腾讯玄武实验室安全动态推送
Tencent Xuanwu Lab Security Daily News
-
[ Android ] Adult themed Android SMS Stealer Trojan http://research.zscaler.com/2016/03/adult-themed-android-sms-stealer-trojan.html
"成人主题的 Android 短信窃取木马， 来自 Zscaler Blog： https://t.co/x8VvhTbQ2v"
-
[ Android ] New Android Gmobi adware found in firmware and popular apps http://securityaffairs.co/wordpress/45420/cyber-crime/new-android-gmobi-adware.html
"Dr.Web 研究员检测到了一款新的 Android 恶意程序 - Gmobi，Gmobi 以 SDK 方式传播，很多知名应用厂商在应用和固件中都嵌入了这个 SDK，Gmobi 会悄悄地收集各种信息，然后发送到恶意作者的 C&C 服务器： https://t.co/ERGaswjOTb"
-
[ Attack ] Korean news site redirected to the #GongDaExploitKit, potentially exposing them to #malware infection http://bddy.me/1R8hQJ7
"1 月 27 号， FireEye 观察到，Korean news 网站的用户会被重定向到 GongDa Exploit Kit 网站： https://t.co/omstTocHnf"
-
[ Attack ] How to access full addresses for Western Digital RMA customers. http://pastebin.com/7HkMXLQV
"如何获取西部数据 RMA 用户的街道地址（数据泄漏）， 来自 Pastebin： https://t.co/6c3t5fAzbc"
-
[ Attack ] Cyber criminals are snapping up expired domains to serve malicious ads... http://www.brainerddispatch.com/lifestyles/tech/3989216-cyber-criminals-snap-expired-domains-serve-malicious-ads-websites
"黑产们正在抢购过期域名，为恶意广告攻击做准备： https://t.co/Tb6LB0L4rn"
-
[ Browser ] Beauty & the Beast: Diverting modern web browsers to build unique browser fingerprints, Laperdrix et al., @ ieeessp https://hal.inria.fr/hal-01285470
"美女与野兽 - 为现代浏览器生成独特的浏览器指纹， Paper： https://t.co/VyEHSLBIzX"
-
[ Challenges ] CTF-Tools - Some setup scripts for security research tools: This is a collection of setup scripts to ... http://bit.ly/1R5G5db #PenTest
"CTF-Tools： https://t.co/hEZXDs1FsV "
-
[ Fuzzing ] FuzzWindows Kernel via javascript http://weibo.com/p/230418770b78cb0102w1ia
"Fuzz Windows Kernel via javascript， 新浪微博： https://t.co/JO1MJ85SlZ 基于 Chakra 引擎，写 JavaScript 代码 Fuzz Windows 内核"
-
[ Hardware ] How Rowhammer Could Be Used to Exploit Weaknesses in Computer Hardware - http://www.thirdio.com/rowhammer.pdf http://arstechnica.com/security/2016/03/once-thought-safe-ddr4-memory-shown-to-be-vulnerable-to-rowhammer/
"Rowhammer 是如何被用于攻击计算机硬件的： https://t.co/FcryYuePmv 曾经被认为安全的 DDR4 内存，现在看来也受 Rowhammer 的影响， 来自 ArsTechnica 的报道： https://t.co/JHfk7Vcc70"
-
[ iOS ] Double blog release on advanced iOS app hooking with cycript https://www.sensepost.com/blog/2016/advanced-cycript-and-substrate/ & Android hooking with introspy https://www.sensepost.com/blog/2016/android-hooking-with-introspy/
"用 Cycript 和 Substrate Hook iOS 应用： https://t.co/qIkVMPGnST 用 Introspy Hook Android 应用： https://t.co/pbQNMDiacz "
-
[ iOS ] Database of Abandoned iOS App Exposes Details for 198,000 Users http://ow.ly/ZE27t
"iOS App Kinoptic 已被 App Store 下架，最近它的数据库在网上泄露，泄露的数据库含 198,000 用户的信息： https://t.co/eY78mdN5Ql "
-
[ iOS ] Probably the most hidden visual trick for iOS i have ever seen. Really useful for bedreading! http://9to5mac.com/2016/03/18/how-to-reduce-iphone-screen-brightness-without-jailbreak/
"不越狱，如何降低 iPhone 手机屏幕的亮度： https://t.co/2O2ZCm6F7F"
-
[ iOS ] Untangling iOS PIN code security: a look at the Apple vs. FBI saga, from a technical perspective. https://marcan.st/2016/03/untangling-ios-pin-code-security/
" iOS PIN 码安全性分析， Blog： https://t.co/fEks2KtYh5"
-
[ Linux ] CVE-2016-2117 memory disclosure to ethernet due to unchecked scatter/gather IO Affects: atheros http://seclists.org/oss-sec/2016/q1/658
"Linux 内核以太网卡驱动 scatter/gather IO (NETIF_F_SG）内存泄漏（CVE-2016-2117）： https://t.co/NiwkTJ2UEe"
-
[ Malware ] Great article in analyzing Python Malware. We love it cause t works!! https://twitter.com/sans_isc/status/710296228198748160
"安全专家们喜欢 Python ？ 黑客们也是： https://isc.sans.edu/diary/Security+Pros+Love+Python%3F+and+So+Do+Malware+Authors!/20853 "
-
[ Network ] Our new beta iOS app is here! Test it today: http://s.cgvpn.net/ne #wifisafespot https://t.co/f37MIh84GU
"WiFi Safe Spot 工具 iOS Beta 版本下载 - 可以防护 Free WiFi、提供匿名访问、为被审查的 APP和网站提供连接 ︰ https://t.co/WJwkcZxD4J https://t.co/f37MIh84GU"
-
[ Others ] The slides of my latest talk on file formats ("Caring for file formats") are out #TR16 https://speakerdeck.com/ange/caring-for-file-formats
"TR16 会议的演讲 《Caring for file formats》（关心一下文件格式吧）， 作者为 ange： https://t.co/DvmzXfMqgy"
-
[ Others ] RT @ justinvincent: Statically Recompiling NES Games into Native Executables with LLVM and Go http://bit.ly/1Lu7LJR
"利用 LLVM 和 Go，将 NES 游戏（'红白机'）静态编译成 Native 可执行程序， 来自 Andrew Kelley Blog： https://t.co/5HlgYqQ27v "
-
[ Others ] Google offering $100,000 to anyone who can hack a Chromebook remotely http://www.huffingtonpost.com/entry/google-offers-100-hacking-reward_us_56eb0bcae4b09bf44a9cc144
"如果可以远程黑掉 Chromebook，Google 奖励 10 万美金： https://t.co/MpDlFucnjp"
-
[ Others ] Analyzing the GTK+ Cross-Platform Widget Toolkit with PVS-Studio. http://www.viva64.com/en/b/0383/ (#gtk, #bugs, #cpp, #dev) https://t.co/5g2yiYQZEd
"用 PVS-Studio 分析 GTK+ 项目， GTK+ 是个跨平台的图形工具包： https://t.co/lXHEOEdKH0 https://t.co/5g2yiYQZEd"
-
[ Others ] Uncovering the Internet of terrible things: The Dark Web mapped https://the-parallax.com/2016/02/29/uncovering-the-internet-of-terrible-things-exclusive/ by @ sethr
"独家揭秘互联网上一些可怕的事儿： The Dark Web： https://t.co/pcbbkholyP "
-
[ Others ] Symantec Endpoint Protection EoP vuls [XSS/SQLi CVE-2015-8152/3 , ADC sysplant.sys CVE-2015-8154] https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160317_00
"Symantec 终端保护软件更新，修复了多个漏洞，包括 XSS/SQLi CVE-2015-8152/3，ADC sysplant.sys CVE-2015-8154： https://t.co/rrCa6jc38l"
-
[ ReverseEngineering ] Reverse-Engineering of the Cryptanalytic Attack Used in the Flame Malware - http://eprint.iacr.org/2016/298
"Flame 攻击中，攻击者利用伪造的微软签名信息实现了中间人劫持 Windows Update，这篇 Paper 通过逆向的方法，从密码学角度分析其中 Hash 碰撞的细节： https://t.co/1z1M0uGSpZ"
-
[ SecurityProduct ] That was quick, Avira patched the first report already. https://bugs.chromium.org/p/project-zero/issues/detail?id=765
"真是迅速，Avira（小红伞）已经修复了 Tavis 报告的第一个漏洞， Avira 在解析 PE section headers 时触发堆溢出， 来自 Project Zero Issue 765： https://t.co/ga4lrN1KIt"
-
[ SecurityProduct ] Apparently a Nessus scan finds a trivial EoP in Trend Micro due to bad ACLs. #wtf https://twitter.com/LaktoseIgnoranz/status/710968245566750720
"用 Nessus 扫描器发现了 Trend Micro 的一个 ACL 配置不当的提权漏洞： https://t.co/3K5OdQ6dYp"
-
[ ThirdParty ] new blog post: SQLite with a Fine-Toothed Comb http://blog.regehr.org/archives/1292
"SQLite 有一把齿非常密的梳子： https://t.co/16sM7fkgnz 这篇 Blog 分析作者发现的 SQLite 的几个 '未定义行为' 的 Bug"
-
[ Tools ] Keystone is a lightweight multi-platform, multi-architecture assembler framework. http://www.keystone-engine.org/ (awaiting)
"写 Unicorn CPU 模拟器和 Capstone 反汇编引擎的作者又在筹备一个新项目， Keystone，一个跨平台的轻量级汇编框架： https://t.co/ThZRGHtOFW 作者分享了两个 API 文档， C： http://dpaste.com/31D32MR Python： http://dpaste.com/2TAE5QF "
-
[ Tools ] CLE provides an abstraction of process memory the same way as if it was loader by the OS's loader. https://github.com/angr/cle
"CLE - 可执行程序加载器， 支持多种格式（PE/ELF）： https://t.co/CokmeGT4pk"
-
[ Windows ] Combined Windows x64 syscall tables https://github.com/hfiref0x/SyscallTables
"Windows x64 Syscall Table 生成器，支持多个版本 Windows， Github Repo： https://t.co/00M58HD6Xo"
