service could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected service.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-res

CVE-2018-0144 – A vulnerability in the web-based management interface of Cisco Prime Data Center Network Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-pdcnm

*CVE-2018-0141 – A vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software 11.6 could allow an unauthenticated, local attacker to log in to the underlying Linux operating system.(Critical)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-cpcp

CVE-2018-0210 – A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-dcnm

Cisco Identity Services Engine (ISE)

CVE-2018-0215 – A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise4

*CVE-2018-0213 – A vulnerability in the credential reset functionality for Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to gain elevated privileges.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise2

*CVE-2018-0214 – A vulnerability in certain CLI commands of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to execute arbitrary commands on the host operating system with the privileges of the local user, aka Command Injection.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise3

CVE-2018-0212 – A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise1

CVE-2018-0216 – A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. (Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise5

* CVE-2018-0211 – A vulnerability in specific CLI commands for the Cisco Identity Services Engine could allow an authenticated, local attacker to cause a denial of service (DoS) condition.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise

* CVE-2018-0221 – A vulnerability in specific CLI commands for the Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to perform command injection to the underlying operating system or cause a hang or disconnect of the user session.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise6

Cisco Secure Access Control

CVE-2018-0207 – A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system. (Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acs

CVE-2018-0147 – A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device.(Critical)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acs2

CVE-2018-0218 – A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acs1

Potential Risk of CVE

Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization

March 12, 2018 admin

Retrospectively Shibboleth(SAML IDP) found vulnerability on 13th Jan 2018 (CVE-2018-0486). The flaw was that it allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD. However there is an additional vulnerability found on Security Assertion Markup Language (SAML). It is the CVE-2018-0489. A multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal. It looks that it may causes serious headache to many people (webmaster).

During my penetration test engagement in past. I was surprised that no matter airline , financial and retail industries web online application solutions are deployed open source single-sign on resources. An incident occurred in Equifax which awaken the business world that open source application has potential inherent risk. It will jeopardize your firm reputation. Below url is the Security Advisory provided by Shibboleth. You can also find the details on attached picture diagram.

https://wiki.shibboleth.net/confluence/display/NEWS/2018/02/27/Shibboleth+Service+Provider+Security+Advisory

Cyber War, Under our observation

New detection of technology. Will it be let Antivirus firm embarrassing?

March 11, 2018 admin 1 Comment

Retrospectively, the IT technology defense mechanism especially behavior analysis and cloud machine learning model are powerful. The threat actors looks difficult to masquerade themselves to start the infiltration. In order to fight against crime. The law enforcement might have to doing the surveillance or scrutiny the suspects. Since it is not a secret, a professional software house assists law enforce to doing the surveillance. Yes, it is FinFisher. Heard a rumors that Turkish government is going to enforce the cyber security in their country. Perhaps Finfisher is expensive and therefore they are chosen the other way. They deployed Sandvine PacketLogic middleboxes in five regions across the country. It is a man-in-the-middle. A question you will be ask. If anti-virus vendor found the malicious activities which handle by law enforcement. Do you know how they can do? Does it take quarantine action or remaining silent? It looks that a contradiction will be happened more and more in future! Or the law enforcement will be deployed advance technique to masquerade themselves evade the detection?

Potential Risk of CVE, Under our observation

CVE-2018-7642 – GNU Binutils 2.30

March 10, 2018 admin

Are you aware of CVE-2018-7642? Bug found GNU Binutils 2.30 on 24th Feb 2018. However it noted to my interest that Binutils 2.30 released on 27th Jan 2018. But 3 weeks later, found a system bug causes system crash. The flaw is that it lack of check if “sym” is null. The bug was fixed on 28th Feb 2018. But I was wondering that GNU Binary Utilities, or binutils, are a set of programming tools for creating and managing binary programs, object files, libraries, profile data, and assembly source code. So if you are using GNU Binutils version 2.30, you must be staying alert! Perhaps the design flaw only encounter system crash. But it is under my observation.

Blockchain

9th Mar 2018 – Crypto currency world Trivia

March 10, 2018 admin

Crypto currency world Trivia: Most crypto exchange are currently licensed at United States level as money transmitter businesses.

Status update on Mar 2018:

US regulators have stated their desire to implement more oversight at the federal level.

Reference URL: https://sg.finance.yahoo.com/news/crypto-exchange-bittrex-compliant-sec-225148555.html

2018, cyber security incident news highlight

How much is your personal data worth?

March 9, 2018 admin

Microsoft windows defender make the world safe. The threat actor masquerading a legitimate file goal to doing bitcoin mining. Windows defender just kill it within seconds. It is very powerful. It hints to the world that there will be formed different countries will have their own operation system. Why? Nobody want that all the time under monitoring.

For more details, about this news, please refer below url for reference.

https://www.forbes.com/sites/leemathews/2018/03/08/microsoft-saves-400000-windows-users-from-a-malicious-cryptocoin-miner/#5cc0f2b046a6

2017, Blockchain, cyber security incident news highlight

Heard that Crypto exchange BINANCE faced ‘large scale’ theft attempt

March 8, 2018 admin

Heard that a rumors on discussion website. A victim stated that an unknown counterfeit cryptocurrency transaction submitted in his account. I retrospectively his discussion detail and feeling that the problem may not happen in his endpoint. The victim stated that he noticed that a 3rd API key has been created, without IP white listing. But the API key not his own belongings. Regarding to the BINANCE Exchange client specification, they support REST API. What if when they are using REST API caching middleware,acting as a reverse proxy between load balancers and your REST API workers. Is there a way let threat actors do the dirty tricks in the cache space?

Should you have interest about this news. Please refer below url for reference.

https://www.ft.com/content/58a32050-22aa-11e8-add1-0e8958b189ea

Potential Risk of CVE, Under our observation