| |
|
|
March 11 · Issue #5 · View online
This newsletter contains my musings around Information technology and mostly information security topics.
|
|
|
So I did the inevitable, I missed creating a weekly newsletter. Honestly, I was in the middle of so many things half done that I prioritized finishing those tasks before coming to the newsletter as I didn’t want to post a newsletter without full commitment just for the sake of it.
|
|
|
|
It seems 2021 is running on steroid with new bugs and vulnerabilities, Things just won’t stop. I made a diagram of all things got vulnerable since 1st January 2021 till now.
|
Every single item in this list is vulnerable in 2021
|
Desktop software to servers to WAF to Routers every single entry in this diagram has had a vulnerability disclosed or exploited. Let me recap the security vulnerabilities / disclosures that have surfaced in last 2 weeks:
|
- VMWare vCenter RCE: Disclosure published on 24th Feb 2021, quickly followed by lots of exploits PoC, Various Check Script for blue teams also started appearing, and like clockwork everyone saw mass scan attempts
- Sublime Package Control: Felix Wilhelm disclosed arbitrary File write in Sublime Package Control, which is the de facto package manager for Sublime text editor.
- ModSecurity Core Ruleset: Disabling Request Body Access in ModSecurity 3 Leads to Complete Bypass: If you are running v3 with request body access disabled, it was possible by bypass ModSecurity completely
- Git clone vulnerability: technical details and github blogpost
- Cisco Router RCE’s
-
Multiple RCE’s in F5 devices
- Dell SupportAssist Local Privilege Escalation
- Microsoft DNS Server RCE: CVE-2021-26897
|
|
|
This is one vulnerability which needs a dedicated space of its own. So in brief, Orange Tsai as usual came up with a brilliant research: this time with all fancy names and branding as well. The vulnerability is effectively a SSRF bug in the MS Exchange interface. Important thing to note in the link below is the timeline where Microsoft was aware of the bug since December 2020. |
ProxyLogon
ProxyLogon - The latest pre-authenticated Remote Code Execution vulnerability on Microsoft Exchange Server
|
|
|
Microsoft released a nmap NSE script, however keep in mind this open issue talking about inconsistent results from it. Various detailed writeups about the vulnerability are now public along with tools. I am listing them below, hoping it will be useful for people. |
GitHub - dwisiswant0/proxylogscan: A fast tool to mass scan for a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin (CVE-2021-26855).
|
CSS-Exchange/Defender-MSERT-Guidance.md
|
Microsoft Exchange server exploitation: how to detect, mitigate, and stay calm
“Sapphire Pigeon” is one of multiple activity clusters that Red Canary has seen dropping web shells on vulnerable Microsoft Exchange servers.
|
HAFNIUM targeting Exchange Servers with 0-day exploits
|
|
|
-
Supply Chain Issues continue to be a pain: Attackers exploited Dependency Confusion actively in last two weeks. They targeted both pypi and npm.
- SITA the service provider behind STAR Alliance suffered a data breach
- OVH data center at Strasbourg caught fire and caused a massive outage.
All I can say now:
|
Source: https://imgflip.com/i/16o47h
|
|
|
While world was busy trying to fix what’s broken. I was feverishly working on the next steps for some of my own projects. My Blogs: I have been blogging since 2007. However, I could never maintain consistent blogging. All this while I kept blaming it on my tooling, and hence I did what I should do. To prove to myself that tooling was the issue, I ran an experiment for few months running a Hugo based blog. Experiment failed miserably, and I realized fault was not in the tooling but in my motivation.
|
Posting regularly on blog: WordPress or hugo does the tooling matters?
|
This year I am trying to revive my old projects, while continue working on newer stuff. Part of that effort was the revival of CodeVigilant. Took the first step by porting the website over to Hugo. (yup neither leaving hugo nor wordpress)
|
Re-launching Codevigilant
|
Lets not forget my other public project HackingArchivesOfIndia. So hacking archives of India were in a frozen state for past2-3 months. I have slowly added more conference data to it. This week I have added ~20 more entries.
|
Hackers of India
This site is a humble attempt to find the OG’s of Indian Hacking Scene and preserve the details for future generations.
|
|
|
This brings us to the last part, as a usual list of topics that could not be covered in this newspaper.
|
The Kilobyte’s Gambit ♟️💾 1k chess game
Play a game of chess against a 1KB Javascript: How hard can it be. The best part is to understand what’s going on behind the scene.
|
Building a High Performance Text Editor
A facinating blog post outlining the efforts while building a High Performance Text Editor : SublimeText in particular
|
Microsoft previews Windows Server 2022
A short article by register outlining new behind the scene features in Windows Server 2022
|
In-depth dive into the security features of the Intel/Windows platform secure boot process
Interesting read around Intel Secure boot process
|
An Exploration of JSON Interoperability Vulnerabilities
a exploration of JSON bugs
|
Post-Spectre Web Development
Web Development Guidelines considering CPU level bugs such as Spectre bugs
|
Exploiting XPC in AntiVirus
Talk presented at Nullcon 2021 exploiting XPC on 28 different AntiVirus products on macOS through 2020
|
Well, this brings us to the end of this newsletter. If the content has helped you and you feel generous, donate here. If you like what you read, please subscribe to the newsletter. |
|
Did you enjoy this issue?
|
|
|
|
If you don't want these updates anymore, please unsubscribe here.
If you were forwarded this newsletter and you like it, you can subscribe here.
|
|
|
|
Bhopal, India
|
