1月25日-每日安全知识热点

1、反向工程Apple的sysloged bug

https://reverse.put.as/2016/01/22/reversing-apples-syslogd-bug/

2、Magento的存储型漏洞

https://blog.sucuri.net/2016/01/security-advisory-stored-xss-in-magento.html

3、CVE-2015-4400:DoorBot门铃网络连接信息泄露

http://blog.fortinet.com/post/cve-2015-4400-backdoorbot-network-configuration-leak-on-a-connected-doorbell

4、公共旅游网站被种植RIG EK,下载QAKBOT恶意软件

http://blogs.forcepoint.com/security-labs/public-holidays-website-leads-rig-ek-drive-download-qakbot-malware

5、LeChiffre:手动运行的恶意欺诈软件

https://blog.malwarebytes.org/intelligence/2016/01/draft-lechiffre-a-manually-run-ransomware/

6、分析imminent monitor"RAT行为

https://itsjack.cc/blog/2016/01/imminent-monitor-4-rat-analysis-a-glance/

7、mona编译器开发第二部分:解析,第一部分http://jancorazza.com/2015/10/02/fundamentals-of-mona/在这里

http://jancorazza.com/2016/01/21/mona-compiler-development-part-2-parsing/

8、超过80+免费的技术书籍下载

https://www.syncfusion.com/resources/techportal/ebooks

9、移动应用渗透测试cheatsheet

https://www.peerlyst.com/blog-post/mobile-application-penetration-testing-cheat-sheet

10、Concurrent:一段bash脚本函数,支持多任务运行,并显示漂亮的输出

https://github.com/themattrix/bash-concurrent

11、FREEBSD安全团队检测到了他们的操作系统的几个严重的漏洞,包括CVE-2016-1879

http://blog.ptsecurity.com/2016/01/severe-vulnerabilities-detected-in.html

12、使用Beff和Google Drive来Hook浏览器

http://blog.beefproject.com/2016/01/hooked-browser-network-with-beef-and.html

13、onioncat:一个基于TOR的匿名VPN项目

https://www.onioncat.org/download/

14、广告恶意软件通过powershell改变DNS配置

https://blog.malwarebytes.org/security-threat/2016/01/trojan-dnschanger-circumvents-powershell-restrictions/

15、从内存中提取Pcap包

https://isc.sans.edu/diary/Extracting+pcap+from+memory+/20639

16、基于http缓存头的隐蔽定时通道(2014年的top 10 web技术)

http://www.slideshare.net/dnkolegov/wh102014

17、对于电话加密协议的不安全设计

https://www.benthamsgaze.org/2016/01/19/insecure-by-design-protocols-for-encrypted-phone-calls/

18、2016年5个最大的网络安全顾虑

http://www.networkworld.com/article/3023348/security/5-biggest-cybersecurity-concerns-facing-cios-cisos-in-2016.html

19、利用linux内核信息泄露绕过linux kASLR

https://marcograss.github.io/security/linux/2016/01/24/exploiting-infoleak-linux-kaslr-bypass.html

20、CVE-2014-7920 + CVE-2014-7921:android提权分析

http://bits-please.blogspot.com/2016/01/android-privilege-escalation-to.html

21、kali上配置vpn服务

http://www.hackingtutorials.org/general-tutorials/installing-vpn-on-kali-linux/

22、通过OpenGL hacking GCN

https://onedrive.live.com/view.aspx?resid=EBE7DEDA70D06DA0!107&app=PowerPoint&authkey=!AD-O3oq3Ung7pzk

23、amazon的客户服务后门

https://medium.com/@espringe/amazon-s-customer-service-backdoor-be375b3428c4#.8bx8f0511

24、php 5.6.10的phar_fix_filepath缓冲区溢出漏洞

https://cxsecurity.com/issue/WLB-2016010158