2月8日安全热点 - HotSpot Shield VPN / iPhone 的iboot源码泄露

资讯类

美国司法部门控告了36名网络诈骗嫌疑犯，涉案金额高达5.3亿美元

http://www.zdnet.com/article/justice-department-indictment-february-cybercrime-ring/

 

CISCO第二次发布安全补丁来修复CISCO ASA中的一个严重漏洞

http://securityaffairs.co/wordpress/68826/security/cisco-asa-flaw.html

 

HotSpot Shield VPN客户端的一个漏洞可能会暴露用户的信息

https://threatpost.com/hotspot-shield-vulnerability-could-reveal-juicy-info-about-users-researcher-claims/129817/

 

iPhone 的iboot源码泄露

https://github.com/ZioShiba/iBoot

 

自动化黑客工具Autosploit可能导致大规模利用

http://securityaffairs.co/wordpress/68798/hacking/autosploit-hacking-tool.html

 

在这个危险的数字世界中防止WordPress黑客的9个技巧

9 Tips to Prevent WordPress Hacks in this Dangerous Digital World

 

技术类

是谁悄悄偷走了我的电：利用DNSMon批量发现被挂挖矿代码的域名

http://blog.netlab.360.com/who-is-stealing-my-power-web-mining-domains-measurement-via-dnsmon/

 

MalwareFox反恶意软件（zam64.sys） – 通过不正确的访问控制提权

http://rce4fun.blogspot.hk/2018/02/malwarefox-antimalware-zam64sys.html

https://cxsecurity.com/issue/WLB-2018020102

 

从补丁到漏洞分析 –记一次joomla漏洞应急

https://lorexxar.cn/2018/02/07/joomla3-8-4/

 

针对中东的攻击

http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html

 

Taking over Facebook accounts using Free Basics partner portal

https://www.josipfranjkovic.com/blog/facebook-partners-portal-account-takeover

 

USN-3559-1：Django漏洞

https://usn.ubuntu.com/usn/usn-3559-1

 

云安全风险（P2）：AWS CloudTrail中的CSV注入

https://rhinosecuritylabs.com/aws/cloud-security-csv-injection-aws-cloudtrail/

 

在Linux上使用.NET Core获取LTTng事件的堆栈

http://blogs.microsoft.co.il/sasha/2018/02/06/getting-stacks-for-lttng-events-with-net-core-on-linux

 

新白皮书 – DANDERSPRITZ / PEDDLECHEAP流量分析（第1部分）

https://blogs.forcepoint.com/security-labs/new-whitepaper-danderspritzpeddlecheap-traffic-analysis-part-1-2

 

Dissecting mobile native code packers

https://blog.zimperium.com/dissecting-mobile-native-code-packers-case-study

通过BMC颠覆您的服务器：HPE iLO4案例

https://airbus-seclab.github.io/ilo/RECONBRX2018-Slides-Subverting_your_server_through_its_BMC_the_HPE_iLO4_case-perigaud-gazet-czarny.pdf

 

Java反序列化漏洞-玄铁重剑之CommonsCollection(上)

https://xianzhi.aliyun.com/forum/topic/2028

 

iBoot Source Code Leaked

[Discussion] iBoot Source Code Leaked from jailbreak

 

利用Powershell获取System权限

https://www.secpulse.com/archives/68180.html

 

ReelPhish: 实时双因素钓鱼软件

https://www.fireeye.com/blog/threat-research/2018/02/reelphish-real-time-two-factor-phishing-tool.html

 

星图日志分析工具逆向

https://www.secpulse.com/archives/68199.html

 

镰刀 – shellcode开发工具

https://howucan.gr/scripts-tools/2851-sickle-shellcode-development-tool