Overview On January 26, NSFOCUS CERT detected that the Qualys research team publicly disclosed a privilege escalation vulnerability (CVE-2021-4034) found in Polkit's pkexec, also known as PwnKit. The vulnerability is due to the inability of pkexec to properly process the call parameters, thereby executing the environment variable as a command....
Blog
APT Retrospection: FIN7 Uses Windows 11 Topics as Bait to Do Spear Phishing Attacks
Overview In July 2021, NSFOCUS Security Labs captured a number of phishing documents using windows 11 related topics as bait. These phishing documents show some ideas and techniques that are different from common phishing attacks. Through in-depth analysis, NSFOCUS Security Labs found that the phishing files are part of a large-scale spear...
SASE Popular Science Series – Understanding SD-WAN
SASE (Security Access Services Edge) is a SaaS service that integrates security and network (To learn about what the SASE is, read SASE, Born for Digital Age). It incorporates too many new concepts. To make it easier to understand, we decided to post the popular science series on SASE, which...
NSFOCUS Releases 2021 Global DDoS Attack Landscape Report
MILPITAS, Calif. – January 28, 2022 – NSFOCUS, a leader in holistic hybrid security solutions, today released the 2021 Global DDoS Attack Landscape, a joint report by working with Tencent, which found that DDoS attacks have entered terabit era with the largest DDoS traffic peaked at 2.4 Tbps (or 3.25 Tbps...
DDoS Attacks Have Entered Terabit Era
MILPITAS, Calif. – January 28, 2022 – NSFOCUS, a leader in holistic hybrid security solutions, today released the 2021 Global DDoS Attack Landscape, a joint report by working with Tencent, which found that DDoS attacks have entered the terabit era with the largest DDoS traffic peaked at 2.4 Tbps (or 3.25...
HTTP Stack Remote Code Execution Vulnerability (CVE-2022-21907) Alert
Overview On January 12, NSFOCUS CERT detected that Microsoft released a monthly security update, which fixed an HTTP protocol stack remote code execution vulnerability (CVE-2022-21907). A buffer overflow can occur due to a boundary error in the HTTP Trailer Support feature in the HTTP stack (HTTP.sys). An unauthenticated attacker can...
