腾讯玄武实验室安全动态推送
Tencent Xuanwu Lab Security Daily News
-
[ Browser ] SOP bypass / UXSS – Stealing Credentials Pretty Fast (Edge) - Broken Browser https://www.brokenbrowser.com/sop-bypass-uxss-stealing-credentials-pretty-fast/
" SOP BYPASS / UXSS – 偷 Edge 浏览器用户的 Twitter/Facebook 密码： https://www.brokenbrowser.com/sop-bypass-uxss-stealing-credentials-pretty-fast/ "
-
[ Browser ] Firefox 53 & Edge 40 Browsers CSP Bypass https://www.n0tr00t.com/2017/05/10/Firefox-and-Edge-Browsers-CSP-Bypass.html
" Firefox53 & Edge40 Browsers CSP Bypass PoC： https://www.n0tr00t.com/2017/05/10/Firefox-and-Edge-Browsers-CSP-Bypass.html "
-
[ Industry News ] Here's a better article on how Microsoft refuses to allow third-party browsers on Windows 10 S. http://www.zdnet.com/article/google-chrome-wont-be-allowed-on-windows-10-s/
" 微软为教育市场推出的 Windows 10 S 版本，将限制用户只能安装运行来自 Windows Store 的应用，其他来源应用，比如桌面版 Chrome 浏览器将无法再运行： http://www.zdnet.com/article/google-chrome-wont-be-allowed-on-windows-10-s/ "
-
[ IoTDevice ] Multiple Vulnerabilities in ASUS Routers [CVE-2017-5891 and CVE-2017-5892] https://goo.gl/fb/FxtN5C #FullDisclosure
" 华硕路由器中存在多个 CSRF 漏洞（cve-2017-5892、cve-2017-5891）： http://seclists.org/fulldisclosure/2017/May/36?utm_source=feedburner&utm_medium=twitter&utm_campaign=Feed%3A+seclists%2FFullDisclosure+%28Full+Disclosure%29 "
-
[ IoTDevice ] [blog] IoT Security Testing Methodology http://r-7.co/2pefnui
" IoT 安全测试方法： http://r-7.co/2pefnui "
-
[ Linux ] Project Zero guest blog post: "Exploiting the Linux kernel via packet sockets" by @ andreyknvl - https://googleprojectzero.blogspot.com/2017/05/exploiting-linux-kernel-via-packet.html
" Linux kernel TPACKET_V3 packet_set_ring() 整数符号比较导致的越界写漏洞（CVE-2017-7308），Project Zero 这篇 Blog 介绍这个漏洞是如何发现的以及如何利用这个漏洞： https://googleprojectzero.blogspot.com/2017/05/exploiting-linux-kernel-via-packet.html "
-
[ Linux ] A collection of Linux kernel exploitation materials: https://github.com/xairy/linux-kernel-exploitation
" Linux Kernel Exploitation - 近几年 Linuxn 内核漏洞挖掘、漏洞分析、漏洞利用方面的资料整理： https://github.com/xairy/linux-kernel-exploitation "
-
[ MalwareAnalysis ] Malware injected into legitimate WordPress JavaScript file designed to reroute sensitive information https://threatpost.com/session-hijacking-cookie-stealing-wordpress-malware-spotted/125586/ via @ threatpost
" 对 Wordpress 进行会话劫持与 Cookie 窃取的恶意 JS 脚本被发现 ： https://threatpost.com/session-hijacking-cookie-stealing-wordpress-malware-spotted/125586/ "
-
[ Others ] On the #BHISblog today @joff_thyer is tearing it up - "How to Evade Application Whitelisting Using REGSVR32" https://t.co/k5IBHz80WF
" 如何使用 REGSVR32 绕过应用白名单： http://www.blackhillsinfosec.com/?p=5926 "
-
[ Others ] New blog post: Git Shell Bypass By Abusing Less (CVE-2017-8386) https://insinuator.net/2017/05/git-shell-bypass-by-abusing-less-cve-2017-8386/
" git-shell 是一个受限的 shell 环境，用于限制客户端对服务器端的可执行命令范围，这篇 Blog 介绍如何滥用 less 命令绕过这个限制（CVE-2017-8386）： https://insinuator.net/2017/05/git-shell-bypass-by-abusing-less-cve-2017-8386/ "
-
[ Pentest ] I wrote another blog post about using ETW for Intrusion Detection: https://blogs.technet.microsoft.com/office365security/hidden-treasure-intrusion-detection-with-etw-part-2/ #DFIR #ETW
" 基于 Windows ETW（事件日志）的入侵检测 part 2 ： https://blogs.technet.microsoft.com/office365security/hidden-treasure-intrusion-detection-with-etw-part-2/ "
-
[ Protocol ] Reverse Engineering Apple Location Services Protocol https://appelsiini.net/2017/reverse-engineering-location-services/ https://t.co/Pa91YqNFRB
" 逆向 Apple 位置服务协议（Location Services Protocol）： https://appelsiini.net/2017/reverse-engineering-location-services/ "
-
[ Tools ] JACKHAMMER - Security vulnerability assessment tool https://github.com/olacabs/jackhammer
" Jackhammer - 安全团队与开发团队之间协作的一个工具，用于漏洞评估和管理： https://github.com/olacabs/jackhammer "
-
[ Browser ] Pwn2Own 2017 再现上帝之手，来自腾讯湛泸实验室在 Pwn2Own 2017 比赛中利用 DVE 技术成功利用 Edge 漏洞(ArrayBuffer)的细节(CVE-2017-0234/0236)： http://weibo.com/ttarticle/p/show?id=2309404105928097034074
-
[ Browser ] 深入理解 EdgeHTML 渲染引擎的攻击面及其防护，原文来自 IBM X-Force 团队 Mark Vincent Yason 在 BlackHat 2015 会议的演讲，本文是来自知道创宇 xd0ol1 的翻译： http://paper.seebug.org/300/
-
[ Industry News ] 微软在昨天的更新中去掉了 IE/Edge 浏览器对 SHA-1 的支持： https://threatpost.com/microsoft-makes-it-official-cuts-off-sha-1-support-in-ie-edge/125579/