12月5日安全热点 - 仙女座僵尸网络/勒索软件新变种

 

资讯类

Leakbase.pw被黑，网站被导向社工库

https://www.bleepingcomputer.com/news/security/leakbase-pw-hacked-password-service-goes-dark/

 

ICS-CERT（美国工控系统计算机应急响应团队）就如何在工业环境中更新杀毒软件提出建议，但有安全专家认为这些建议并不够实用，杀毒软件并不是工控系统安全的保证
http://www.securityweek.com/ics-cert-advice-av-updates-solid-impractical

 

多家执法机构合作取缔仙女座僵尸网络，此网络自2011年开始活跃，分发了非常多的恶意软件，关于此次行动的细节ESET发布了安全报告

http://securityaffairs.co/wordpress/66343/cyber-crime/andromeda-botnet-dismantled.html

https://www.welivesecurity.com/2017/12/04/eset-takes-part-global-operation-disrupt-gamarue/

 

安全研究员发现新的Shadow BTCware Ransomware变种，中招的用户只能免费解密3个小于1MB的文件

http://securityaffairs.co/wordpress/66331/malware/new-shadow-btcware-ransomware.html

 

美国证券交易委员会打响电子货币犯罪第一枪，ICO被冻结

https://www.theregister.co.uk/2017/12/05/secs_cybercops_cyberfile_cyberfirst_cyberfraud_cybercharges/

 

谷歌开始打击未经用户允许收集用户资料的安卓应用

https://www.bleepingcomputer.com/news/security/google-to-crack-down-on-android-apps-that-collect-user-data-without-consent/

 

技术类

Struts2：S2-054、S2-055调查报告
https://github.com/SecureSkyTechnology/study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017-15095

 

共享密码的风险与现状

https://www.troyhunt.com/the-trouble-with-politicians-sharing-passwords/

 

img标签的进化：没有GIF的Gif

https://calendar.perfplanet.com/2017/animated-gif-without-the-gif/

 

PocketBeagle的手工制作

http://www.righto.com/2017/12/hands-on-with-pocketbeagle-tiny-25.html

 

深入剖析LLVM混淆工具

https://blog.rpis.ec/2017/12/dissection-llvm-obfuscator-p1.html

 

ECDSA私钥与DSA签名恢复工具

https://github.com/tintinweb/ecdsa-private-key-recovery

 

安卓中的ARM Mode与Thumb Mode

https://userpc.net/2017/12/04/arm-mode-thumb-mode-classification-android/

 

STARTTLS Stripping Attack PoC

https://github.com/tintinweb/striptls

 

基于Bigquery构建内容发现Wordlist

https://pentester.io/commonspeak-bigquery-wordlists/

 

基于神经网络的恶意软件检测

https://devblogs.nvidia.com/parallelforall/malware-detection-neural-networks/

 

NSJail与沙盒Imagemagick

https://offbyinfinity.com/2017/12/sandboxing-imagemagick-with-nsjail/

 

渗透测试与.NET执行文件 Part2

https://www.peew.pw/blog/2017/12/4/writing-net-executables-for-penteters-part-2

 

Plaso Heimdall介绍

https://www.youtube.com/watch?v=JZGfhd1PNhU

 

CNI-IPVLAN-VPC-K8S

https://eng.lyft.com/announcing-cni-ipvlan-vpc-k8s-ipvlan-overlay-free-kubernetes-networking-in-aws-95191201476e