【知识】12月08日 - 每日安全知识热点

热点概要：在ie8中利用ROP与Heap Spray利用反弹shell、Visa信用卡暴力破解，发现CVV和过期日期、反混淆AutoIt脚本、第一款针对Linux平台的僵尸网络恶意软件LuaBot

国内热词：

---

Google表示2017年将实现100%可更新能源

英国黑胶唱片销售额首次超过数字下载

在横幅广告像素中隐藏恶意代码

研究人员发现iPhone的激活锁可被绕开

中国用户报告iPhone起火，苹果否认是电池导致

资讯类：

---

黑客偷取了来自Major Cryptocurrency投资者的300,000美元

https://www.bleepingcomputer.com/news/security/hacker-steals-300-000-from-major-cryptocurrency-investor/

技术类：

---

恶意软件警告欺骗浏览器地址栏

https://www.brokenbrowser.com/spoof-addressbar-malware/

在ie8中利用ROP与Heap Spray利用反弹shell

https://woumn.wordpress.com/2016/12/07/rop-heap-spray-for-a-reverse-shell-in-ie8/

你的timeline故事值得一说

https://medium.com/@jberggren/your-timeline-is-a-story-worth-telling-6e2f2a9bfc0c#.ep66gxs2w

Visa信用卡暴力破解，发现CVV和过期日期

http://eprint.ncl.ac.uk/file_store/production/230123/19180242-D02E-47AC-BDB3-73C22D6E1FDB.pdf

webshell检测防护第四部分

https://dfir.it/blog/2016/12/07/webshells-rise-of-the-defenders-part-4/

对Broadcom wifi芯片的监控模式:bcmon

https://n0where.net/monitor-mode-for-broadcombcmon/

Trump Twitter Bot

https://webbreacher.com/2016/12/07/trump-twitter-bot/

Windows 10 和 Server 2012的Microsoft DirectAccess 远程访问

http://www.slideshare.net/kemptechnologies/microsoft-directaccess-remote-access-vpn-with-windows-10-and-server-2012

Hacking TalkTalk DSL-3680 router

http://antincode.com/post/138926308251/hacking-talktalk-dsl-3680-router

OpenSSH 7.2拒绝服务漏洞POC

https://packetstormsecurity.com/files/140070

Farewell to the SHA-1 Hash Algorithm

https://securingtomorrow.mcafee.com/mcafee-labs/farewell-sha-1-hash-algorithm/

Eventvwr无文件UAC绕过在Cobalt Strike 中的实现

https://www.mdsec.co.uk/2016/12/cna-eventvwr-uac-bypass/

PHP 7.1发行，增加异步信号处理，OpenSSL AEAD支持，HTTP/2服务端push

http://php.net/archive/2016.php#id2016-12-01-3

本月新的信息盗取恶意软件

https://www.proofpoint.com/us/threat-insight/post/august-in-december-new-information-stealer-hits-the-scene

Passwordreq No：黑客视角

https://room362.com/post/2016/passwordreq-no-a-hacker-prospective/

反混淆AutoIt脚本

http://lifeinhex.com/deobfuscating-autoit-scripts/

Microsoft Windows 10 x86/x64 WLAN AutoConfig Named Pipe Proof Of Concept

https://cxsecurity.com/issue/WLB-2016120041

Linux Kernel 4.4.0 (Ubuntu 14.04/16.04 x86-64) – 'AF_PACKET' 条件竞争导致的本地提权POC，具体细节可以参考安全客对该漏洞的预警http://bobao.360.cn/learning/detail/3267.html

https://www.exploit-db.com/exploits/40871/

通过静态分析和机器学习通过静态分析检测恶意软件预执行

https://sentinelone.com/blogs/detecting-malware-pre-execution-static-analysis-machine-learning/

LuaBot:第一款针对Linux平台的僵尸网络恶意软件

https://www.digitalmunition.me/2016/12/luabot-first-botnet-malware-target-linux-platforms/