PT-2020-1725

Name of the Vulnerable Software and Affected Versions Surface Hub affected versions not specified Description A security feature bypass issue exists in Surface Hub related to insufficient access control in the touchscreen firmware, allowing an attacker to access administrator-only settings when...

KLA11665 SB vulnerability in Microsoft Device

A security feature bypass vulnerability was found in Microsoft Device. Malicious users can exploit this vulnerability to bypass security restrictions. Original advisories CVE-2020-0702 Exploitation Related products Microsoft-Surface CVE list CVE-2020-0702 warning KB list 4537765 Solution Install...

CVE-2020-0702: Undefined Security Weakness

A security feature bypass vulnerability exists in Surface Hub when prompting for credentials, aka 'Surface Hub Security Feature Bypass Vulnerability'...

Pen Testing Ships. A year in review

Partially driven by the upcoming inclusion of Cyber Security by the IMO International Maritime Organisation, 2019 was a really busy year for maritime security testing at PTP. What can we all learn from a year of evaluating the security of ships? We’ve been involved in all sorts of ship testing,...

Stripo Inc: Information disclosure through Server side resource forgery

Summary: The application https://my.stripo.email has a template feature where can we can enter html code. By including an iframe in the html template, I was able to make a call to my server. This exposed an internally running web application. Please refer below, 63.33.82.168 - -...

Microsoft Windows: Server Core Installation

The Server Core option is a minimal installation option that is available when you are deploying the Standard or Datacenter edition of Windows Server. Server Core includes most but not all server roles. Server Core has a smaller disk footprint, and therefore a smaller attack surface due to a...

Top 5 Cybersecurity and Cybercrime Predictions for 2020

We distilled 30 independent reports dedicated to cybersecurity and cybercrime predictions for 2020 and compiled the top 5 most interesting findings and projections in this post. Compliance fatigue will spread among security professionals Being a source of ongoing controversy and debate, the...

Microsoft OAuth Flaw Opens Azure Accounts to Takeover

A vulnerability in the way Microsoft applications use OAuth for third-party authentication could allow an attacker to take over Azure cloud accounts. OAuth is a protocol that allows app users to share data about their accounts with third-party websites or apps, so that when they sign into the app...

SDL: heap-based buffer overflow in SDL blit functions in video/SDL_blit*.c

A heap-based buffer overflow was discovered in SDL in the SDLBlitCopy function, that was called while copying an existing surface into a new optimized one, due to lack of validation while loading a BMP image in the SDLLoadBMPRW function. An application that uses SDL to parse untrusted input files...

Macy's Suffers Data Breach by Magecart Cybercriminals

The department store Macy’s is warning that web skimmer malware was discovered on Macys.com collecting customers’ payment card information. The attack has been linked to Magecart, a notorious umbrella group made up of various cybercriminal affiliates that is known for injecting payment card...

Ubuntu shiftfs refcount Underflow / Type Confusion

Ubuntu: refcount underflow and type confusion in shiftfs Tested on Ubuntu 19.10, kernel "5.3.0-19-generic 20-Ubuntu". Ubuntu ships a filesystem "shiftfs" in fs/shiftfs.c in the kernel tree that doesn't exist upstream. This filesystem can be mounted from user namespaces, meaning that this is...

Microsoft Guidance for Vulnerability in Trusted Platform Module (TPM)

Executive Summary This advisory addresses CVE-2019-16863. A security vulnerability exists in certain Trusted Platform Module TPM chipsets. The vulnerability weakens key confidentiality protection for a specific algorithm ECDSA. It is important to note that this is a TPM firmware vulnerability, an...

Microsegmentation and Isolation: 2 Essential Strategies in Zero-Trust Security

The headlines over the past few years have been consistent – enterprises are pouring more and more money into cybersecurity countermeasures. Indications are that 2020 will be no different, with reports that nearly three quarters of CISOs plan to ask their CFOs for increased cybersecurity investme...

Time for day 2 of briefings at BlueHat Seattle!

We hope you enjoyed the first day of our BlueHat briefings and the Bytes of BlueHat reception in our glamping tent complete with toasted marshmallows. Yesterday, we learned a lot about how XboxOne hardware security has advanced the state of hardware security elsewhere, we heard some surprising...

Time for day 2 of briefings at BlueHat Seattle!

We hope you enjoyed the first day of our BlueHat briefings and the Bytes of BlueHat reception in our glamping tent complete with toasted marshmallows. Yesterday, we learned a lot about how XboxOne hardware security has advanced the state of hardware security elsewhere, we heard some surprising...

ThreatList: Sharp Increase in Fake Mobile Apps Impersonating Legit Ones

Malicious mobile apps that try to dupe consumers by mimicking reputable apps is a persistent problem that’s on the rise, making an app store’s commitment to security a key factor to consider for mobile users who want to avoid these threats, according to a new report. The number of blacklisted app...

10 Steps for Ransomware Protection

Just the thought of ransomware is enough to keep CISOs and security teams up at night. Victims are caught in an awful choice between paying a ransom to a criminal who may or may not release their captured network and data, or potentially spending millions of dollars to remove the ransomware on...

WordPress broken-link-manager plugin SQL injection vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. broken-link-manager is a backlink management plugin used in it. The WordPress broken-link-manager plugin suffers from an SQL injection...

iMessage - Decoding NSSharedKeyDictionary Can Read Object Out of Bounds

iMessage - Decoding NSSharedKeyDictionary Can Read Object Out of Bounds When an NSKeyedUnarchiver decodes an object, it first allocates the object using allocWithZone, and then puts the object into a dictionary for temporary objects. It then calls the appropriate initWithCoder: on the allocated...

Rethinking Responsibilities and Remedies in Social-Engineering Attacks

In the pantheon of catchy cybersecurity slogans that should never have caught on, two about social engineering spring to mind almost immediately: “End users are the weakest link” and “attackers only have to be lucky once; defenders have to be lucky all the time.” Both of those statements have bee...