🔵IBM WebSphere AS security vulnerability:

(DC: 260-2021)

https://dailycve.com/ibm-websphere-security-vulnerability

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑DataWave is an ingest/query framework that leverages Apache Accumulo to provide fast, secure data access: (By NSA)


Data fusion across structured and unstructured datasets

Construction and analysis of distributed graphs

Multi-tenant data architectures, with tenants having distinct security requirements and data access patterns

Fine-grained control over data access, integrated easily with existing user-authorization services and PKI

> How to install ?
https://code.nsa.gov/datawave/docs/quickstart

2021 version
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🔵 Apache Nutch injection vulnerability :

(DC: 261-2021)


https://dailycve.com/apache-nutch-injection-vulnerability

Net profit AMD Q4 rose by 947 percent annually by 1,78 billion U.S. dollars
#Analytiques

Microsoft released its second fiscal quarter financial report for the 2021 fiscal year ending.
#Analytiques

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑The right way for a ddos :
How to check subnets ?

The first thing you need to check is the connections from the shared subnets (the most commonly used are / 16 or / 24 masks).

Log in to your Linux server and enter the following command to see what connections are coming from the same subnet (/ 16):

netstat -ntu | awk '{print $ 5}' | cut -d: -f1 -s | cut -f1,2 -d '.' | sed 's / $ /. 0.0 /' | sort | uniq -c | sort -nk1 -r

If the netstat command is not found, you need to install it using the command:
sudo apt-get install net-tools -y

You should see a list of all connections from addresses that contain the same first two octets, for example 192.168.xx


To find connections from the / 24 subnet, use the following command:

netstat -ntu | awk '{print $ 5}' | cut -d: -f1 -s | cut -f1,2,3 -d '.' | sed 's / $ /. 0 /' | sort | uniq -c | sort -nk1 -r

as example

The above command will display all connections from the same subnet, but the first three octets (for example, 192.168.1.x).

If you find a large number of connections from any of these subnets, you've narrowed your search a bit.

Another netstat command will list all the IP addresses connected to the server.

This command:

netstat -anp | grep 'tcp \ | udp' | awk '{print $ 5}' | cut -d: -f1 | sort | uniq -c
You should see a list of all connected IP addresses and the number of their connections.

We then use netstat to count the number of connections each IP address has to your server.

This command:

sudo netstat -ntu | awk '{print $ 5}' | cut -d: -f1 | sort | uniq -c | sort -n
The above command will actually list the IP addresses from all subnets that are sending connection requests to your server.

At this point, you should have a good idea of ​​where the connections are coming from and what IP addresses are associated with those connections.

You can have a large number of connections from one specific subnet.

If this subnet is not supposed to reach a server with this level of traffic, most likely, this is where the DDoS attack originates.
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🔵 Tp-link TL-WR841N injection vulnerability :

(DC: 262-2021)

https://dailycve.com/tp-link-tl-wr841n-injection-vulnerability

🔵Apache Servicecomb Java Chassis input validation error vulnerability:

(DC: 263-2021)

https://dailycve.com/apache-servicecomb-java-chassis-input-validation-error-vulnerability

Digi Mobil offers certain consumers a 10 Giga voucher.
#International

WindTre, January record deal of EUR 500 discount and free tablet.
#International

🔵net-snmp: Root compromise - Existing account :

(DC: 264-2021)

https://dailycve.com/net-snmp-root-compromise-existing-account

🔵WebSphere Application Server: Denial of service - Remote/unauthenticated

(DC: 265-2021)

https://dailycve.com/websphere-application-server-denial-service-remoteunauthenticated

IPA declares “10 major threats” to information security, which suddenly leads to an attack.
#CyberAttacks

Apple was once again the subject of a "iPhone speed-down door" class action suit in Europe.
#Technologies

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑　Introduction to discovering and attacking IoT devices based on web attacks :

1. Discovery phase: Identify IoT devices

　　Use WebRTC to obtain a local IP address.

　　Send requests to all IP addresses in the IP range through port 81. Since port 81 is usually not occupied, the active device will immediately respond to a TCP RST packet. For inactive devices in the IP range, the request packet will time out.

　　Each active IP address received the initial request collected using HTML5 for 35 GET endpoints. Based on the returned error message information, the attack script will identify whether the IP address matches any of the seven devices.

　　The research project uses three different operating systems (Windows 10, MacOS and Ubuntu) and four different browsers (Chrome, Firefox, Safari, MicrosoftEdge). However, only two browsers, Chrome and Firefox, are suitable for this study. Therefore, Safari and Edge browsers are not used, because according to (Web-based attacks on the discovery and control of local IoT devices):

　　On Safari, all FETCH requests timed out, causing the attack script to identify all IP addresses as inactive. On the Edge browser, the script can use the FETCH request to correctly identify the active IP address, but Edge did not disclose the detailed HTML5 error message, so the attack script could not identify any devices on Edge.

　　2. Access phase: control IoT devices

　　The victim visits the domain name (domain.tld) ​​controlled by the attacker, and the browser executes the malicious JavaScript code found on the attacker's site. The domain name still resolves to the attacker's server IP.

　　The malicious script requests another resource on domain.tld, which only exists on the attacker's server.

　　If the victim's local DNS cache still resolves to the attacker's remote IP, the request to /hello.php will return the string "hello" and repeat step 2.

　　But if the domain.tld in the victim's cache expires, a new DNS query will be sent to the attacker.

　　Finally, the local IP obtained from the discovery phase will be returned instead of the remote IP of the attacker. /hello.php will not respond with the string "hello", but with different content, such as a 404 error, which tells the malicious script The DNS rebinding attack has been successful.

　　Through this attack, the malicious script bypassed the browser Same-Origin Policy and gained access to the web application running on the device. Attackers can now perform restarts or start video/audio files on Google Chromecast, Google Home, smart TVs, and smart switch devices.

　　How to prevent DNS rebinding attacks against IoT devices

　　Researchers say that users, browser vendors, IoT vendors, and DNS providers need to take preventive measures to avoid DNS rebinding attacks. The following are some of the measures given by the study:

　　Users can disable WebRTC on the browser and prevent the disclosure of private IP. The attacker will be able to discover the user's private IP by sending a request to all *.1 addresses (router addresses) in the private IP range.

　　The attacker assumes that the IP range of all IoT devices has the same IP range as the victim's PC. The user can configure the router's DHCP server to assign an IP address on another subnet (such as /16).

　　Users can install dnsmasq to prevent DNS rebinding attacks by removing the RFC 1918 address from the DNS response. Users can also use dnsmasq's OpenWRT router.

　　IoT vendors can control the Host header in requests sent to the web interface. If there is no private IP that complies with RFC 1918, access can be blocked.

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

The first discrete graphics card was launched by Intel in several years, with a high incompatibility issues.
#Technologies

In searches relating to the Jewish genocide, Facebook will display "authoritative sources"
#International

🔵New termux bug in any services scripts using svlogger:

(DC: 266-2021)

https://dailycve.com/new-termux-bug-any-services-scripts-using-svlogger

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

New release for The Universal Radio Hacker (URH)

is a complete suite for wireless protocol investigation with native support for many common Software Defined Radios. URH allows easy demodulation of signals combined with an automatic detection of modulation parameters making it a breeze to identify the bits and bytes that fly over the air. As data often gets encoded before transmission, URH offers customizable decodings to crack even sophisticated encodings like CC1101 data whitening. When it comes to protocol reverse-engineering, URH is helpful in two ways. You can either manually assign protocol fields and message types or let URH automatically infer protocol fields with a rule-based intelligence. Finally, URH entails a fuzzing component aimed at stateless protocols and a simulation environment for stateful attacks.

and windows compatibility improuvements


> checkout: https://github.com/jopohl/urh

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁