腾讯玄武实验室安全动态推送
Tencent Xuanwu Lab Security Daily News
-
[ Android ] Austrian Mobile Phone Signature is vulnerable against phishing and MitM attack http://robert.penz.name/1224/austrian-mobile-phone-signature-is-vulnerable-against-phishing-and-mitm-attack/
"奥地利的 Mobile Phone Signature 受网络钓鱼和中间人攻击影响, 而 Mobile Phone Signature 是一种 Web 身份证明机制: https://t.co/jv2GtJnI13"
-
[ Android ] Chip chomped as dev's debug backdoor found in Android phones http://www.theregister.co.uk/2016/02/02/chip_chomped_as_devs_debug_backdoor_found_in_android_phones
"MediaTek 生产的 MT6582 芯片被发现留有一个调试特性,允许攻击者以 ROOT 权限访问, 这个开发调试后门影响联想、华为等厂商的 Android 设备, 来自 TheRegister 报道: https://t.co/80tyUSAoRa"
-
[ Android ] Here are the goods on the Android WiFi kernel RCEs (CVE-2016-0801/0802), from the msm.git: http://pastebin.com/7g2tPJeb (/cc @ newshtwit)
"Android WiFi RCE(CVE-2016-0801/0802) Patch 的 Git 提交日志, 来自 Pastebin: https://t.co/CoHPCNEb92 "
-
[ Attack ] URLZone Back, Targeting Banks in Japan: https://threatpost.com/urlzone-back-targeting-banks-in-japan/116107/ via @ threatpost
"URLZone 组织向日本银行发起攻击活动, IBM X-Force 文章提到, 在 Shifu 组织攻击日本之前,多年内都没有其他组织攻击过日本,分析一部分原因是来自日本语言的障碍。而在 Shifu 攻击之后,各大组织纷纷来袭,都想分一杯羹。而且各个组织的攻击手法都模仿 Shifu。 来自 ThreatPost 的报道: https://t.co/BoFtGn3zb9 IBM X-Force 的原文: https://securityintelligence.com/organized-cybercrime-big-in-japan-urlzone-now-on-the-scene/ "
-
[ Attack ] Where will #cyber criminals strike in 2016? Read our predictions http://bddy.me/1QX2LOa https://t.co/GAyxWVVnON
"FireEye 展望 2016 安全形势预测报告: https://t.co/3enMqxHZxW https://t.co/GAyxWVVnON"
-
[ Debug ] uni-trace - Universal Trace Debugger Engine. Based on pykd. https://github.com/Baoqi/uni-trace
"uni-trace - 一个通用的调试器 Trace 工具,作为 Windbg 扩展存在, 基于 pykd,目前仅支持 Windbg, Github Repo: https://t.co/DmeiVbB569"
-
[ Defend ] Thoughts on Intel's upcoming Software Guard Extensions (Part 2) : http://blog.invisiblethings.org/2013/09/23/thoughts-on-intels-upcoming-software.html cc: @ rootkovska
"对 Intel SGX 保护机制的一些思考, 作者为 Joanna Rutkowska, 这篇 Blog 写于 2013 年, Part 2: https://t.co/NvJrRA4lh3 Part 1: http://theinvisiblethings.blogspot.com/2013/08/thoughts-on-intels-upcoming-software.html "
-
[ Forensics ] IR_Tool : A simple BASH script for digital forensic on Linux/UNIX system : https://github.com/pwnagentsmith/IR_Tool
"IR_Tool - 用于 Linux/UNIX 系统数字取证的一个 BASH 脚本, Github Repo: https://t.co/xz0GAxqvMI"
-
[ Hardware ] Checkout our paper published by the IEEE HPEC! DRAM Memory Failures http://www.ddrdetective.com/files/6014/5436/0253/DDR_Memory_Errors_caused_by_Row_Hammer.pdf
"RowHammer 引起的 DDR 内存错误, 来自 IEEE HPEC Paper: https://t.co/xbUW9Wk5nd"
-
[ iOS ] Frida 6.2 is out with massive performance improvements, iOS 9 fixes and a new API for finding functions http://www.frida.re/news/2016/02/01/frida-6-2-released/
"Frida 6.2 发布, 性能大大提高, 增加了一个用于查找函数的新 API, 另外在 iOS 9 上的稳定性也有所提高,详细的更新说明: https://t.co/8nONVSaRL4"
-
[ IoTDevice ] Reverse engineering an IP camera : http://www.contextis.com/resources/blog/push-hack-reverse-engineering-ip-camera/
"Motorola Focus 73 室外监控摄像头的逆向和攻击, 不接触局域网, 实现盗取 WiFi 密码、视频信号劫持、告警劫持。 来自 Context Blog: https://t.co/I1hRi3WzjE"
-
[ Linux ] Injecting code into running process with linux-inject : https://lkubuntu.wordpress.com/2016/01/31/injecting-code-into-running-process-with-linux-inject/
"Linux-inject - 向正在运行的进程注入代码, 来自 lkubuntu Blog: https://t.co/wldqHFMyyJ"
-
[ MalwareAnalysis ] A Soft-ish Introduction to Malware Analysis for Incident Responders - http://www.redblue.team/2016/02/a-soft-introduction-to-malware-analysis.html
"为应急响应的同学写的一篇恶意软件分析入门介绍, 来自 RedBlue Team Blog: https://t.co/nayKJoIi2U"
-
[ Network ] Introducing MitM-VM & Trudy: A Dead Simple TCP Intercepting Proxy Tool Set - https://www.praetorian.com/blog/trudy-a-dead-simple-tcp-intercepting-proxy-mitm-vm
"MitM-VM & Trudy - 一个非常容易安装和配置的中间人代理劫持工具: https://t.co/QMDGC4U2Zm"
-
[ Others ] Bypassing XIGNCODE3 Anti-Cheat via DLL Injection and Code Modification : http://0xbaadf00dsec.blogspot.com.br/2016/02/bypassing-xigncode3-dragomon-hunter.html
"通过 DLL 注入和代码修改绕过 XIGNCODE3 的反作弊保护, XIGNCODE3 是猎龙人游戏的保护程序: https://t.co/0SPq3wycur"
-
[ Others ] Cryptanalysis of intercepted Israeli drone feeds: http://samvartaka.github.io/cryptanalysis/2016/02/02/videocrypt-uavs https://t.co/WXzkC6Ebm2
"截获的以色列无人机视频信号源加密分析: https://t.co/Ex9NZXYQV0 https://t.co/WXzkC6Ebm2"
-
[ Others ] PVS-Studio Team: Analysis of CNTK tool kit from Microsoft Research. http://www.viva64.com/en/b/0372/ #cpp, #CNTK, #opensource https://t.co/KlZVR5kD5f
"PVS-Studio 团队用自己的静态分析工具对 CNTK 工具包做的分析结果, CNTK 是微软新开源的一个人工智能领域的开源项目: https://t.co/eLdOAw2GNI https://t.co/KlZVR5kD5f"
-
[ Pentest ] FuzzySec --> Windows Domains, Pivot & Profit - http://www.fuzzysecurity.com/tutorials/25.html
"Windows Domains, Pivot & Profit - 渗透测试时,如何在域内横向渗透, 来自 FuzzySecurity Blog: https://t.co/54udw4rlDI"
-
[ ReverseEngineering ] On the x86 Representation of Object Oriented Programming Concepts for Reverse Engineers : https://www.sans.org/reading-room/whitepapers/malicious/x86-representation-object-oriented-programming-concepts-reverse-engineers-36457 (pdf)
"C++ 面向对象的一些概念在 x86 层面的呈现, Sans Paper: https://t.co/WnlCuNaByt "
-
[ ReverseEngineering ] Finally, #miasm has a doc/blog: http://miasm.re !
"GreHack 2015 一道逆向题的 Writeup: https://t.co/f2xd4P5GvS!"
-
[ ReverseEngineering ] Reversing C++ : https://www.blackhat.com/presentations/bh-dc-07/Sabanal_Yason/Paper/bh-dc-07-Sabanal_Yason-WP.pdf (pdf)
"C++ 逆向, 来自 Sabanal 和 Yason 在 07 年 BlackHat 会议的演讲: https://t.co/6dy6MPR7PH "
-
[ SecurityProduct ] Malwarebytes updates are not signed or downloaded over a secure channel using a hardcoded RC4 key: http://code.google.com/p/google-security-research/issues/detail?id=714
"Malwarebytes 反病毒软件更新没有签名保护,并且是 HTTP 下载, 仅用了一个硬编码的 RC4 密钥加密, 来自 Project Zero: https://t.co/2nkl0heMgy"
-
[ Windows ] I put together an Application Whitelisting Quick Reference Guide For #NCCDC Blue Teams: http://subt0x10.blogspot.com/2016/02/application-whitelisting-quick.html #rmccdc Feedback Welcome.
"Windows 应用白名单快速参考指南, 来自 subTee 的 Blog: https://t.co/4H6kQOP5jg "
-
[ Windows ] Windows 7 & 8.1 systems running on Skylake should update to Win 10 by July 17, 2017 to continue receiving support https://blogs.windows.com/windowsexperience/2016/01/15/windows-10-embracing-silicon-innovation/
"Skylake 平台上运行的 Windows 7 和 8.1 应更新到 Win 10, 以在 2017 年 7 月 17 号后继续得到官方支持: https://t.co/xQvlUGF91y"