Skip to content
Search

Vulnerability

lastmod 2026-04-10created 2018-01-1218 edits

A vulnerability is a weakness used by an attacker to reduce a system's information assurance. A vulnerability is the intersection of three elements: a system susceptibility or flaw, attacker access to the flaw, and attacker capability to exploit the flaw. To exploit a vulnerability, an attacker must have at least one tool or technique that can connect to a system weakness. In this case, the vulnerability is also known as the attack surface.

Category

Intel Vulnerability

Standard reference file for reporting security vulnerabilities

  • security.txt: Proposed standard for defining security policies
  • Draft submitted to the IETF
  • A Security version of Robots.txt placed in the root or /.well-known/
  • Required: Contact (security contact's email or link) / Expires
  • Optional
    • Links: Encryption (PGP-Key) / Acknowledgments / Policy (security policy details) / Hiring (security-related jobs) / Canonical (other locations)
    • Other: Preferred-Languages

2018 Best Vulnerability

The most common vulnerabilities of 2018 selected by WhiteHat are as follows.

  1. jQuery File Upload RCE – CVE-2018-9206
  2. Magecart
  3. WordPress DoS – CVE-2018-6989
  4. Drupalgeddon 2 – CVE-2018-7600
  5. Drupalgeddon 3 – CVE-2018-7602
  6. Telerik’s RadAsyncUpload
  7. Spring Data Commons – CVE-2018-1273
  8. Cross Site Scripting – CVE-2018-1999024
  9. Flash Player Hack – CVE-2018-4878
  10. Spring OAuth Approval – CVE-2018-1260

Three-line summary

  1. The 10 vulnerabilities hackers used most in 2018 were selected.
  2. They included a mix of old and new ones.
  3. The vulnerabilities have two roots: the spread of open source and DevOps.

South Korea's online security at a dead end

Korea's online banking and e-government services have long been notorious for their various installer programs. In the past it was ActiveX, and these days it has changed to security plugin installers, but the essence has not changed. Still, compared to before, things have improved somewhat recently, with identity verification methods that replace the accredited certificate appearing and some places offering online services without exe plugin installation; yet it is truly lamentable that, as of 2023, websites that force you to install these things still brazenly remain.

Wladimir Palant, known for Adblock Plus, posted on his blog that he had been investigating this state of online security in Korea since September. (in English) Starting from the historical reason that Korea began using ActiveX to implement internet banking services with its own SEED algorithm because of U.S. export restrictions on cryptographic algorithms in the 1990s, he accurately sees through the state of security plugin installation that anyone who has used internet banking in Korea knows well, and even the point that this “security software” is actually fake and does nothing for security, yet the current situation has been deliberately designed because of vested interests.

It seems he found and reported several security vulnerabilities in security plugin products during his investigation, but he naturally understands that this alone cannot solve the real problem. In any case, following the convention of disclosing 90 days after reporting, the details of the vulnerabilities he found are said to be scheduled for disclosure on the author's blog on January 9, January 23, and March 6, 2023, respectively.

He also says he found the following software quality problems while looking for security vulnerabilities. Somehow, it is all rather familiar.

  • The developers who built these appear to be inexperienced with memory safety issues such as buffer overflows despite using the C language
  • Compiled with 15-year-old Visual Studio instead of modern compilers that provide various mitigation mechanisms
  • Despite supposedly being security programs, even old and basic security features such as ASLR and DEP are disabled
  • Use of old versions of open-source libraries (in some cases more than 10 years old)
  • In most cases, encryption appears to be used merely for obfuscation to hinder reverse engineering
  • Still using cryptographic algorithm parameters that were deprecated long ago

TouchEn nxKey vulnerability analysis

See TouchEn nxKey for details.

IPinside: South Korea's mandatory spyware

See IPinside for details.

Weakening TLS protection, South Korean style - Wladimir Palant

Summary:

  • Korean security programs install their own unaccredited certificate authorities on PCs to use TLS on local servers.
  • The private keys used by these certificate authorities should be well managed for security, but since there are no laws or external audits enforcing this, you have to trust that the companies that installed them keep them secure.
  • However, as seen in the previous post, it is doubtful how well the companies will maintain security.
  • If a private key leaks, many people in Korea could be exposed to the risk of website impersonation.
  • Presents safer methods and examples for installing your own certificate authority.

South Korea's banking security: Intermediate conclusions

Wladimir Palant's fourth post on Korean security software.

He reached a negative intermediate conclusion on whether Korea's security-related apps actually provide better security. He discusses why current Korean security software falls short across the following 5 topics.

  • Endpoint security
  • Keyboard security
  • IP address detection
  • Certificate-based login
  • Software distribution

Veraport: Korea's dysfunctional application management software

Review paper

See also

Favorite site

author Zer0 sitemap