腾讯玄武实验室安全动态推送(Tencent Xuanwu Lab Security Daily News)

腾讯玄武实验室安全动态推送

Tencent Xuanwu Lab Security Daily News

2017/01/19

Nicolas Krassas @Dinosn

[ Android ] Hash Suite Droid (Hash Suite for Android). Free and Open Source. http://hashsuite.openwall.net/android

"Hash Suite for Android： https://t.co/iDcWe1Qg8C"
Francisco Alonso @revskills

[ Conference ] Pwn2Own 2017 rules http://zerodayinitiative.com/Pwn2Own2017Rules.html

"Pwn2Own 2017 大赛规则： https://t.co/XYmw5Guzq8"
Philipp Jovanovic @Daeinar

[ Crypto ] NSA publishes key recovery attacks on AES-GCM-SIV: https://www.ietf.org/mail-archive/web/cfrg/current/msg08892.html

"AES GCM SIV analysis︰ https://t.co/RfGeWipRzr"
Lukas Stefanko @LukasStefanko

[ IoTDevice ] Nice blog about Hacking Smart Bulbs #IoT #BLE #Exploit http://blog.attify.com/2017/01/17/exploiting-iot-enabled-ble-smart-bulb-security/ https://t.co/imu87lQp9B

"Hacking 智能电灯： https://t.co/gxGLBNsROe "
Nicolas Krassas @Dinosn

[ MalwareAnalysis ] New Mac backdoor using antiquated code https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/

"新 Mac 恶意软件分析： https://t.co/Tb2tY0mhHW"
KevinLu @K3vinLuSec

[ MalwareAnalysis ] My new blog: Android Locker Malware uses Google Cloud Messaging Service https://blog.fortinet.com/2017/01/16/android-locker-malware-uses-google-cloud-messaging-service @ FortiGuardLabs

"针对利用谷歌云消息服务的 Android Locker 恶意软件分析 https://t.co/h3lXXqTe8I "
Binary Defense @Binary_Defense

[ MalwareAnalysis ] New Blog: Dangers of Embedded LNK Files by @ JaredDeMott https://www.binarydefense.com/blog/the-dangers-of-embedded-lnk-files-in-office-documents/ #BinaryDefense

"Office 文档中存在的嵌入式 LNK 文件危险: https://t.co/cHSuruJA95 "
TrendLabs @TrendLabs

[ MalwareAnalysis ] New post: Uncovering the Inner Workings of EyePyramid http://bit.ly/2iRcU43 @ TrendMicro

"解密 EyePyramid 恶意软件，来自 TrendMicro： https://t.co/YR7JIGiar8"
TrendLabs @TrendLabs

[ Mobile ] New post: In Review: 2016’s Mobile Threat Landscape Brings Diversity, Scale, and Scope http://bit.ly/2j88vHz @ TrendMicro

"回顾 2016 年移动安全： https://t.co/QEXCesVqzH "
Tavis Ormandy @taviso

[ Popular Software ] I took a quick look at the extension. There was an easy privileged javascript code execution bug. Sigh.… https://twitter.com/i/web/status/821799140497584129

"最近 Adobe Acrobat 强制安装的 Chrome 扩展存在 XSS 漏洞： https://bugs.chromium.org/p/project-zero/issues/detail?id=1088"
Hossein Lotfi @hosselot

[ Popular Software ] Details of Microsoft Word OneTableDocumentStream vulnerability (CVE-2016-7290): http://srcincite.io/blog/2016/12/13/word-up-microsoft-word-onetabledocumentstream-underflow.html

"Microsoft Word OneTableDocumentStream 内存下溢漏洞分析 (CVE-2016-7290)︰ https://t.co/zvcxq6vlXu"
Nicolas Krassas @Dinosn

[ Tools ] JudasDNS - Nameserver DNS poisoning attacks made easy http://www.kitploit.com/2017/01/judasdns-nameserver-dns-poisoning.html

"JudasDNS -- DNS 投毒工具： https://t.co/vJOXIyJP0x"
Nicolas Krassas @Dinosn

[ Vulnerability ] Analysis of ISC BIND TKEY Query Response Handling DoS (CVE-2016-9131) http://blog.fortinet.com/2017/01/18/analysis-of-isc-bind-tkey-query-response-handling-dos-cve-2016-9131

"分析 BIND TKEY 查询响应时存在的 DOS 漏洞(CVE-2016-9131)： https://t.co/34WHVcwwLm"
hyp @hyp_h5p

[ Vulnerability ] NIce !!!! Happy new year PHP php-gettext: Arbitrary code execution http://www.openwall.com/lists/oss-security/2017/01/17/17 #InfoSec #PHP #web

"PHP php-gettext 库的 select_string 函数存在任意代码执行漏洞： https://t.co/pvpiFJFH50 "
Nicolas Krassas @Dinosn

[ Web Security ] Practical JSONP Injection https://securitycafe.ro/2017/01/18/practical-jsonp-injection/

"JSONP 注入实战： https://t.co/QqFLCFnhbG"
karttoon @noottrak

[ Windows ] New personal blog - "Abusing native Windows functions for shellcode execution", included a tool to gen the VBA code https://t.co/TGD93YNN8b

"利用 Windows API 中的回调函数执行 Shellcode: https://t.co/TGD93YNN8b"

Xuanwu Spider via phithon's blog

[ Web Security ] eval长度限制绕过 && PHP5.6新特性： https://www.leavesongs.com/PHP/bypass-eval-length-restrict.html
Xuanwu Spider via project zero

[ ] NVIDIA DxgkDdiEscape Handler 存在一个可控指针写漏洞： https://bugs.chromium.org/p/project-zero/issues/detail?id=911
Xuanwu Spider via Talos 'S blog

[ Popular Software ] Oracle Outside In Technology 存在多个漏洞： http://blog.talosintel.com/2017/01/oit-multiple-rce.html?utm_source=dlvr.it&utm_medium=twitter&utm_campaign=Feed:+feedburner/Talos+(Talos+Blog)&m=1
Xuanwu Spider via krebsonsecurity

[ Others ] Mirai 恶意软件作者大追踪： https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/
Xuanwu Spider via project zero

[ Others ] NVIDIA DxgkDdiEscape Handler 存在一个可控指针写漏洞： https://bugs.chromium.org/p/project-zero/issues/detail?id=911

2017/01/19