腾讯玄武实验室安全动态推送
Tencent Xuanwu Lab Security Daily News
-
[ Browser ] About the security content of Safari 10.1.1 https://support.apple.com/en-us/HT207804
" Safari 10.1.1 安全更新内容： https://support.apple.com/en-us/HT207804 "
-
[ Browser ] The tl;dr here is: smaller memory footprint, better real-world perf, and some nice JIT security improvements. https://v8project.blogspot.de/2017/05/launching-ignition-and-turbofan.html
" V8 从 5.9 版本开始将切换至 Ignition 解释器和 TurboFan 编译器，性能将有重大提升，以前的 Full-codegen 和 Crankshaft 编译器很快就会被移除： https://v8project.blogspot.com/2017/05/launching-ignition-and-turbofan.html "
-
[ Industry News ] WordPress Now on HackerOne https://wordpress.org/news/2017/05/wordpress-now-on-hackerone/
" WordPress 现已入驻 HackerOne 平台 ： https://wordpress.org/news/2017/05/wordpress-now-on-hackerone/ "
-
[ Industry News ] United Airlines cockpit codes released to the public http://www.zdnet.com/article/united-airlines-cockpit-codes-released-to-the-public/#ftag=RSSbaffb68
" 美联航的驾驶舱机密代码（cockpit codes）意外泄露： http://www.zdnet.com/article/united-airlines-cockpit-codes-released-to-the-public/#ftag=RSSbaffb68 "
-
[ iOS ] About the security content of macOS Sierra 10.12.5 https://support.apple.com/en-us/HT207797
" Apple 发布 iOS 10.3.2 和 macOS Sierra 10.12.5，本次更新修复了多个漏洞， iOS： https://support.apple.com/en-us/HT207798 macOS： https://support.apple.com/en-us/HT207797 "
-
[ Malware ] Excellent #WannaCry resource sheet: https://gist.github.com/rain-1/989428fa5504f378b993ee6efbc0b168 @ MalwareTechBlog @ hackerfantastic
" WannaCry 相关信息汇总: https://gist.github.com/rain-1/989428fa5504f378b993ee6efbc0b168 "
-
[ MalwareAnalysis ] We just published an analysis of the #Lazarus/#Wannacry similarities found by @ neelmehta - https://securelist.com/blog/research/78431/wannacry-and-lazarus-group-the-missing-link/
" 卡巴斯基和 Google 的研究员分析发现，WannaCry 的样本与 Lazarus APT 组织 2015 年的某个样本存在代码相似性，并据此推断 WannaCry 蠕虫勒索事件的幕后组织来自朝鲜： https://securelist.com/blog/research/78431/wannacry-and-lazarus-group-the-missing-link/ "
-
[ Others ] Tweet is for a silent, "fileless" UAC bypass on Win10 which should be fixed in RS3 :-). Bit more info on my blog https://tyranidslair.blogspot.co.uk/2017/05/exploiting-environment-variables-in.html
" 利用计划任务（Scheduled Tasks）中的环境变量实现 UAC Bypass，来自 James Forshaw: https://tyranidslair.blogspot.com/2017/05/exploiting-environment-variables-in.html "
-
[ Others ] Help me test our latest #nmap NSE script to check Windows machines vulnerable to ms17-010 #smb #WannaCry #infosec https://t.co/um12vdnjGt
" Nmap 发布针对 ms17-010 漏洞的探测脚本smb-vuln-ms17-010.nse： http://seclists.org/nmap-dev/2017/q2/79 "
-
[ Pentest ] [Blog] Empire - Modifying Server C2 Indicators, follow-up to @bluscreenofjeff recent post on #Empire C2 profiles https://t.co/VXaNY5BN1G
" 修改 Power Empire 的 C2 服务器配置以绕过特征检测： http://threatexpress.com/2017/05/empire-modifying-server-c2-indicators/ "
-
[ Popular Software ] I just realized I didn't release the slides for my talk @ MS BlueHat and Tencent TenSec last Nov., so here you go https://sites.google.com/site/zerodayresearch/Analysis_of_the_Attack_Surface_of_Microsoft_Office_from_User_Perspective_final.pdf.
" 从用户角度出发分析 Microsoft Office 的攻击面，来自 Haifei Li 在 BlueHat 的演讲： https://sites.google.com/site/zerodayresearch/Analysis_of_the_Attack_Surface_of_Microsoft_Office_from_User_Perspective_final.pdf "
-
[ Tools ] Reverse engineer 200 binaries with the mechanical efficiency of symbolic execution http://blog.trailofbits.com/2017/05/15/magic-with-manticore/ https://t.co/ESGwAQgMpf
" 使用 Manticore 解决 DEFCON CTF 二进制分析题目 - Magic 的详细方法： https://blog.trailofbits.com/2017/05/15/magic-with-manticore/ "
-
[ Tools ] WikiLeaks publishes "AfterMidnight" and "Assassin", two CIA malware frameworks for the Microsoft Windows platform. - https://wikileaks.org/vault7/releases/#AfterMidnight
" 上周五 WikiLeaks 又公开了两个 CIA 所用的 Windows 平台的恶意代码框架 - AfterMidnight（午夜之后）和 Assassin（刺客）： https://wikileaks.org/vault7/releases/ "
-
[ Tools ] It's finally here: https://xorrior.com/2.0-Final-Release/ cc @ 424f424f @ harmj0y @ Killswitch_GUI @ sixdub @ enigma0x3 Enjoy!?
" 渗透测试攻击框架 Empire 更新 2.0 版本： https://github.com/EmpireProject/Empire https://xorrior.com/2.0-Final-Release/ "
-
[ Windows ] Windows Kernel stack memory disclosure in win32k!xxxClientLpkDrawTextEx https://bugs.chromium.org/p/project-zero/issues/detail?id=1182
" Windows 内核驱动 win32k!xxxClientLpkDrawTextEx 在触发 user-mode callback 时会泄露内核栈上 4 字节的内存（CVE-2017-0245）： https://bugs.chromium.org/p/project-zero/issues/detail?id=1182 "
-
[ Windows ] Windows Kernel pool memory disclosure in nt!NtTraceControl (EtwpSetProviderTraits) https://bugs.chromium.org/p/project-zero/issues/detail?id=1161
" Windows 内核 EtwpSetProviderTraitsUm Kernel Pool 内存泄漏漏洞（CVE-2017-0259）： https://bugs.chromium.org/p/project-zero/issues/detail?id=1161 "
-
[ Windows ] Windows Kernel uninitialized memory in the default dacl descriptor of system processes' token https://bugs.chromium.org/p/project-zero/issues/detail?id=1145
" lsass.exe, services.exe 等进程的 token 的 default DACL 中存在 8 字节未初始化的内存（CVE-2017-0258）： https://bugs.chromium.org/p/project-zero/issues/detail?id=1145 "
-
[ Windows ] Windows Kernel pool-based out-of-bound reads due to bugs in the implementation of bind() in afd.sys and tcpip.sys https://bugs.chromium.org/p/project-zero/issues/detail?id=1127
" Windows 内核驱动 afd.sys 和 tcpip.sys 在实现 Socket bind() 时存在内存越界读漏洞（CVE-2017-0175/0220）： https://bugs.chromium.org/p/project-zero/issues/detail?id=1127 "
-
[ Windows ] 0patching the "Worst Windows Remote Code Execution Bug in Recent Memory" CVE-2017-0290 https://0patch.blogspot.com/2017/05/0patching-worst-windows-remote-code.html
" 0patch 团队为 Tavis 发现的 Windows 反病毒引擎中的 mpengine RCE 漏洞写了一个第三方补丁（CVE-2017-0290）： https://0patch.blogspot.com/2017/05/0patching-worst-windows-remote-code.html "
-
[ Windows ] Stealing Windows credentials using Google Chrome https://www.helpnetsecurity.com/2017/05/15/stealing-windows-credentials-using-google-chrome/
" 2015 年有研究者展示了利用 SMB 文件共享协议认证的缺陷偷用户凭据的信息，当时的展示都是基于 IE 和 Edge 浏览器的。这篇 Blog 中作者介绍如何利用 .scf 文件在 Chrome 上实现攻击： https://www.helpnetsecurity.com/2017/05/15/stealing-windows-credentials-using-google-chrome/ 2015年的研究： https://www.blackhat.com/docs/us-15/materials/us-15-Brossard-SMBv2-Sharing-More-Than-Just-Your-Files.pdf 还有一篇相关的文章《SPEAR: Redirect to SMB》： https://www.cylance.com/redirect-to-smb "
