腾讯玄武实验室安全动态推送(Tencent Xuanwu Lab Security Daily News)

腾讯玄武实验室安全动态推送

Tencent Xuanwu Lab Security Daily News

2016/07/09

Threat Insight @threatinsight

[ Attack ] NetTraveler APT Targets Russian, European Interests: http://buff.ly/29unFF7 https://t.co/ac8UtQLaku

"NetTraveler - 针对俄罗斯及其邻国的 APT 攻击行动︰ https://t.co/PyqGUeHmwn https://t.co/ac8UtQLaku"
Nicolas Krassas @Dinosn

[ Attack ] Cracking the MySpace List - First Impressions http://reusablesec.blogspot.gr/2016/07/cracking-myspace-list-first-impressions.html

" 解开 MySpace 泄漏的 3.6 亿数据，据作者说，黑客早在 2008 年就窃取了这份数据： https://t.co/N1PJMMaFeX 还有一篇分析这份数据的 Blog： http://cynosureprime.blogspot.gr/2016/07/myspace-hashes-length-10-and-beyond.html "
Nicolas Krassas @Dinosn

[ Attack ] Over 1000 Wendy’s restaurants hacked – customers’ credit card details stolen http://www.welivesecurity.com/2016/07/08/1000-wendys-restaurants-hacked-customers-credit-card-details-stolen/

"超过 1000 家温蒂餐厅被黑，用户信用卡和储蓄卡信息被盗，黑客在餐厅的 POS 系统中安装了恶意软件： https://t.co/RDJ60zRCHj"
JP Aumasson @veorq

[ Backdoor ] stealth hard-drive backdoor with remote covert exfiltration https://www.ibr.cs.tu-bs.de/users/kurmus/papers/acsac13.pdf had missed this paper by @ kurmus @ travisgoodspeed & al.

" 硬盘隐蔽后门的实现与启示， Paper： https://t.co/pbDQ83XC8a "
Joseph Cox @josephfcox

[ Detect ] Pretty cool: researchers identify flows of encrypted traffic related to malware families https://motherboard.vice.com/read/researchers-figure-out-how-to-detect-malware-in-encrypted-traffic https://t.co/VfToVAcyXa

"安全研究人员找到了在加密流量中检测恶意软件家族的方法： https://t.co/kKwH1av2tT https://t.co/VfToVAcyXa "
Dave @nzkarit

[ Hardware ] I have released gpsnitch which is the GPS Spoofer Catcher I demoed at @ unrestcon. https://github.com/zxsecurity/gpsnitch (slides coming soon)

" GPSnitch - 专门检测 GPS 欺骗攻击的工具， GitHub Repo： https://t.co/wPJZSPzwGr "
Binni Shah @binitamshah

[ Others ] Hiding a payload in PNG files with Python : http://blog.brian.jp/python/png/2016/07/07/file-fun-with-pyhon.html

" 利用 Python 在 PNG 文件中藏 Payload︰ https://t.co/pS5RFNmMvf"
Binni Shah @binitamshah

[ Others ] Apex memmove - the fastest memcpy/memmove on x86/x64 ... EVER, written in C : http://www.codeproject.com/Articles/1110153/Apex-memmove-the-fastest-memcpy-memmove-on-x-x-EVE

" x86/x64 平台速度最快的内存拷贝/移动的实现代码，C 语言编写: https://t.co/kS0HkWP76n"
MWR Labs @mwrlabs

[ Others ] Just published! Slides from Nick Jones talk @ BSidesLondon "Bug Hunting with Static Code Analysis" https://labs.mwrinfosecurity.com/publications/bug-hunting-with/ #BSidesLDN2016

" 通过静态代码分析的方法找漏洞，来自 MWR Labs 研究员在 BSides 伦敦会议的演讲： https://t.co/opzrrcAFKq "
Virus Bulletin @virusbtn

[ Others ] Kaspersky's Oleg Gorobets looks at the security aspects of Virtual Desktop Infrastructures https://securelist.com/blog/security-policies/75279/vdi-non-virtual-problems-of-virtual-desktop-security-and-how-to-solve-them-for-real/

" 虚拟桌面（VDI）安全的真实问题，以及如何解决，来自 Kaspersky Blog： https://t.co/MJU5JQzaik "
Nicolas Krassas @Dinosn

[ Pentest ] Penetration Testing Process & Tools, Visually Explained http://visuallyexplainedpentest.barricade.io/

" 可视化地了解渗透测试的流程： https://t.co/EtjUgsF2jU"
Enno Rey @Enno_Insinuator

[ Pentest ] Penetration Testing Tools that (do not) Support #IPv6 (Dec 2014) https://www.ernw.de/download/newsletter/ERNW_Newsletter_45_PenTesting_Tools_that_Support_IPv6_v.1.1_en.pdf [PDF] by @ AntoniosAtlasis https://t.co/G3m85xkiFM

" 那些不支持 IPv6 的渗透测试工具，来自 ERNW 的报告： https://t.co/G3m85xkiFM https://t.co/aoALzgbESY "
Nicolas Krassas @Dinosn

[ Popular Software ] Adobe Flash: Heap Corruption in LMZA Property Decoding https://bugs.chromium.org/p/project-zero/issues/detail?id=790#c_ts1467910639

"Adobe Flash LMZA 属性解码时的一个堆内存破坏漏洞（CVE-2016-4137），来自 Project Zero Issue 790： https://t.co/2TZtNr2TOU 还有一个处理 JXR 格式时的 Double Free 漏洞： https://bugs.chromium.org/p/project-zero/issues/detail?id=788 "
Nicolas Krassas @Dinosn

[ Popular Software ] Adobe Flash: Overflow in ATF Processing https://bugs.chromium.org/p/project-zero/issues/detail?id=786#c_ts1467910584

"Adobe Flash 在处理 ATF（Adobe 纹理）文件时存在一个堆溢出漏洞（CVE-2016-4135），来自 Project Zero Issue 786： https://t.co/OrvjhX30fi"
Binni Shah @binitamshah

[ Popular Software ] Messenger (Facebook) Secret Conversations - Technical Whitepaper : https://fbnewsroomus.files.wordpress.com/2016/07/secret_conversations_whitepaper.pdf (pdf)

" Facebook Messenger 的秘密会话模式分析报告︰ https://t.co/f7lZErT2W4 "
switched @switch_d

[ ThreatIntelligence ] Open Source Threat Intelligence Tools & Techniques http://resources.infosecinstitute.com/open-source-threat-intelligence-tools-techniques/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+infosecResources+%28InfoSec+Resources%29

" 开源威胁情报相关的工具和技巧： https://t.co/Prutu1tLNQ"
Binni Shah @binitamshah

[ Tools ] BINSEC : Binary-level Semantic Analysis to the Rescue : https://sec2016.rmll.info/files/20160705-03-Bardin-Binsec.pdf (pdf) https://t.co/qnXdDNLCwF

"BINSEC - 基于语义的二进制分析框架︰ https://t.co/CNW3bTHRz2 https://t.co/qnXdDNLCwF"
Binni Shah @binitamshah

[ Tools ] Vulners – Vulnerability Data Base : https://vulners.com/

"Vulners — 漏洞数据库︰ https://t.co/ytSlXYsQZn"
Nicolas Krassas @Dinosn

[ Web Security ] The Genesis of an XSS Worm - Part III (with video) http://brutelogic.com.br/blog/genesis-xss-worm-part-iii/

" XSS 蠕虫的起源 Part 3： https://t.co/Oqy2zelqS2"
Binni Shah @binitamshah

[ Web Security ] Extracting Multiple Bits Per Request From Full-blind SQL Injection Vulnerabilities : http://howto.hackallthethings.com/2016/07/extracting-multiple-bits-per-request.html https://t.co/Lt7ZU76Gmy

" SQL 盲注时，如何在一个请求中提取更多的位信息︰ https://t.co/Sq4Edd22Yh https://t.co/Lt7ZU76Gmy"

2016/07/09