
腾讯玄武实验室安全动态推送
Tencent Xuanwu Lab Security Daily News
-
[ APT ] Enhanced Analysis of GRIZZLY STEPPE http://bit.ly/2ltMKqt
"美国国土安全部和通信集成中心合作发布的针对 GRIZZLY STEPPE 攻击组织的分析报告,该组织与 APT28/APT29 有关: https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
-
[ Browser ] Chrome OS Security Guide https://www.youtube.com/watch?v=maCSmdy3an4
"Chrome OS 安全指南(video): https://t.co/McY9fOlloS"
-
[ Conference ] The list of (conditionally) accepted papers is available on the website: http://eurosys2017.org/
" EuroSys 会议已接受的 Papers 列表公开了(点击右上角的 Program)︰ https://t.co/810CNLG9sC"
-
[ Conference ] Our very own @RCS will be at @owasp @AppSecEU 2017 to deliver a Secure Coding in Java training course https://t.co/A21bEv5rZQ
"OWASP AppSec EU Belfast 2017 大会将于 5 月 11-12 日举行 https://2017.appsec.eu/"
-
[ Crypto ] Here is a guide I wrote about using GPG and Mutt with Gmail as a provider https://gist.github.com/bnagy/8914f712f689cc01c267 https://twitter.com/tqbf/status/831155478990352389
"GPG 介绍: https://t.co/KTKynxJv8Q https://t.co/hdR2LyULBJ "
-
[ Detect ] You can detect Mimikatz stealing passwords by configuring Sysmon to watch Lsass.exe for process access: https://t.co/KSv9G9T21y
"通过配置 Sysmon 观察 Lsass.exe 进程,可以发现 Mimikatz 偷密码的行为︰ https://t.co/KSv9G9T21y"
-
[ Linux ] ELF-Miner : Using Structural Knowledge and Data Mining Methods To Detect New (Linux) Malicious Executables : http://www.genetic-programming.org/hc2011/05-Farooq/Farooq-Paper.pdf (pdf)
"ELF-Miner -- 使用结构化知识和数据挖掘方法来检测新的 Linux 恶意执行文件︰ https://t.co/JRzrsUKTkO (pdf)"
-
[ macOS ] Word documents laced with malicious macros used to hack Apple Mac systems http://securityaffairs.co/wordpress/56226/breaking-news/apple-mac-malware.html
"据 SecurityAffairs 报道,已经有攻击者开始利用携带恶意宏代码的 Word 文档攻击 Mac 系统用户: https://t.co/68YP2zYuc1"
-
[ macOS ] __today = ['new','blog','post']; post=str('OS X Packet Capture & #Empire '); https://cybersyndicates.com/2017/02/os-x-packet-capture--empire/
"为 OS X Empire 攻击框架添加 Socket Sniffer 的支持: https://t.co/wIGrCjfFXp"
-
[ Malware ] IBI Crypter. A JIT Crypter PoC : https://0x00sec.org/t/ibi-crypter-a-jit-crypter-poc/1373
" IBI Crypter - 基于 JIT 思路生成的 Crypter 恶意代码 PoC,动态生成下一步将要执行的代码: https://t.co/63AgXIW0AD"
-
[ Malware ] Mirai Widens Distribution with New Trojan that Scans More Ports http://blog.trendmicro.com/trendlabs-security-intelligence/mirai-widens-distribution-new-trojan-scans-ports/
"Mirai 演变出新的木马并可扫描更多端口: https://t.co/TI3XrNqvrk"
-
[ NetworkDevice ] NCC Group's @ foxit Blog on Detecting #Ticketbleed (CVE-2016-9244) - https://blog.fox-it.com/2017/02/13/detecting-ticketbleed-cve-2016-9244/ including @ Snort signatures
" F5 设备 Ticketbleed(CVE-2016-9244) 漏洞的检测: https://t.co/po5KLDk0Mw "
-
[ Others ] github-cheat-sheet : A list of cool features of Git and GitHub : https://github.com/tiimgreen/github-cheat-sheet
"GitHub 秘籍 - GitHub 使用中的一些小技巧︰ https://t.co/zFE8ImM2VS"
-
[ ReverseEngineering ] Reverse engineering a hypocritical private API! https://github.com/casperreverser/CasperReverse/blob/master/writeup.md
"Casper API 逆向分析报告: https://t.co/MPlWrlgomw"
-
[ ReverseEngineering ] Devirtualizing C++ with Binary Ninja: https://blog.trailofbits.com/2017/02/13/devirtualizing-c-with-binary-ninja/
"利用 Binary Ninja 逆向框架实现对 C++ 虚函数的定位和导航︰ https://t.co/4eAB6tYJ90"
-
[ ReverseEngineering ] IDA Pro Malware Analysis Tips : https://vimeo.com/203657826
"在利用 IDA Pro 分析恶意软件时的一些建议(视频)︰ https://t.co/CrJ245o7oL"
-
[ SecurityProduct ] Vulnerability in Quick Heal Antivirus which will allow remote code execution http://payatu.com/quick-heal-av-secrity-assessment/
"Quick Heal 反病毒软件自身的远程代码执行漏洞: https://t.co/FtzWK6hbuV "
-
[ Tools ] vsaudit - VOIP Security Audit Framework http://www.kitploit.com/2017/02/vsaudit-voip-security-audit-framework.html
"vsaudit -- VOIP 安全审计框架: https://t.co/y3FCI2eRL9"
-
[ Tools ] SSMA - Simple Static Malware Analyzer https://github.com/secrary/SSMA
"SSMA -- 简单的静态恶意软件分析工具: https://t.co/sLZluTOwSt"
-
[ Windows ] Heads up researchers: Windows 10 build 15031 removes support for Return Flow Guard. Bypass bounty terms updated @ https://technet.microsoft.com/en-us/security/dn425049.aspx
" Windows 10 build 15031 版本移除了 RFG(Return Flow Guard)利用缓解特性,与此同时,微软的 Bypass Bounty 致谢页面中也删除了 RFG 相关的信息: https://t.co/lOaqxfmH9C"
-
[ Windows ] Analysis of Win32k system call filtering on Windows 10 1607 and its effectiveness against windows kernel exploits - https://t.co/czrZnth2To
" Win32k System Call Filtering 保护机制以及在 Exploit 防护方面的有效性分析: https://t.co/czrZnth2To"
-
[ WirelessSecurity ] Predicting and Abusing WPA2/802.11 Group Keys : http://papers.mathyvanhoef.com/33c3-broadkey-slides.pdf (Slides) cc @ vanhoefm
" WPA2/802.11 Group Keys 的预测和滥用︰ https://t.co/ZEnkVsdVIx "
-
[ WirelessSecurity ] Advanced WiFi Attacks + Jamming Using Commodity Hardware : http://www.mathyvanhoef.com/2015/10/advanced-wifi-attacks-using-commodity.html , Slides : https://people.cs.kuleuven.be/~mathy.vanhoef/papers/brucon2015_slides.pdf cc @ vanhoefm
" 使用廉价的主流硬件攻击 WiFi︰ https://t.co/QdRXaVf6RB Slides︰ https://t.co/WEb1dxZDNg "
-
[ Android ] ISC 2016安全训练营-安卓app逆向与安全防护 PPT: https://github.com/feicong/android-app-sec/blob/master/2016%E5%AE%89%E5%85%A8%E8%AE%AD%E7%BB%83%E8%90%A5.pptx.zip
-
[ Android ] Android源代码的下载和编译技巧,以及如何处理中间过程出现的错误: http://0xcc0xcd.com/p/videos/download-and-compile-aosp.php
-
[ Malware ] 安天移动安全&中国电信云堤联合报告《Dark Mobile Bank之钓鱼篇》:
-
[ Virtualization ] QEMU的VGA设备CirrusCLGD 54xx VGA(XSA-208/CVE-2017-2615): http://www.mottoin.com/96036.html
-
[ Detect ] 我的ELK搭建笔记(Windows 日志收集): http://mp.weixin.qq.com/s?__biz=MzI5ODE0ODA5MQ==&mid=2652277948&idx=1&sn=96ceb072aeda6cb94d64d9feff98393a&scene=0#wechat_redirect