Excerpts from Building a High Speed SOC: Achieving Speed (Part 2)

Carbon Black recently published an in-depth guide on what it takes to develop a "high speed" security operations center, or SOC; this is the last excerpt from that guide, which you can find here. For more information on building high speed SOCs, including how to eliminate the "response gap," chec...

SOC Forum 2017: How I Learned to Stop Worrying and Love Massive Malware Attacks

Today I spoke at SOC Forum 2017 in Moscow. It was a great large-scale event about Security Operation Centers. 2,700 people registered. Lots of people in suits . And lots of my good fellows. The event was held in Radisson Royal Congress Park. There were three large halls for presentations and a hu...

CVE-2017-0865

An elevation of privilege vulnerability in the MediaTek soc driver. Product: Android. Versions: Android kernel. Android ID: A-65025090. References: M-ALPS02973195...

CVE-2017-0865

An elevation of privilege vulnerability in the MediaTek soc driver. Product: Android. Versions: Android kernel. Android ID: A-65025090. References: M-ALPS02973195...

Excerpts from Building a High Speed SOC: Introduction

Carbon Black recently published an in-depth guide on what it takes to develop a "high speed" security operations center, or SOC; this is an excerpt from that guide, which you can find here. For more information on building high speed SOCs, including how to eliminate the "response gap," check out...

IEEE P1735 Encryption Is Broken—Flaws Allow Intellectual Property Theft

Researchers have uncovered several major weaknesses in the implementation of the Institute of Electrical and Electronics Engineers IEEE P1735 cryptography standard that can be exploited to unlock, modify or steal encrypted system-on-chip blueprints. The IEEE P1735 scheme was designed to encrypt...

Android Security Bulletin—November 2017Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2017-11-06 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners were...

November 3, 2017 – Morning Cyber Coffee Headlines – “Friday” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! November 3, 2017 - Headlines Carbon Black in the News: Endpoint security needs...

Apple: OOB NUL byte write when handling WLC_E_TRACE event packets(CVE-2017-7112)

Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are capable of handling many Wi-Fi related events without delegating to the host OS. On iOS, the "AppleBCMWLANBusInterfacePCIe"...

Google Android Qualcomm SoC Driver Elevation of Privilege Vulnerability

Android is a free and open source Linux-based operating system led and developed by Google Inc. and the Open Handset Alliance. An elevation of privilege vulnerability exists in the Google Android Qualcomm SoC driver, which can be exploited by attackers to elevate privileges...

Apple: Information Leak when handling WLC_E_COUNTRY_CODE_CHANGED event packets(CVE-2017-7116)

Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are capable of handling many Wi-Fi related events without delegating to the host OS. On iOS, the "AppleBCMWLANBusInterfacePCIe"...

5 Steps to a High-Speed SOC

Your endpoints don’t just live within the safety of your corporate network—they’re out in the wild exposed to millions of new threats every day. With non-malware attacks on the rise that are even harder to detect than traditional malware, security professionals are realizing it is no longer a...

CVE-2017-0827

An elevation of privilege vulnerability in the MediaTek soc driver. Product: Android. Versions: Android kernel. Android ID: A-62539960. References: M-ALPS03353876, M-ALPS03353861, M-ALPS03353869, M-ALPS03353867, M-ALPS03353872...

Broadcom ICMPv6 Information Leak Vulnerability

Exploit for hardware platform in category dos / poc Broadcom: Information Leak in ICMPv6 Router Advertisement Offloading CVE-2017-11122 Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers,...

CVE-2017-0827

CVE-2017-0827 is an Elevation of Privilege vulnerability in the MediaTek SoC driver within the Android kernel. Affects Android devices with MediaTek SoC driver stack; root cause is a flaw in the SoC driver that could allow a local attacker to execute arbitrary code within a privileged process con...

CVE-2017-0827

An elevation of privilege vulnerability in the MediaTek soc driver. Product: Android. Versions: Android kernel. Android ID: A-62539960. References: M-ALPS03353876, M-ALPS03353861, M-ALPS03353869, M-ALPS03353867, M-ALPS03353872...

Broadcom: Multiple overflows when handling 802.11r (FT) Reassociation Response(CVE-2017-11121)

Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are capable of handling many Wi-Fi related events without delegating to the host OS. In order to allow fast roaming between access...

Broadcom: Heap overflow when handling 802.11v WNM Sleep Mode Response(CVE-2017-7065)

Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are capable of handling many Wi-Fi related events without delegating to the host OS. In order to allow clients to configure...

Broadcom 802.11r (FT) Reassociation Response Overflows Vulnerability

Broadcom suffers from multiple overflow vulnerabilities when handling 802.11r FT Reassociation Response. Broadcom: Multiple overflows when handling 802.11r FT Reassociation Response CVE-2017-11121 Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. Thes...

Partner Perspectives: Operationalizing Data With the Carbon Black and Splunk Integration (Part 1)

Editor's Note: this blog originally appeared on RedCanary.com Over the last 5 years I have grown very close to Splunk. The product has evolved so much over the years, but the core architecture has always been easy to deploy and understand. Splunk is known for the speed at which it can search for...