ICT for Myanmar in English

If you're using Azure API Management (APIM) services, you've likely seen this message: "Support for the single-tenant v1 (STv1) platform ends on 8/31/24. Migrate instances before that date to the new platform version (STv2) for continued support and access to new features." This announcement highlights the urgency of migrating to STv2. To ensure a smooth transition, it's crucial to analyze our architecture, understand technical constraints, explore possible approaches, and assess risks. Here’s a summarized guide on how I managed the migration using the VNET-injection method. My Case: APIM with Dedicated Public IP and Subnet Configuration: APIM with a dedicated public IP and a dedicated subnet. Assigned private IP with NAT in a controlled VNET. Need to maintain IP addresses and DNS. Issues: APIM migration requires a new public IP, new subnet with private IP, new DNS, and new NSG. APIM instances acquire IP addresses randomly, complicating existing firewall rules, NS...

I've upgraded my AKS nodes in Cluster last night. After upgraded both nodes, all my apps went down and all my internal load balancers was not able to access. Spending many hours in troubleshooting and ends up with the miserable findings of root caused. That's it.... The Resource Tagging used in my Cluster and it's resource has exceed more than 50 tags. Microsoft recommendation is to maintain the tags less than 20. After I've removed over 30 tags and refresh the nodes then only all my resources are back up online as well as the applications. Currently, the resource sync the tags with cluster are below, AKS Cluster itself Router Table Pubic IP Load Balancer Network Security Group Virtual Network AKS managed kubelet msi AKS managed addon msi Private DNS zone Private endpoint So, beware this when you have more than 50 tags on your AKS Cluster. Cheer!  Have a good day. (Be knowledgeable, pass it on then)

Staying Home? Get paid for surfing the web! You can earn some passive money by using below browser on your mobile phone, table and computer. Just try it during this globally impacted COVID-19 situation. https://cryptotabbrowser.com/landing/57/25117657 What you need to do is download the CryptoTab Browser in above link and use it as default browser on your gadegets then get paid. That's all. Thanks. Have fun!

TFTP server is sitting in subnet which can reach via global routing table and your network devices is configured OOB with vrf routing. You have no other ways to copy your files to your device except from TFTP server. What will you do then? 😊 Leaking vrf to global routing or vice versa?  The answer is ... configure terminal ip tftp source-interface (Your OOB interface IP) You’re done. Cheer!  Have a good day. (Be knowledgeable, pass it on then)

When you use External Block List for Malicious IP with your PaloAlto, you need API Key for your server to refresh the list whenever you update the content. The API key syntax for PAN OS 7 and 8 is different and it will take your time after you upgrade PAN OS. So here is the solution what I've tested. Syntax for 7 is https://<firewall IP>/api/?type=op&cmd=<request><system><external-list><refresh><name>Type your EBL Name Here</name></refresh></external-list></system></request>&key="API Key" Syntax for 8 is https://<firewall ip>/api/?type=op&cmd=<request><system><external-list><refresh><type><ip> <name>Type your EBL Name Here</name></ip> </type></refresh></external-list></system></request>&key="API Key" Have fun with PAN OS. Thanks. Have a good da...

Unlike other ransomware families, the WannaCry strain does not spread via infected e-mails or infected links. Instead, it takes advantage of a security hole in most Windows versions to automatically execute itself on the victim PC. According to various reports, this attack avenue has been developed by the National Security Agency (NSA) in the US as a cyber-weapon and it was leaked to the public earlier  in April along with other classified data allegedly stolen from the agency. Until now, a number of hospitals, telecom companies or gas and utilities plants have suffered massive disruptions caused by data being held at ransom. As this ongoing outbreak is affecting countless computer users around the world, we are actively working on a free decryption tool to help victims recover their information without paying the ransom. Make sure to follow us on Twitter and Facebook to be notified when it becomes available. Source : Bitdefender Thanks. Have a good day! (Be knowl...

Anyone of you having difficulty in troubleshooting MPLS as a beginner? I did some research and take notes for myself and now it is for you to do reference as well. MPLS troubleshooting can be divided into two main steps: 1) Verify routing information flow 2) Verify proper data flow - Routing information flow troubleshooting requires verification of end-to-end routing information propagation between CE routers. - Verification of the routing information flow should be done systematically, starting at the routing ingress CE and moving to the egress CE. - Verification of the data flow should be done systematically, starting at the data flow ingress CE and moving to the egress CE. There are three things to perform basic MPLS troubleshooting. They are, 1) Preliminary steps in MPLS VPN Troubleshooting: - Is CEF enabled? - Are labels for IGP routes generated and propagated? - Are large labeled packets propagated across the MPLS backbone (maximum transmission unit issues)? 2) Verify the routi...

The Dell SonicWall Threats Research team has received reports of a new Ransomware Trojan, Ryzerlo which encrypts the victim's files and leaves an email address to be contacted to unlock victim's files. Infection cycle: The Trojan comes across as Pokemon Go game with the icon Once the victim installs the executable, the trojan adds the some changes to the registry. The Trojan adds two autostart objects to enable startup after reboot: %APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\[numbers].exe (copy of original) It tries to connect to the C&C server and then t he trojan encrypts all the victims documents with extensions * .txt, * .rtf, * .doc, * .pdf, * .mht, * .docx, * .xls, * .xlsx, * .ppt, * .pptx, * .odt, * .jpg, *. png, * .csv, * .sql, * .mdb, * .sln, * .php, * .asp, * .aspx, * .html, * .xml, * .psd, * .htm, * .gif, * .png with .locked extension.  The trojan creates the following two files on the victim's desktop. One includ...

A set of 4 critical Android  vulnerabilities were recently published by  CheckPoint . Successful exploitation of any of these exploits can give the attacker root privileges on the affected device. It is possible for an attacker to construct a malicious app that triggers these exploits with no need for special privileges making these vulnerabilities extremely dangerous.  The vulnerabilities were found in the software drivers that accompany Qualcomm chipsets. Thereby any Android device using Qualcomm chipset is vulnerable, this counts to nearly 900 million smartphones and tablets. The report by CheckPoint goes into the finer details about the vulnerabilities but below is a high level description of the same: CVE-2016-2059 : The vulnerability is present in a kernel module introduced by Qualcomm called ipc_router that provides inter-process communication where it is possible to convert a regular socket (CLIENT_PORT) into a monitoring socket (CONTROL_PORT). CVE-201...

On January 12th 2016, Microsoft announced it will stop supporting older versions of Internet Explorer. It means from now on, Internet Explorer 10 and prior will not get security updates. However many people are still using older versions of Internet Explorer, and it has become a potential threat. In July 2016, Dell SonicWALL observed that: - 0.7% of firewalls reported use of Internet Explorer 5.x. - 60.6% of firewalls reported use of Internet Explorer 6.x. - 71.1% of firewalls reported use of Internet Explorer 7.x. - 22.4% of firewalls reported use of Internet Explorer 8.x. - 24.3% of firewalls reported use of Internet Explorer 9.x. - 31.5% of firewalls reported use of Internet Explorer 10.x. Unpatched Internet Explorer is insecure and can damage the system. So, we, ICT For Myanmar would like to urges all our customers to review their environment and stop using Internet Explorer 10 and prior. Source : Dell SonicWall Security Center Have a good time. ...

A remote, unauthenticated vulnerability exists in PHP. The vulnerability allows an attacker to execute arbitrary code on the web server. CVE-2016-4343 is assigned to this vulnerability. PHP is a server-side scripting language designed for web development but also used as a general-purpose programming language. PHP code may be embedded into HTML code, or it can be used in combination with various web template systems, web content management systems and web frameworks. A remote code execution vulnerability exists in PHP due to lack of proper sanitation when parsing TAR files. It fails to properly validate the values inside the headers found in the file. This allows a remote attacker to create malicious TAR files to cause the vulnerable server to execute code. The following versions of PHP are vulnerable: PHP prior to 5.5.36 PHP prior to 5.6.22 PHP prior to 7.0.7 If your device haven't patch to prevent this vulnerable, this is time to patch now. Source : Dell SonicWa...

Netscape Communications invented Secure Sockets Layer (SSL) protocol in 1994. It has been de facto standard for cryptographic protocol since then. Over the years the protocol has evolved (SSLv2.0 -> SSLv3.0 -> TLSv1.0 -> TLSv1.1 -> TLSv1.2) to increase security. Today, SSLv2.0 no longer provides a sufficiently high level of security. SSLv2.0 deficiencies include the following: Message authentication uses MD5. Most security-aware users have already moved away from any use of MD5. Handshake messages are not protected. This permits a man-in-the-middle to trick the client into picking a weaker cipher suite than it would normally choose. Message integrity and message encryption use the same key, which is a problem if the client and server negotiate a weak encryption algorithm. Sessions can be easily terminated. A man-in-the-middle can easily insert a TCP FIN to close the session, and the peer is unable to determine whether or not it was a legitimate end of the session. ...

ntpd is an implementation of Network Time Protocol which sets and maintains the system time of day synchronized with Internet standard time servers or any local references. Many major servers and devices come with inbuilt ntpd. NTP works with different variants like client/server, symmetric, and broadcast. Symmetric mode is used for time synchronization between the servers with authentication. It operates with two modes active and passive. Active mode packets are used when connection is already set. If connection is not set, passive mode packets are used to set up short passive connection for authentication. If packet which fails to authenticate is received, it responds with crypto-NAK packet. While processing incoming packets findpeer() function is called to see if packet is from existing peer. It returns pointer to peer structure or NULL depending upon whether peer is found or not. To check whether packet is crypto-NAK, valid_NAK() function is called. One of the parameters f...

Adobe Flash Player is vulnerable to a critical vulnerability. It is reported to be exploited in the wild. The following CVE identifier has been assigned to this vulenrability:   CVE-2016-4171 This vulnerability affects Flash Player versions running on Windows, Macintosh, Linux as well as Chrome OS. It is reported that any successful exploitabtion could cause a crash and potentially allow an attacker to take control of the affected system. Although, Adobe reports that the vulnerability is exploited on a limited but targeted basis in the wild. Adobe is aware of the this vulnerability and expected to release the patch as early as June 16.  It's time to patch you security devices and Adobe as well if you are not done yet. Source : SonicWall Security Center Have a good time. (Be knowledgeable, pass it on then)

A remote, unauthenticated vulnerability exists in Apache Struts. The vulnerability allows an attacker to execute arbitrary code on the server with the privileges of the user running the Java Web Container process (e.g. JBoss, Tomcat etc). CVE-2016-3081 is assigned to this vulnerability. Apache Struts is a MVC (model-view-controller) franework for building Java applications. It uses Java Servlet APIs to expose ActionServlet controller. Any requests coming from a client are sent to the controller in the form of 'actions'. These actions are outlined as a map in a configuration file. Accordingly, the corresponding method is invoked. An interface called ActionMapper is used to provide mapping between the request and the corresponding action. The default implemtation maps to DefaultActionMapper class. A remote code exection vulnerability exists in Apache Struts 2 framework due to lack of proper santization inside the constructor of DefaultActionMapper. It fails to properly valid...

The GD Graphics Library (libgd) is an open-source graphics software library for dynamically manipulating images. It can create many formats of image files including GIFs, JPEGs, PNGs, and WBMPs. GD is extensively used with PHP, where a modified version supporting additional features is included by default as of PHP 4.3 and may be used in PHP 5.3 as well. There is a heap buffer overflow vulnerability has been found in GD Library libgd 2.1.1 and prior. The vulnerability exists when a signed integer was claimed to store the size of chunked data, however, an unsigned integer was used for copying. When a negative integer was set to the size variable, the vulnerable codes will overwrite the heap buffer which may cause denial of service or remote code execution under the current user, which may be web application's privileges. This vulnerability is referred as  CVE-2016-3074 . So, it is time to patch you security devices with latest updates. Have a good time. (Be knowledgeable,...

Recent zero days discovered in Microsoft scripting engine and Adobe Flash player are being exploited in the wild. The Microsoft JScript and VBScript engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability" (CVE-2016-0189) Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors.(CVE-2016-4117) If you haven't patch your Security Devices, it is time to patch to prevent from these. Source : Dell SonicWall Security Center Have a good time. (Be knowledgeable, pass it on then)

About an year ago Microsoft announced the plan to retire Internet Explorer. The new browser, Microsoft Edge, is now the default browser in Windows 10. Edge has many security improvements. It does not support legacy technologies such as ActiveX and Browser Helper Objects. The new layout engine, EdgeHTML, is a fork of Trident (the layout engine of Internet Explorer) that has removed all legacy code of older versions of Internet Explorer. EdgeHTML is meant to be fully compatible with the WebKit (the layout engine used by Google Chrome). Does Edge outperform Internet Explorer form a security perspective? We tried to find some clues here. Since August 2015, Microsoft has released "Cumulative Security Update for Microsoft Edge" each month. Below is the number of total CVEs related to IE 11 and Edge in last 9 months: Below is the number of critical CVEs related to IE 11 and Edge in last 9 months: Over past years Microsoft has lost market share in web browser (source...

I was encounter below error message when I tried to install HP Comware simulator (H3C cloud Lab). "The virtualbox version is lower than the HCL needed." My PC was installed with Virtualbox Version 5.0.16 and it is latest when I am writing this post. Below is the resolve method to skip this error. You just open registry editor and go to HKEY_LOCAL_MACHINE>SOFTWARE>Oracle>Virtualbox . Then change the Data Value of Version and VersionExt to 4.2.18 and try to reinstall Simulator. You will see no more error while installing it. Do not forget to revert to correct version data value in registry value after Simulator installation done. Have a good time. (Be knowledgeable, pass it on then)

The Dell SonicWall Threats Research team has received reports of a new Ransomware Trojan, Jigsaw (named after the fictional character) which encrypts the system files and also deletes them if the payment is not made on time. Infection cycle: The Trojan poses as firefox with the following properties: The Trojan adds the following files to the filesystem: %APPDATA%\Roaming\Frfx\firefox.exe (copy of original) [Detected as  GAV: Jigsaw.A (Trojan) ] The Trojan creates the following key to the Windows registry to enable startup after reboot: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ""%APPDATA%\Roaming\Frfx\firefox.exe"" It displays the following iconic image and the message while encrypting the files: It starts countdown and threatens to delete the files mentioned each hour. The trojan finds the following files on the victim's machine and encrypts them: It copies the filenames before encrypting at the ...