腾讯玄武实验室安全动态推送(Tencent Xuanwu Lab Security Daily News)

腾讯玄武实验室安全动态推送

Tencent Xuanwu Lab Security Daily News

2017/04/04

Catalin Cimpanu @campuscodi

[ Android ] Android Overtakes Windows as Most Used Operating System on the Internet https://www.bleepingcomputer.com/news/software/android-overtakes-windows-as-most-used-operating-system/ #android #windows… https://t.co/gfbiT459i8

"据 StatCounter 分析公司发布的数据显示，Android 在今年三月赶超 Windows 成为使用人数最广的操作系统，第三、第四分别为 iOS、OS X： https://t.co/rzsLcCRhVM "
Alexander Popov @a13xp0p0v

[ Linux ] I've published the write-up about exploiting CVE-2017-2636 in the Linux kernel: https://a13xp0p0v.github.io/2017/03/24/CVE-2017-2636.html

" CVE-2017-2636: 对 Linux 内核驱动模块 n_hdlc 中存在的条件竞争漏洞进行利用，以绕过 SMEP︰ https://t.co/U6jQqp6urM"
Sasha Goldshtein @goldshtn

[ Linux ] Tracing .NET Core on Linux with USDT and BCC -- GC stacks, object allocs, exception statistics and much more:… https://t.co/AqNQ6Tfx7B

"为 Linux .NET Core 添加 Event Tracing 的支持： http://blogs.microsoft.co.il/sasha/2017/04/02/tracing-net-core-on-linux-with-usdt-and-bcc/"
FireEye @FireEye

[ MalwareAnalysis ] [Blog] Dissecting One of #APT29’s Fileless WMI and PowerShell Backdoors (POSHSPY) http://bddy.me/2o2XRao

"解析 APT29 无文件 WMI & Powershell 后门(POSHSPY)： https://t.co/HGZ5Apo9K5"
Neel Mehta @neelmehta

[ MalwareAnalysis ] Investigating Chrysaor, Android #malware used in targeted attacks: https://android-developers.googleblog.com/2017/04/an-investigation-of-chrysaor-malware-on.html

" Android 间谍软件 Chrysaor 的分析︰ https://t.co/IFkOXtXKRF"
NCC Group Infosec @NCCGroupInfosec

[ Others ] An initial technical analysis of the Red Leaves implant, as used by #APT10. Suricata & Yara sigs included. See: https://github.com/nccgroup/Cyber-Defence/blob/master/Technical%20Notes/Red%20Leaves/Red%20Leaves%20technical%20note%20v1.0.pdf

"RedLeaves 技术分析报告，来自 NCC Group︰ https://t.co/2UD0A9R3nu"
Binni Shah @binitamshah

[ Others ] How to recover data from dead usb the easy way : https://www.youtube.com/watch?v=_catJb73LI8

" 从一个坏掉的 USB 中恢复数据（video）︰ https://t.co/2aXshS8DCH"
Full Disclosure @SecLists

[ SecurityProduct ] Trend Micro Enterprise Mobile Security Android Application - MITM SSL… https://goo.gl/fb/p8De84 #FullDisclosure

"Trend Micro 企业安全安卓应用未对SSL证书进行验证，可进行中间人攻击(CVE-2016-9319)： https://t.co/UInovG4ROB "
Valentine @vgrsec

[ Windows ] Unicode obfuscation for files, users, services, and more. Fool users and tools with unicode control characters.… https://t.co/LvqzfJS0hK

"巧妙利用 Unicode 控制字符以混淆字符串： https://www.vgrsec.com/post20170402.html"
j00ru//vx @j00ru

[ Windows ] Another bug documented: Windows Kernel Local Denial-of-Service #4: nt!NtAccessCheck and family (Windows 8-10), http://j00ru.vexillium.org/?p=3225.

"Windows Kernel 本地拒绝服务之四: nt!NtAccessCheck (Windows 8-10)： https://t.co/NJjdB0q6MX。"
Matt Nelson @enigma0x3

[ Windows ] [Blog] Defeating Device Guard: A look into CVE-2017-0007 https://enigma0x3.net/2017/04/03/defeating-device-guard-a-look-into-cve-2017-0007/

"针对 PowerShell 签名代码的 Device Guard 保护特性的绕过（CVE-2017-0007），漏洞分析及利用: https://t.co/GrvZHYlgvN "

2017/04/04