12月10日-每日安全知识热点

1、先进的图像隐写算法和最新策略

http://research.ijcaonline.org/nwnc/number3/nwnc1439.pdf

2、关于隐写技术的一些记录

http://old.di.unisa.it/professori/ads/corso-security/www/CORSO-0203/steganografia/LINKS%20LOCALI/matrix-encoding.pdf

3、如何使用免费的SSL证书安装在你的站点上

http://thehackernews.com/2015/12/How-to-Install-Lets-Encrypt-SSL-Certificate.html

4、网络安全最佳实践PAPER

http://net-security.tradepub.com/free/w_hp469/prgm.cgi

5、ICS蜜罐的指纹识别

http://xiphosresearch.com/2015/12/09/OPSEC-For-Honeypots.html

6、一个跨数据库和操作系统的基于桌面或终端的轻量级SQL客户端

https://sqlectron.github.io/

7、配置APACHE减缓DDOS攻击

https://securityintelligence.com/defending-against-apache-web-server-ddos-attacks/

8、sqlmap的–pickled-options选项未处理异常问题,原理在https://blog.nelhage.com/2011/03/exploiting-pickle/

https://github.com/sqlmapproject/sqlmap/issues/1592

9、DELL发布的地下黑市调查报告

http://www.secureworks.com/assets/pdf-store/white-papers/wp-underground-hacking-report.pdf

10、spartan:frontpage和sharepoint指纹识别及攻击工具

https://github.com/sensepost/SPartan

11、packrat:连续7年的南美威胁

https://citizenlab.org/2015/12/packrat-report/

12、windows媒体中心的漏洞分析与利用

https://blog.coresecurity.com/2015/12/09/exploiting-windows-media-center/

13、如何使用netzob逆向未知的协议

http://blog.amossys.fr/How_to_reverse_unknown_protocols_using_Netzob.html

14、ios9的content blockers漏洞导致可以跟踪浏览器历史

http://blog.appgrounds.com/content-blockers-track-browser-history/

15、Linksys EA6100 无线路由器认证绕过漏洞

https://www.korelogic.com/Resources/Advisories/KL-001-2015-006.txt

16、Chrome's setup.exe 允许任意文件代码执行和提权

http://seclists.org/fulldisclosure/2015/Dec/35

17、使用RTF文件作为恶意软件的传递载体

http://phishme.com/rtf-malware-delivery/

18、加强公共密钥认证阻止KEY盗窃

http://martin.kleppmann.com/2015/12/08/preventing-key-theft-at-passwords15.html

19、COM+服务DLL loading漏洞利用分析(MS15-132已经修补)

https://www.securify.nl/advisory/SFY20150801/com__services_dll_side_loading_vulnerability.html

20、一例以“采访”为社工手段的定向木马攻击分析

http://www.antiy.com/response/RemoteABC/RemoteABC.pdf

21、通过收件人的电子邮件地址SMTP注射

http://www.mbsd.jp/Whitepaper/smtpi.pdf

22、邮件发送 JS 脚本传播敲诈者木马的分析报告

http://www.antiy.com/response/TeslaCrypt2/TeslaCrypt2.pdf

23、利用chakra引擎中的JIT编译器绕过DEP和CFG

http://xlab.tencent.com/en/2015/12/09/bypass-dep-and-cfg-using-jit-compiler-in-charkra-engine/

24、使用POWERSHELL增强USB存储策略

https://isc.sans.edu/diary/Enforcing+USB+Storage+Policy+with+PowerShell/20469