Category Archives: Technology

TECNO to enter the LED back panelled smartphone trend with an RGB Spin

New Delhi, 29th July 2023– It’s almost been two weeks with brands revealing their upcoming phone flaunting LED light design patterns over social media. That has stirred quite a discussion around who’s doing better?TECNO too caught the attention of the consumers when it dropped its latest teaser for the POVA 5 Pro 5G donning a multi-coloured LED light back panel and is set to give a tough competition to Nothing Phone (2).

Even though the light design resembles to the Nothing Phone, TECNO has an advantage over here as, unlike Nothing’s single white LED light, POVA 5 Pro seems to support RGB colours at the back. As per the teasers circulated on the internet, the brand has named light design as Arc interface and the same offers multiple functionalities with respect to incoming calls, music, and more.

Earlier in June 2022, the company launched POVA 3 with a single RGB LED light strip at the back panel, which received much praise among users. Taking the innovation one step ahead, the company is ready to announce its POVA 5 Pro 5G with the Arc Interface multi-coloured back panel, expected to launch in August 2023 on Amazon.

TECNO is known for launching best-in-segment features at competitive pricing. Considering the disruptive pricing of its Phantom V Fold, making it the most affordable fold phone in India, it is expected that POVA 5 Pro 5G will be launched at an aggressive pricing too. Looking at the teasers, POVA 5 Pro 5G seems to be positioned towards fuelling the aspirations of GenZ and seeing the consistent innovation from TECNO, the smartphone likely feature some best-in-segment attributes coupled with a premium 3D textured design. The exact specs are not known as of now but considering the specs of the previous POVA series smartphone, it is expected that the phone will boast a powerful processor, a big battery, and fast charging speed.

Cloudflare DDoS report finds that HTTP DDoS attacks increased by 15% QoQ in Q2 2023

India, 21st July 2023: Every quarter, cybersecurity and internet infrastructure company Cloudflare shares data and insights on the DDoS attack trends observed across their network, with insights on the size and volume of attacks, the industries seeing the most attacks, and emerging threats. This quarter as well, Cloudflare has released the findings of its DDoS report for Q2 2023.

Cloudflare mitigated the largest attack in recorded history peaking at 71 million rps. For the past two quarters, the Gaming and Gambling industry was the most targeted industry in Asia. In Q2, however, the Gaming and Gambling industry dropped to second place and Cryptocurrency took the lead as the most attacked industry (~50%). Substantial portions of the attack traffic originated from Asia itself (30%) and North America (30%).

Some notable findings for Q2 2023 include:

• Attacks targeting cryptocurrency companies increased by 600%, as a broader 15% increase in HTTP DDoS attacks was observed. Of these, Cloudflare noticed an alarming escalation in attack sophistication which we will cover more in depth. After Crypto, Gaming and Gambling websites came in second place as their attack share increased by 19% QoQ. Marketing and Advertising websites not far behind in third place with little change in their share of attacks.
• An increase in deliberately engineered and targeted DNS attacks alongside a 532% surge in DDoS attacks exploiting the Mitel vulnerability (CVE-2022-26143). Cloudflare contributed to disclosing this zero-day vulnerability last year.
• Over the past quarter, HTTP DDoS attacks increased by 15% quarter-over-quarter (QoQ) despite a 35% decrease year-over-year (YoY). Additionally, network-layer DDoS attacks decreased this quarter by approximately 14%.
• Over the past quarter, the most common attack vector was DNS-based DDoS attacks — 32% of all DDoS attacks were over the DNS protocol. Amongst these, one of the more concerning attack types we’ve seen increasing is the DNS Laundering attack which can pose severe challenges to organizations that operate their own authoritative DNS servers.
• Cloudflare protects more than 2,271 Non-profit organizations in 111 countries as part of Project Galileo which celebrated its ninth anniversary this year. Over the past months, an average of 67.7 million cyber attacks targeted Non-profits on a daily basis.

Additionally, one of the largest attacks Cloudflare has seen this quarter was an ACK flood DDoS attack which originated from a Mirai-variant botnet comprising approximately 11K IP addresses. The attack targeted an American Internet Service Provider. It peaked at 1.4 terabit per seconds (Tbps) and was automatically detected and mitigated by Cloudflare’s systems. Despite general figures indicating an increase in overall attack durations, most of the attacks are short-lived and so was this one. This attack lasted only two minutes. However, more broadly, we’ve seen that attacks exceeding 3 hours have increased by 103% QoQ.

Dive into the full report here and let us know if you’d like to speak to a spokesperson about the most recent findings.

ManageEngine Site24x7 Unveils OpenAI Observability Integration for Enhanced Performance Monitoring

India — July 18, 2023 — ManageEngine, the enterprise IT management division of Zoho Corporation, today announced that it has newly added OpenAI observability as a native capability to Site24x7, its comprehensive cloud-based observability platform. The offering enables application owners to monitor the utilization of different OpenAI models seamlessly while tracking real-time performance and cost metrics — all within a unified view. This powerful capability empowers businesses to leverage the potential of emerging AI technologies, such as OpenAI’sChatGPT, to drive innovation and achieve their strategic objectives while being cost-conscious.
As organizations increasingly embrace OpenAI’s latest generative AI model and explore the potential of ChatGPT across multiple teams, gaining a comprehensive understanding of user interactions with GPT-powered applications becomes crucial. This understanding enables the identification of valuable opportunities to optimize models and enhance user experiences. Additionally, closely monitoring API usage and token consumption becomes essential to managing costs and enhancing overall application performance.
“As the demand for OpenAI’s GPT-4 model continues to soar, companies are compelled to reimagine and revamp their existing service landscapes to enhance the user experience,” said Srinivasa Raghavan, director of product management for Site24x7. “Observability emerges as a transformative force, empowering companies to get the most out of GPT. Our commitment to enabling organizations using GPT APIs is reflected in our efforts to provide effortless setup, cost and performance monitoring. We aim to ensure that efficiency and effectiveness remain at the forefront of our AI-driven IT operations management solution.”
The Site24x7 OpenAI Observability module automatically tracks and analyzes various metrics related to OpenAI usage, such as token usage, latency and errors. It is easy to integrate in applications that use OpenAI modules and leverage the platform’s built-in alerting system to take quick actions on malfunctions.

Unleashing the Power of AI: Insights from Industry Titans on AI Appreciation Day

AI has become a powerful tool that has the potential to shape various aspects of our lives. It’s essential to acknowledge the myriad of benefits that AI brings to our world. From enhancing efficiency & automation to fueling breakthrough innovations & delivering personalized experiences, AI is transforming industries & revolutionizing the way we live & work. With the ongoing efforts taken by industry veterans like Google, IBM, Microsoft, we can expect even greater advancements, unlocking new possibilities & shaping a brighter future powered by AI.

On AI Appreciation Day, below are the expert opinions on the importance of trust in AI and the steps needed to establish it. In this story, we present their insightful perspectives and strategies for fostering trust in the age of AI.

AI to reshape & revolutionize lives – Sangeet Kumar, CEO & Co-Founder, Addverb. “AI continues to shape and revolutionize our lives in unimaginable ways, spanning across various industries such as healthcare, transportation, finance, and entertainment. As we celebrate the remarkable advancements in artificial intelligence, we recognize its transformative impact on supply chain and warehouse automation. At Addverb, we have implemented AI through our robots and automation system, to transform traditional warehouses into autonomous distribution centres, by optimising different aspects like storage, picking, sorting, and shipping of goods. Convergence of AI and human expertise creates a powerful synergy, resulting in lower operational costs, higher productivity & accuracy and also enhancing worker safety.”

Ensuring AI Security and Protection – Ritesh Chopra, Director Sales and Field Marketing, India & SAARC Countries, Norton. “AI can be both a method for carrying out cyberattacks as well as a way to protect against them. With the expansion of tools such as ChatGPT, attackers can more easily generate human-like text to carry out their social engineering attacks, which rely on tricking someone into giving up confidential information. By playing on people’s emotions and natural tendency to trust, social engineers are able to manipulate people into divulging sensitive information like passwords and bank account details. With ever-growing frequency and sophistication of attacks, it grows harder for people to distinguish between legitimate and malicious communications. At Norton, we are innovating to help protect people from these ever-evolving threats, both through our products and services as well as by educating people about scams.”

Transformative Impact of AI in Talent Acquisition – Lokesh Nigam, Co-founder and Director, Kognoz. “Artificial intelligence is an expansive field with profound implications, especially in human resource management. HR departments increasingly rely on AI to inform decisions related to hiring, employee development, and retention. On this AI Appreciation Day, Kognoz celebrates the transformative impact of AI in talent acquisition. By harnessing cutting-edge conversational intelligence, we have revolutionized traditional hiring methods. Our platform empowers client companies, delivering unmatched efficiency, cost savings, and a competitive advantage. With advanced AI capabilities, we provide a leading-edge solution that optimizes the hiring process and outperforms competitors. Let’s honor the incredible potential of AI to revolutionize talent acquisition and unlock boundless opportunities for organizations worldwide.”

Building trust in AI is a collective effort involving industry leaders, researchers, policymakers, and individuals. By prioritizing security, ethical practices, user empowerment, collaborative standards, and education, we can establish a foundation of trust in AI. As we celebrate AI Appreciation Day, let us embrace these expert insights and work towards a future where AI technologies serve as trustworthy and reliable companions in our daily lives.

Tezos India launches 3rd edition of TezAsia Hackathon to uplift and nurture blockchain talent in India

New Delhi, July 14, 2023: Tezos India, a leading blockchain adoption entity announced today the launch of the much awaited TezAsia Hackathon 3.0. The third edition of Asia’s most popular hackathon will commence on July 16th, 2023, and embark on a month-long exciting journey of collaboration and innovation by the brightest minds in the Indian blockchain space. This transformative initiative aims to amplify Web3 development and facilitate broader access to the Tezos blockchain platform throughout the Asia-Pacific region. Tezos India aims to leverage the power of India’s demographic transition to make India the blockchain capital of the world.

The TEZASIA hackathon revolves around two main concepts: ‘Small but great’ and ‘Disrupt all the things’. These concepts cover a wide range of topics, including NFTs, Defi, and more. The ‘Small but great’ theme is designed for individuals who are new to blockchain development. It allows them to showcase their abilities by creating a simple DApp using the Tezos technology stack. On the other hand, the ‘Disrupt all the things’ theme invites teams with innovative visions to present a proof of concept or a minimum viable product for their Web3 product. To enhance their chances of winning in each category, participants can explore a comprehensive list of ideas available on the platform.

Commenting on the development, Om Malviya, President of Tezos India, said “Tezos India has been highly successful in implementing strategies to boost blockchain adoption in India and South East Asia to some extent. We have created the first layer of adoption through various initiatives over the years and the time has come to leverage the platform to engage the large blockchain community in India and across Asia to accelerate into the next phase of the blockchain revolution. It’s time to build products and services on blockchain for the masses to make Web3 a part of people’s daily lives”.

TezAsia is a carefully crafted innovation hub that creates a level playing field for all the participants through customized workshops on problem-solving, extensive training for using Tezos tools to build groundbreaking applications (Dapps), and explore the Tezos Universe to gain Web3 wisdom to enter the world of endless possibilities and opportunities offered by Web3/Blockchain. TezAsia hackathon has no entry barriers and is open to all i.e. college students, developers, working professionals, coders, and blockchain enthusiasts.

Registrations are now open, and interested participants can find detailed information and register for the hackathon through the official microsite at https://bit.ly/TezAsia-TezosIndia. 

Annexure l

Hackathon Schedule 

Akamai Charts Course for the Next Decade of Cloud Computing with New Sites, Services, and Capabilities

Bengaluru, India — July 14, 2023 — Akamai Technologies (NASDAQ: AKAM), the cloud company that powers and protects life online, today opened the doors on three cloud computing sites that bring to life the company’s vision for a new kind of cloud designed to meet the needs of modern applications that require higher performance, lower-latency, and true global scalability current cloud architectures were not built to provide.

The new sites mark the first major step in Akamai’s push to put compute, storage, database, and other services on top of the same underlying backbone that powers its edge network today — a massively distributed footprint spanning more than 4,200 locations across 134 countries.

“Distributed workloads require distributed infrastructure,” said Adam Karon, chief operating officer and general manager, Cloud Technology Group, Akamai Technologies. “Legacy, centralized cloud architecture was not designed for the demands of developers and companies challenged with delivering better user experiences that increasingly require putting applications and data closer to the customer.”

Akamai is taking a fundamentally new approach to cloud computing that shifts how developers and companies build, deploy, and secure applications and data across the entire continuum of computing from core to edge. For the rollout of the new sites, Akamai reimagined conventional data center design principles. In addition to scaling its core cloud computing services, Akamai also used its vast content delivery experience to connect each site to the company’s massive global backbone. In doing so, Akamai brings the simplicity, affordability, and accessibility of its Linode-based cloud computing services to larger commercial customers on an architecture built for the next decade, not the last.

Five New Sites

Strategically located in Paris, Washington, D.C., and Chicago, with Seattle and Chennai, India opening later this quarter, Akamai’s new sites feature a new architecture design and hardware configuration to enable high-performance, scalable cloud resources for commercial users on the Akamai global network.

Akamai’s new site in Washington, D.C., puts a stake in the ground in what is often considered the data center hub of the world. Northern Virginia contains more than half of the total primary data center market inventory in the United States.
The company’s new Chicago site gives Akamai customers access to cloud computing services in the fifth top data center market in the world. It’s an attractive replication option for latency-sensitive, multicloud workloads running in Philadelphia and Washington.
Akamai’s presence in Seattle gives the company access to a growing community of developer and startup customers. Seattle is the eighth-largest market in the U.S. and has become a major data center hub for companies in the Pacific Northwest.
Its new Paris site positions Akamai to help companies in the European Union address growing data sovereignty challenges. Paris has the highest density data center capacity in Europe.
Akamai’s new site in Chennai will give the company greater access to one of the largest IT hubs in India. In an April 2023 survey of its partners, Akamai found that 48% of respondents in India estimated that between 21-40% of IT budgets would be spent on cloud.

“Next generation applications demand cloud infrastructure that provides dramatically lower latency and better egress than what’s currently possible from today’s legacy cloud providers,” said Karon. “What we’re building is designed for that new world. We have a unique advantage of seeing the cloud from a different perspective than most given the nature of our business and customer base. And the feedback we increasingly hear, not only from our own customers but our competitors’ customers, is that our edge-in vision solves many of the scale and portability challenges they face with the current centralized cloud options available to them.”

New Premium Instances

The company also announced new premium instances that deliver consistent performance, predictable resource and budget allocation, and simpler SKU management for larger commercial workloads. The new instance types guarantee assignment to the best performing processor and hardware combination available. They can also make it easier to manage multiple deployments and upgrades without complicated SKU matching which can often see in excess of 100,000 changes a month across the top three legacy hyperscale providers. The new premium service, available across each of the company’s newly launched sites, adds to Akamai’s existing shared and dedicated offerings.

Doubling Object Storage Capacity

Additionally, Akamai announced it doubled the capacity of its object storage product to one petabyte and one billion objects per bucket. The upgrade allows businesses to access higher data volumes to build scalable, performant, and low-latency cloud-native applications and analytics solutions. Clusters with the increased limits will be available in the new sites announced today.

New Global Load Balancer

Lastly, the company announced plans to launch Akamai Global Load Balancer later this quarter, the first of several planned integrated services following Akamai’s acquisition of Linode. The new global load balancing capabilities ensure no single point of failure, routing traffic requests to the optimal data center to minimize latency.

Akamai Global Load Balancer bridges existing functionality of Linode NodeBalancers for local traffic load balancing, with existing Akamai Global Traffic Manager and Application Load Balancer services. The resulting integration allows customers to select between local and global load balancing across Akamai’s network and rapidly expanding number of sites. The introduction of Akamai Global Load Balancer is a critical component of Akamai’s connected cloud vision.

The new cloud computing sites and capabilities are part of Akamai Connected Cloud, a massively distributed edge and cloud platform for cloud computing, security, and content delivery that keeps applications and experiences closer and threats farther away. Announced in February, Akamai Connected Cloud builds on 25 years of experience scaling and securing the internet for the biggest companies in the world.

More information about Akamai Connected Cloud and Akamai Cloud Computing Services is available on the Akamai website.

Five ways to ensure digital platform security and avoid data breaches in 2023

It’s more important than ever to prioritise the security of digital systems, software and applications. Not only do robust online security systems protect personal privacy, but they also prevent financial losses, safeguard intellectual property, and help businesses comply with their legal obligations.

Data breaches can also severely damage an organisation’s reputation. When customer data is compromised, the company’s ability to protect its users’ sensitive information is doubted. This loss of trust can lead to a decline in customer loyalty, a decrease in sales, and ultimately, a significant negative impact on the business’s long-term viability.

The risk is exacerbated in companies that underinvest in cybersecurity, like the arts, entertainment and recreation sector which should spend seven times as much on IT as it currently does.

Fortunately, there are measures that businesses of all sizes, across all industries, can take to reduce these risks and ensure their digital platforms are safe and secure in 2023.

Jose San Miguel, Managing Director at white-label ticketing platform Nuweb Group comments: “Organisations must invest in robust cybersecurity measures, implement best practices, and stay vigilant to counter the evolving threats in the digital landscape.

“With the rapid adoption of cloud, remote work, SaaS apps, and distributed systems, the security landscape has expanded significantly. Every new system, network, and application creates potential vulnerabilities for attackers to exploit.

“From DDos attacks to credential stuffing, these threats highlight the need for companies to implement multi-layered security measures, conduct regular security assessments, and stay informed about the latest cybersecurity trends and best practices.”

Here are five ways businesses can ensure digital platform security and avoid data breaches in 2023:

1. Implement 2-factor authentication (2FA): 

Implementing 2-factor authentication provides your platform with an additional layer of security beyond just a username and password combination. By requiring multiple factors of authentication, for example biometric data, the likelihood of unauthorised access significantly reduces. This means that even if the initial security factor is bypassed, the attacker would still have other authentication factors to deal with.

2. Regularly update and patch systems: 

You should strive to stay up-to-date with the latest security patches and updates relevant to your platform’s operating systems, software, and applications, because many of these updates tend to identify and address vulnerabilities that can be exploited by attackers. The updates and patches can also fix software bugs and improve system stability. By regularly updating, organisations can ensure that their systems are running efficiently and therefore providing a better user experience.

3. Conduct regular security audits and penetration testing: 

You should perform regular security audits and penetration testing to help identify vulnerabilities and weaknesses in your systems, applications, and network infrastructure. This process involves actively testing your system’s security measures to discover potential weaknesses before they’re exploited. Any vulnerabilities that are identified should then be addressed promptly.

4. Encrypt sensitive data: 

By implementing robust encryption mechanisms to protect sensitive data, you can make it harder for perpetrators to access your organisation’s information. Encryption ensures that sensitive data remains confidential and accessible only to authorised parties. It transforms the data into an unreadable format that can only be decrypted with the right decryption key. This helps protect against unauthorised access, whether it’s due to data breaches, insider threats, or physical theft.

5. Employee education and awareness: 

Businesses should train employees on best practices for data security and raise awareness about potential threats such as phishing attacks. Try to encourage strong password practices, help your staff be able to recognise suspicious emails or links, and emphasise the importance of safeguarding sensitive information. Accreditations like CISSP and ISO 9001 in the UK can help with this.

Patch Tuesday – M. Walters, VP of Vulnerability and Threat Research at Action1, comments

This Patch Tuesday, Microsoft has released a significant number of updates, addressing a total of 142 vulnerabilities. This includes 132 new fixes and updates for 10 previously addressed issues, resulting in a record-breaking number of fixes for the year. Among these, there are nine critical vulnerabilities that have been resolved, along with an update for an older critical vulnerability. This month’s updates also cover six zero-day vulnerabilities, with one of them publicly disclosed, and an update for a previously patched zero-day. Additionally, one older vulnerability now has a Proof of Concept (PoC) available.

Now, let’s dive into the details of the most noteworthy critical updates.

Office and Windows HTML Remote Code Execution Vulnerability

Office and Windows HTML Remote Code Execution Vulnerability (CVE-2023-36884) is an important zero-day vulnerability that impacts Office and Windows HTML. It possesses a network attack vector with high complexity, requiring user interaction but not elevated privileges. With a CVSS rating of 8.3, it is categorized as important, although it could potentially warrant an even higher severity if executed with user interaction and complexity. The vulnerability affects all versions of Windows Server from 2008 onwards, Windows 10, as well as Microsoft Word and Microsoft Office versions 2013 and later.

Exploiting this vulnerability entails an attacker creating a specially crafted Microsoft Office document capable of executing remote code in the victim’s context. However, it is important to note that convincing the victim to open the malicious file is a prerequisite for a successful attack.

Microsoft has outlined certain mitigation steps to address this issue. Within existing attack chains, implementing the “Block all Office applications from creating child processes” attack surface reduction rule can thwart the exploitation of this vulnerability. For organizations unable to leverage this protection, an alternative approach involves configuring the FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION registry key to prevent exploitation. It is worth noting that while these registry settings can mitigate the vulnerability’s exploitation, they may impact normal functionality in certain use cases associated with these applications. To implement this approach, add the application names listed as values of type REG_DWORD with data 1 to the registry key.

Given Microsoft’s confirmation of active exploitation and the absence of available workarounds, it is crucial to prioritize updating systems to address this vulnerability promptly.

Microsoft Outlook Security Feature Bypass Vulnerability

Microsoft Outlook Security Feature Bypass Vulnerability (CVE-2023-35311) is another important zero-day vulnerability impacting Microsoft Outlook. It utilizes a network attack vector with low attack complexity, requiring user interaction but not elevated privileges. With a CVSS rating of 8.8, it is considered a significant vulnerability, although its severity could have been higher if user interaction was not required. It’s important to note that this vulnerability specifically allows bypassing Microsoft Outlook security features and does not enable remote code execution or privilege escalation. Therefore, attackers are likely to combine it with other exploits for a comprehensive attack. The vulnerability affects all versions of Microsoft Outlook from 2013 onwards.

To compromise a user, the attacker would need the user to click on a specially crafted URL. Notably, the attacker can bypass the Microsoft Outlook security prompt even in preview mode.

Given that this vulnerability is already being exploited and can be used in conjunction with other exploits, it is strongly recommended to apply the available update promptly.

Windows Error Reporting Service Elevation of Privilege Vulnerability

Windows Error Reporting Service Elevation of Privilege Vulnerability (CVE-2023-36874) is an important zero-day vulnerability that impacts the Windows Error Reporting Service. It can be exploited locally with low complexity and without requiring elevated privileges or user interaction. The vulnerability has a CVSS rating of 7.8, indicating its severity. However, it should be noted that this rating would be even higher if the vulnerability allowed remote attacks without requiring elevated privileges.

To exploit this vulnerability, an attacker needs to gain access to the system using other exploits or harvested credentials. The compromised user account must have the ability to create folders and performance traces on the computer, which is typically available to normal users by default. This vulnerability affects all versions of Microsoft Windows Server from 2008 onwards, as well as Windows 10 and later versions.

Successful exploitation of this vulnerability could grant the attacker administrative privileges, enabling them to escalate their privileges and perform various malicious actions.

Due to the ongoing exploitation of this vulnerability and its potential combination with other exploits, it is highly recommended to apply the available update as soon as possible.

Windows MSHTML Platform Elevation of Privilege Vulnerability

Windows MSHTML Platform Elevation of Privilege Vulnerability (CVE-2023-32046) is a critical zero-day security concern affecting the MSHTML platform in Windows. This vulnerability possesses a local attack vector with a low complexity of attack and does not require elevated privileges. However, user interaction is necessary for exploitation. It has received a CVSS rating of 7.8, indicating its severity. Note that the rating would have been higher if the vulnerability allowed remote attacks without requiring user interaction.

To exploit this vulnerability, a user must open a specifically crafted file. In an email attack scenario, an attacker may send the manipulated file to the user and deceive them into opening it. Similarly, in a web-based attack scenario, the attacker may host a website containing the specially crafted file intended to exploit the vulnerability.

It is crucial to understand that the attacker cannot compel users to visit the malicious website. Instead, they must convince users to click on a link, typically through enticing email messages or instant messages, and then persuade them to open the specifically crafted file.

It is important to note that the attacker would only acquire the rights of the user running the affected application. Therefore, if a user does not possess administrative rights on the computer, neither does the attacker.
Considering that this vulnerability is actively being exploited and has the potential to be combined with other exploits, it is strongly advised to promptly apply the available update.

Source: https://www.action1.com/patch-tuesday-july-2023/?vyj

Oxeye AppSec Platform Automatically Discovers Owncast & EaseProbe Security Vulnerabilities

Company Provides Recommended Remediation for Server-Side

Request Forgery (SSRF) and SQL-Server Injection Vulnerabilities

TEL AVIV – July 12, 2023 – Oxeye, the provider of an award-winning cloud-native application security platform, has uncovered two critical security vulnerabilities and is recommending immediate action be taken to mitigate risk. The vulnerabilities were discovered by the Oxeye AppSec Platform in Owncast (CVE-2023-3188) and EaseProbe (CVE-2023-33967), two open-source platforms written in Go.

The Oxeye AppSec Platform combines the functions of SAST, DAST and SCA into one tool to filter out vulnerabilities that cannot be exploited in modern distributed applications. Oxeye identifies all vulnerabilities, including those that cross microservices, then help AppSec & dev teams focus on critical vulnerabilities by finding and determining which vulnerable open source and third-party packages are loaded and used and filtering out those that are not; filtering vulnerabilities that cannot be accessed from the Internet (directly or indirectly); Refining further by adding infrastructure configuration data, and performing active validation by fuzzing the exploitable APIs.

Owncast Vulnerability

The first vulnerability was discovered in Owncast, an open-source, self-hosted, decentralized, single-user live video streaming and chat server written in Go. The vulnerability, labeled as an Unauthenticated Blind Server-Side Request Forgery (SSRF), could potentially allow unauthenticated attackers to exploit the Owncast server by forcing the Owncast server to send HTTP requests to arbitrary locations using the GET HTTP method. This vulnerability also allows the attacker to send the requests while specifying arbitrary URL paths and query parameters. The Owncast vulnerability has a high CNA CVSS severity rating of 8.3/10 and was identified during an extensive analysis conducted by Oxeye Security’s in-house custom SAST (Static Application Security Testing) solution for compiled Golang applications.

Upon examination, the security researchers at Oxeye Security determined that the Owncast server is susceptible to an unauthenticated SSRF attack, enabling malicious actors to force the server to send HTTP requests to arbitrary locations using the GET HTTP method. Additionally, attackers can manipulate the requests by specifying arbitrary URL paths and query parameters.

The vulnerable code resides within the GetWebfingerLinks function of Owncast, specifically in the following location: https://github.com/owncast/owncast/commit/f40135dbf28093864482f9662c23e478ea192b16 . As per the code analysis, user-controlled input passed through the “account” parameter is parsed as a URL, and subsequently, an HTTP request is issued to the specified host on line 32.

To address this critical SSRF vulnerability, Oxeye Security recommends the following remediation steps:

– Prohibit the HTTP client utilized by Owncast from following HTTP redirections to mitigate the potential exploitation of SSRF attacks.

– Implement restrictions to allow only authenticated users to trigger the vulnerable endpoint, thereby minimizing the risk of unauthorized access.

Oxeye Security has been proactive in reaching out to the Owncast development team and providing them with detailed information regarding the vulnerability and recommended remediation steps. Together with Owncast, Oxeye Security aims to ensure the prompt resolution of this security issue to safeguard the Owncast community and its users.

EaseProbe Vulnerability

Oxeye has also recently discovered multiple SQL-injection vulnerabilities in EaseProbe, a lightweight and standalone health/status checking tool written in Go. The vulnerabilities, categorized as Config-Based SQL-Injection, expose potential security risks for users of EaseProbe with a Critical NIST CVSS Security Score of 9.8/10. The vulnerable code is located in the MySQL / Postgres database client code:

· https://github.com/megaease/easeprobe/blob/main/probe/client/mysql/mysql.go#L174

· https://github.com/megaease/easeprobe/blob/main/probe/client/postgres/postgres.go#L203

During an extensive evaluation utilizing Oxeye Security’s in-house custom SAST (Static Application Security Testing) solution for compiled Golang applications, the security researchers identified significant vulnerabilities in EaseProbe. These vulnerabilities can be exploited by attackers who have control over the EaseProbe configuration, enabling them to read, delete, or modify all information stored in the databases configured for health checking. In certain circumstances, depending on the user privileges and the database engine, the attacker may also execute arbitrary system commands on the server hosting the database. The vulnerable code is located within the MySQL and Postgres database client code of EaseProbe.

By analyzing the EaseProbe configuration file, Oxeye Security demonstrated a practical exploitation scenario on a Postgres database. The attacker injects a malicious command “ls” to execute arbitrary system commands. The vulnerable database query is unsafely formatted with user-provided data, leading to the successful execution of the injected command.

To mitigate the risks associated with SQL-injection attacks, Oxeye Security recommends the following remediation measures:

– Properly sanitize all user input to prevent SQL-injection vulnerabilities. This can be achieved by implementing techniques such as prepared statements and parameterized queries, which treat user-provided input as values instead of executable code. If injection occurs in a query part that cannot be parameterized, strictly validate user input, considering the use of regular expressions or other appropriate methods.

– Ensure the application is regularly updated and patched to address any known vulnerabilities, as this can effectively mitigate the risk of exploitation.

Oxeye Security has taken immediate action by notifying the developers of EaseProbe about the discovered vulnerabilities. By collaborating with the EaseProbe team, Oxeye Security aims to expedite the resolution of these security issues to protect EaseProbe users from potential threats. Note: This problem has been fixed in EaseProbe v2.1.0.

If interested in learning more about how Oxeye can assist with cloud-native application security challenges, please visit https://www.oxeye.io/contact to contact us.