NIPS V5.6R10 has five types of rules to detect DDoS attacks, local privilege elevation, information gathering, suspicious network behaviors, and network monitoring events, respectively. They are described as follows. 1. Information gathering Information gathering is the first step of network intrusion. Attackers use various methods to scan and probe target...
Blog
Relationship Between Security Concept and Security Assessment for Software Supply Chain
The three concepts, transparency of software supply chain, assessable capabilities of software supply chain security, and trusted software supply chain, are closely related to the ability of end users to conduct security checks and assessments for the software supply chain, including: 1. Basic assessment of software composition security Upstream and...
Exchange Server OWASSRF Vulnerability (CVE-2022-41080/CVE-2022-41082) Alert
Overview Recently, NSFOCUS CERT found that security teams overseas publicly disclosed the technical details of the exploit chain for Exchange Server vulnerabilities. An authenticated remote attacker exploits an Exchange Server privilege escalation vulnerability (CVE-2022-41080) to gain permission to execute PowerShell in the context of the system on an endpoint Outlook...
NTA Traffic Troubleshooting
Common Problems (1) Choose Monitor > Router, and find that no data is displayed or the router traffic data size is greatly different from that in the real situation.(2) The traffic of some region IP addresses is not monitored.(3) Before upgrading to NTA V4.5R90F02SP06, the router can monitor traffic data,...
Security Concept for Software Supply Chain (Part 3) – Building Trusted Software Supply Chain
A crop of multi-level upstream and downstream security problems makes software supply chain (SSC) security more complex. It is difficult to assess and control the security of the whole chain only depending on companies, but it is necessary to strengthen the security supervision of the supply chain products, provide companies...
Multiple Security Vulnerabilities in Linux Kernel
Overview On December 26, 2022, NSFOCUS CERT detected multiple security vulnerabilities in Linux Kernel released online, relevant users are requested to take protective measures as soon as possible. Linux Kernel Remote Code Execution Vulnerability (CVE-2022-47939): A remote code execution vulnerability exists in Linux Kernel SMB2_TREE_DISCONNECT command processing. Due to the...
