腾讯玄武实验室安全动态推送
Tencent Xuanwu Lab Security Daily News
-
[ Android ] KINIBI TEE 的可信环境及相关漏洞与利用方法: https://www.synacktiv.com/posts/exploit/kinibi-tee-trusted-application-exploitation.html
-
[ Attack ] 详细介绍 DREAMCAST 复制保护是如何被击败的: http://fabiensanglard.net/dreamcast_hacking/
-
[ Attack ] 使用 C# 监控并窃取剪贴板内容: https://grumpy-sec.blogspot.com/2018/12/i-csharp-your-clipboard-contents.html
-
[ Browser ] V8 在数组反序列化时执行用户提供的 JavaScript 导致的越界写漏洞(CVE-2018-17480),可以实现远程代码执行: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17480
-
[ Malware ] 新型 Android 银行木马可绕过 PayPal 双因素认证窃取用户资金: https://www.welivesecurity.com/2018/12/11/android-trojan-steals-money-paypal-accounts-2fa/
-
[ MalwareAnalysis ] 针对家庭路由器和 SOHO 路由器的新型漏洞利用工具包 Novidade 被发现: https://blog.trendmicro.com/trendlabs-security-intelligence/new-exploit-kit-novidade-found-targeting-home-and-soho-routers/
-
[ MalwareAnalysis ] 继 DarthMiner 之后新发现的针对 Mac 的恶意软件分析: https://blog.malwarebytes.com/threat-analysis/2018/12/flurry-new-mac-malware-drops-december/
-
[ Pentest ] 高级 JavaScript 注入技术: https://brutelogic.com.br/blog/advanced-javascript-injections/
-
[ Popular Software ] Adobe Acrobat Reader DC Text Field Value 执行代码漏洞(CVE-2018-19716): https://www.talosintelligence.com/reports/TALOS-2018-0704/
-
[ Protocol ] ERNW White Paper 62 - RA GUARD EVASION REVISITED : https://static.ernw.de/whitepaper/ERNW_Whitepaper62_RA_Guard_Evasion_Revisited_v1.0.signed.pdf
-
[ SecurityAdvisory ] Microsoft 发布 2018 年 12 月 安全更新: https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/6c54acc6-2ed2-e811-a980-000d3a33a34d 致谢信息: https://portal.msrc.microsoft.com/en-us/security-guidance/acknowledgments
-
[ SecurityProduct ] Equifax 数据泄漏事件调查报告(PDF): https://oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf
-
[ SecurityProduct ] McAfee.TrueKey.Service 的多个漏洞披露(CVE-2018-6756、 CVE-2018-6755 、CVE-2018-6757),来自Project Zero : https://bugs.chromium.org/p/project-zero/issues/detail?id=1660
-
[ Vulnerability ] phpMyAdmin 发布严重漏洞补丁,修复了 LFI/CSRF/XSS 漏洞: https://thehackernews.com/2018/12/phpmyadmin-security-update.html
-
[ Vulnerability ] GNU/inetutils <= 1.9.4 telnet 客户端中的 0day 漏洞披露: https://hacker.house/releasez/expl0itz/inetutils-telnet.txt
-
[ Vulnerability ] 视频会议中的风险, WhatsApp ,来自 Project Zero : https://googleprojectzero.blogspot.com/2018/12/adventures-in-video-conferencing-part-3.html
-
[ Windows ] Microsoft 介绍为其控制台提供的新设置选项 : https://blogs.msdn.microsoft.com/commandline/2018/12/10/new-experimental-console-features/
-
[ Windows ] Microsoft 介绍如何启用 Windows Defender 的 Attack surface reduction 规则: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction
-
[ Browser ] 从逻辑上绕过浏览器的安全边界 : 1) https://speakerdeck.com/shhnjk/logically-bypassing-browser-security-boundaries 2) https://bugs.chromium.org/p/chromium/issues/detail?id=825258
-
-
[ SecurityAdvisory ] Firefox 64 安全漏洞修复详情: https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/
-