腾讯玄武实验室安全动态推送
Tencent Xuanwu Lab Security Daily News
-
[ Pentest ] 利用 Qualified 团队开发的在线代码运行引擎的漏洞，结合 SSRF，攻击 AWS metadata service： https://blog.christophetd.fr/abusing-aws-metadata-service-using-ssrf-vulnerabilities/
-
[ Windows ] Enumerating Job Objects (枚举 Windows Job 对象)： https://blogs.microsoft.co.il/pavely/2017/06/17/enumerating-job-objects/
-
[ Browser ] Google Chrome V8 slow/fast properties 类型混淆漏洞 (CVE-2014-3188)，沙箱逃逸 Exploit 的细节： https://bugs.chromium.org/p/chromium/issues/attachment?aid=63680
-
-
[ Windows ] Security baseline for Windows 10 “Creators Update” (v1703)（草案）： https://blogs.technet.microsoft.com/secguide/2017/06/15/security-baseline-for-windows-10-creators-update-v1703-draft/
-
[ Windows ] Windows 10 v1703 中去掉了 "Untrusted Font Blocking"（不可信字体禁止加载）设置选项，改为由 AppContainer 限制字体攻击面： https://blogs.technet.microsoft.com/secguide/2017/06/15/dropping-the-untrusted-font-blocking-setting/ 10:38:20
-
[ WirelessSecurity ] exploiting 802.11 wireless driver vulnerabilities on windows ，2007 年的一篇 Paper ： http://uninformed.org/?v=6&a=2&t=sumry