7月01日-每日安全知识热点

技术类:

攻击KeePass的案例学习

http://www.harmj0y.net/blog/redteaming/a-case-study-in-attacking-keepass/

攻击android全盘加密:提取Qualcomm的KeyMaster密钥

https://bits-please.blogspot.com/2016/06/extracting-qualcomms-keymaster-keys.html

CDitter:依靠cd-rom的闭合来提取数据

https://www.anfractuosity.com/projects/cditter/

利用elf扩展变量

http://backtrace.io/blog/blog/2016/06/29/exploiting-elf-expansion-variables/

百万流行的俄罗斯站点受到信息窃取恶意软件的影响,样本分析在https://blogs.forcepoint.com/security-labs/rig-exploit-kit-makes-sprash-russia

http://www.infosecurity-magazine.com/news/top-russian-site-exposes-millions/

破解Locky的新的反沙盒技术

https://blog.fortinet.com/2016/06/30/cracking-locky-s-new-anti-sandbox-technique

联想thinkpad系统管理模式任意代码执行poc

https://github.com/Cr4sh/ThinkPwn

绕过应用白名单

http://insights.sei.cmu.edu/cert/2016/06/bypassing-application-whitelisting.html

Veil-Evasion更新到v2.27.1

https://github.com/Veil-Framework/Veil-Evasion

Hashcat v3.00发行

https://hashcat.net/forum/thread-5559.html

新的 SQL PowerShell模块

https://blogs.technet.microsoft.com/dataplatforminsider/2016/06/30/sql-powershell-july-2016-update/

新的钓鱼欺骗技术:钓鱼邮件会先询问你的邮箱账号然后才让你看整个文档

https://isc.sans.edu/diary/Phishing+Campaign+with+Blurred+Images/21207

发现新的CryptXXX变种

https://sentinelone.com/blogs/new-cryptxxx-variant-discovered/

Debian Exim Spool 本地root提权漏洞,POC在http://www.halfdog.net/Security/2016/DebianEximSpoolLocalRoot/EximUpgrade.c

http://www.openwall.com/lists/oss-security/2016/06/30/2

LibreOffice也能被用像微软office一样来做恶意软件分发

http://www.talosintelligence.com/reports/TALOS-2016-0126/

介绍世界范围的SMS 消息

https://mobile.awsblog.com/post/TxSP0HUNM8FQ1Y/Introducing-Worldwide-SMS-Messaging

没有杀软的时候如何分析恶意的宏

http://decalage.info/mraptor

分析satana恶意欺诈勒索软件

https://blog.malwarebytes.com/threat-analysis/2016/06/satana-ransomware/

适用installUtil.exe解锁powershell的ConstrainedLanguage模式

http://subt0x10.blogspot.com/2016/06/unlock-powershell-constrainedlanguage.html

资讯类:

Oculus的ceo twiter账号被黑

http://www.cnet.com/news/oculus-ceos-twitter-gets-hacked/

大约有4亿foxit用户需要打补丁

http://www.theregister.co.uk/2016/07/01/foxit_patches_756/?utm_medium=twitter&utm_source=twitterfeed

数据大规模扩散往往意味着伴随大规模网络欺骗的到来,要注意

http://www.infosecurity-magazine.com/blogs/breaches-mean-fraud-spikes-so-be/

针对医院医疗设备劫持的攻击

http://www.itproportal.com/2016/06/28/new-medical-hijack-attacks-targeting-hospital-devices/

数据泄露消息:

穆斯林交友网站MuslimMatch.com 数据泄露