腾讯玄武实验室安全动态推送
Tencent Xuanwu Lab Security Daily News
-
[ Android ] [Slides] Perf: From Profiling to Kernel Exploiting http://goo.gl/OnRmQE #HITB2016AMS by @ wish_wu
" From Profiling to Kernel Exploiting，来自 wish_wu 在 HITB 2016 阿姆斯特丹会议的演讲： https://t.co/B4Szta4hvM "
-
[ Android ] Android AdWare Trying to Deceive the Analyst | Fortinet Blog http://ow.ly/DuLP300tC6V
" 一款叫做 Feiwo 的 Android 广告软件欺骗分析人员躲避检测，截至上周很多反病毒厂商仍不能检出： https://t.co/71JgiyHpDf"
-
[ Android ] Android Anti-Hooking Techniques in Java http://d3adend.org/blog/?p=589 ( by @ neilbergman )
" 在 Java 层探测 Substrate 或者 Xposed Hook 框架的存在： https://t.co/vqalHfZnPl "
-
[ Browser ] .@ google updates #Chrome to 51.0.2704.63, pays one researcher $30,000 in bounties. https://threatpost.com/researcher-pockets-30000-in-chrome-bounties/118337/
" Chrome 更新 51.0.2704.63 版本，本次共修复了 9 个高危漏洞。Google 支付了 3 万美金给 Mariusz Mlynski，奖励他发现的 4 个高危漏洞。此外，本次更新中还修复了玄武实验室 LiuKe 发现的两个漏洞，来自 ThreatPost 的报道： https://t.co/kjVCKHPEH5 Release Blog： http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html "
-
[ Defend ] Enforcing Kernel Security Invariants with Data Flow Integrity http://www.cc.gatech.edu/~blee303/paper/kenali.pdf
" 通过数据流完整性校验，对抗内核中基于内存破坏漏洞的提权攻击， 来自美国佐治亚理工大学的 Paper： https://t.co/QhW5cLjAgV"
-
[ Detect ] Detecting hidden backdoors analyze malware hidden inside an OPcache file ~ http://blog.gosecure.ca/2016/05/26/detecting-hidden-backdoors-in-php-opcache/
" 检测 PHP OPcache 文件中隐藏的后门，来自 GoSecure Blog： https://t.co/B9s0VITwMm"
-
[ Exploit ] How CVE-2015-7547 (GLIBC getaddrinfo) can bypass ASLR http://bit.ly/1NRrvbg
" CVE-2015-7547 (GLIBC getaddrinfo) 是怎么绕过 ASLR 的，来自 Palo Alto Blog： https://t.co/IRXf2sxpjo 作者在 HITB 阿姆斯特丹会议关于这个议题的演讲： http://conference.hitb.org/hitbsecconf2016ams/materials/D1%20COMMSEC%20-%20Nadav%20Markus%20and%20Gal%20De%20Leon%20-%20Exploiting%20GLIBC%20-%20Hacking%20Everything.pdf "
-
[ Fuzzing ] Torturing the PHP interpreter - Slides from my @ CONFidence_news talk - http://www.slideshare.net/logicaltrust/torturing-the-php-interpreter CC: @ owasppoland #php #fuzzing
" 折磨（Fuzz） PHP 解释器，Slides： https://t.co/gVdHOF8op5 "
-
[ Fuzzing ] Slides: @ richinseattle on 'Go Speed Tracer: Guided Fuzzing' http://conference.hitb.org/hitbsecconf2016ams/materials/D2T2%20-%20Richard%20Johnson%20-%20Go%20Speed%20Tracer%20-%20Guided%20Fuzzing.pdf #HITB2016AMS https://t.co/0G0taEK0Kx
" 高速 Trace 与 Guided Fuzzing， 来自 HITB 2016 阿姆斯特丹会议： https://t.co/ea8IaKLN8G https://t.co/0G0taEK0Kx"
-
[ iOS ] Evading "Find My iPhone' http://blog.kcnabin.com.np/find_my_iphone_can-be-failed/
" 利用私有 DNS， '查找我的 iPhone' 可以被轻松绕过： https://t.co/oMD9casb0U"
-
[ iOS ] SandJacking allows hackers to install malicious iOS apps on non-jailbroken devices. No patch from Apple http://www.securityweek.com/sandjacking-attack-allows-hackers-install-evil-ios-apps #hitb2016ams
" 通过 'SandJacking' 攻击技术，在未越狱的 iOS 设备上安装恶意 APP： https://t.co/uMTAdj3Sdn 来自 HITB 2016 会议的演讲，演讲 Slides: https://conference.hitb.org/hitbsecconf2016ams/materials/D1T2%20-%20Chilik%20Tamir%20-%20Profiting%20from%20iOS%20Malware.pdf "
-
[ Linux ] wildpwn – UNIX Wildcard Attack Tool http://www.darknet.org.uk/2016/05/wildpwn-unix-wildcard-attack-tool/
"wildpwn — UNIX 通配符攻击工具： https://t.co/NLAkcKprpa"
-
[ Mac OS X ] Untrusting an intermediate CA on OS X https://blog.filippo.io/untrusting-an-intermediate-ca-on-os-x/
"如何在 OS X 系统取消对 BlueCoat Intermediate CA 的信任： https://t.co/May98xTu8E "
-
[ Mac OS X ] Clipboard poisoning attacks on the Mac https://blog.malwarebytes.org/threat-analysis/2016/05/clipboard-poisoning-attacks-on-the-mac/
" Mac OS X 系统的剪贴板投毒攻击，来自 MalwareBytes Blog： https://t.co/sfYPqzJYVa "
-
[ Mac OS X ] ZDI-16-360: (Pwn2Own) Apple OS X fontd Sandbox Escape Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-16-360/
"ZDI-16-360: Apple OS X fontd 沙箱逃逸漏洞（CVE-2016-1797， lokihardt 用此漏洞参加的 Pwn2Own 比赛）， ZDI 公告： https://t.co/dkTX72Hyp6"
-
[ Mac OS X ] ZDI-16-361: (Pwn2Own) Apple OS X libATSServer Heap-based Buffer Overflow Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-16-361/
"ZDI-16-361: Apple OS X libATSServer 堆缓冲区溢出 RCE（CVE-2016-1796， lokihardt 用此漏洞参加的 Pwn2Own 比赛）， ZDI 公告： https://t.co/mT85W2Ry89"
-
[ Malware ] Bayrob - An Ancient Evil Awakens http://blog.fortinet.com/2016/05/26/bayrob-an-ancient-evil-awakens @ Fortinet #security #infosec https://t.co/TpsAB5mQ8L
"Bayrob 恶意软件分析，来自 Fortinet Blog： https://t.co/E7M5NbHVns https://t.co/TpsAB5mQ8L"
-
[ Malware ] Angler, GZIP, and a Landing Page http://neonprimetime.blogspot.com/2016/05/angler-gzip-landing-page.html
" Angler, GZIP, and a Landing Page： https://t.co/pPrD6uzseJ"
-
[ Obfuscation ] Seeing Through Darkleech Obfuscation: a Quick Hack to Iframes https://blogs.mcafee.com/mcafee-labs/seeing-darkleech-obfuscation-quick-hack-iframes/
" Darkleech 混淆技术分析 - 快速定位 iframe 和跳转 URL，来自 McAfee Blog： https://t.co/AgKyII7OjI"
-
[ OpenSourceProject ] Graphite2 heap-based buffer overflow in GlyphCache::GlyphCache https://bugs.chromium.org/p/project-zero/issues/detail?id=749#c_ts1464261060
"字体渲染引擎 Graphite2 GlyphCache::GlyphCache 堆缓冲区溢出，来自 Project Zero Issue 749： https://t.co/nsUnVe13tW "
-
[ Popular Software ] ZDI-16-359: Adobe Reader DC FlateDecode Use-After-Free Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-16-359/
"ZDI-16-359: Adobe Reader FlateDecode UAF RCE（CVE-2016-1094）， ZDI 公告： https://t.co/lGlQkz1dQe"
-
[ Tools ] PHP Sandbox for different versions http://sandbox.onlinephpfunctions.com/
" 在线版 PHP 沙盒工具，网页上直接输出代码执行结果。支持 PHP 各大版本： https://t.co/AKtoTHW0aU "
-
[ Tools ] Phosphor: Dynamic Taint Tracking for the JVM https://github.com/Programming-Systems-Lab/phosphor
" Phosphor - JVM 中的动态污点追踪系统， GitHub Repo： https://t.co/oL4ttyVTh8"
-
[ Windows ] Msbuild.exe Code Injection Sample Example: https://gist.github.com/subTee/bc651742fc726863f4799648f5a264ab This will allows msbuild.exe to execute an arbitrary assembly
"Msbuild.exe 代码注入 PoC： https://t.co/szzt6WMSQ8 允许 msbuild.exe 执行任意的汇编指令。 Casey Smith 还贴出了另外一篇参考文章《基于 MSBuild Inline Tasks 的代码注入》： https://badcorporatelogo.wordpress.com/2013/09/15/code-injection-with-msbuild-inline-tasks/ MSDN 关于 MSBuild Inline Task 的文章： https://blogs.msdn.microsoft.com/christianb/2010/08/02/msbuild-4-0-inline-task/ "
-
[ Windows ] Here are Windows instructions by @ ftp_alun on how to explicitly untrust an intermediate CA like BlueCoat's http://blogs.msmvps.com/alunj/2016/05/26/untrusting-the-blue-coat-intermediate-ca-from-windows/
" 如何在 Windows 系统取消对 BlueCoat Intermediate CA 的信任： https://t.co/rW3B0Tnzdy"
-
[ Windows ] Windows (Hyper-V) Containers on Windows 10 : https://msdn.microsoft.com/en-us/virtualization/windowscontainers/quick_start/quick_start_windows_10
" Windows Server Containers 快速安装指南: https://t.co/dhEK85TwCo 这是个系列文章，包括对容器安装、部署、管理的介绍： https://msdn.microsoft.com/en-us/virtualization/windowscontainers/about/about_overview "
