SecWiki周刊（第37期)

SecWiki周刊（第37期）

2014/11/10-2014/11/16

安全资讯

[恶意分析] Iranian contractor named as Stuxnet 'patient zero
http://www.theregister.co.uk/2014/11/12/stuxnet_patient_zero/

[恶意分析] 能存活19年的bug不是bug
http://www.vaikan.com/a-19-years-old-bug/

[Web安全] 京东安全应急响应中心第二届安全沙龙15日开讲
http://bobao.360.cn/activity/detail/53.html

[Web安全] The Future of Incident Response
https://www.schneier.com/blog/archives/2014/11/the_future_of_i.html

[恶意分析] 黑暗旅馆APT剑指全球高管
http://www.secpulse.com/archives/2099.html

[移动安全] SANS：2014年安全分析与安全智能调研报告
http://yepeng.blog.51cto.com/3101105/1577208

[恶意分析] 互联网灰色产业链一角:流氓软件也挺”拼”的
http://blog.vulnhunt.com/index.php/2014/11/14/network_rogue_software/

[运维安全] Chinese Routing Errors Redirect Russian Traffic
http://research.dyn.com/2014/11/chinese-routing-errors-redirect-russian-traffic/

[Web安全] Sophisticated Targeted Attack Via Hotel Networks
https://www.schneier.com/blog/archives/2014/11/sophisticated_t.html

安全技术

[漏洞分析] IP.Board<=3.4.7 SQL注入漏洞（0day）POC
http://www.freebuf.com/vuls/50847.html

[其它] hctf writeup
http://anhkgg.gitcafe.com/hctf-writeup/

[比赛] CUIT 2014 Writeup
http://www.91ri.org/9482.html

[其它] 未知攻焉知防——XXE漏洞攻防
http://www.secpulse.com/archives/850.html

[比赛] uctf-杂项题目分析
http://drops.wooyun.org/tips/3349

[比赛] Hack.lu 2014 Writeup
http://drops.wooyun.org/tips/3420

[恶意分析] ICMP Reverse Shell
http://resources.infosecinstitute.com/icmp-reverse-shell/?utm_source=tuicool

[其它] 利用ROP绕过DEP
http://www.05112.com/anquan/gjbc/hkbc/2014/1105/16034.html

[工具] 用命令行录制屏幕操作视频
http://www.weibo.com/p/1001603776108683261811

[移动安全] Android伪关机
http://bbs.pediy.com/showthread.php?t=194369

[Web安全] 《安全参考》HACKCTO-201411-23
http://www.hackcto.com/post/2014-11-15/40064401666

[运维安全] WAF防御能力评测及工具
http://danqingdani.blog.163.com/blog/static/1860941952014101462723470/

[文档] Fedora Security Lab Test bench’s documentation
https://fedora-security-lab-test-bench.readthedocs.org/en/latest/#

[Web安全] HCTF2014 Writeup(通关攻略) 完美版
http://bobao.360.cn/news/detail/796.html

[编程技术] IP 库的那些事儿
https://www.evernote.com/shard/s1/sh/ecaa734a-f53f-4b92-a65b-f4b5be7cb8f3/931d01e038fdd256

[其它] Linux 服务安全器配置的20条建议
http://www.cyberciti.biz/tips/linux-security.html

[漏洞分析] Playing with MS14-060 and MS14-058 [CVE-2014-4113 CVE-2014-4114]
http://labs.jumpsec.com/2014/11/10/playing-ms14-060-ms14-058-cve-2014-4113-cve-2014-4114-attacks-defenses/

[无线安全] 用SDR分析未知HF信号:HDSDR+USRP+GNU Radio+RFMap
http://www.bilibili.com/video/av795582/index.html

[漏洞分析] CVE-2014-1767 Afd.sys double-free vulnerability Analysis and Exploit
http://www.secniu.com/cve-2014-1767-afd-sys-double-free-vulnerability-analysis-and-exploit/

[恶意分析] 金融攻击事件分析:Tyupkin样本技术分析及攻击过程还原
http://blog.vulnhunt.com/index.php/2014/11/11/tyupkin_analysi/

[编程技术] 版本管理工具介绍—Git篇
http://www.imooc.com/learn/208

[Web安全] 北京联合大学内网渗透小记
http://www.wooyun.org/bugs/wooyun-2014-077615

[设备安全] scada-tools
https://github.com/atimorin/scada-tools

[移动安全] AndroidManifest二进制文件010 Editor模板
http://bbs.pediy.com/showthread.php?p=1329824#post1329824

[无线安全] Spark：Open source IoT toolkit
https://www.spark.io/

[漏洞分析] 绕过百度杀毒溢出保护的一些方法
http://blog.jowto.com/?p=55

[取证分析] Extending the ELF Core Format for Forensics Snapshots
http://www.leviathansecurity.com/wp-content/uploads/2014_11_Ryan_Oneill_Extended-Core-Format-Snapshots.pdf

[Web安全] Zabbix的前台SQL注射漏洞利用
http://www.secpulse.com/archives/2089.html

[数据挖掘] 从贝叶斯方法谈到贝叶斯网络
http://blog.csdn.net/v_july_v/article/details/40984699

[设备安全] 西门子S7-1200 PLC识别指南与工具脚本
http://plcscan.org/blog/2014/11/s7-plc-discovery-tools-releases/

[漏洞分析] IBM X-Force Researcher Finds Significant Vulnerability in Microsoft Windows
http://securityintelligence.com/ibm-x-force-researcher-finds-significant-vulnerability-in-microsoft-windows/#.VGMkIDZpPBu

[Web安全] 第五季极客大挑战writeup
http://syclover.sinaapp.com/?p=369

[Web安全] Php Codz Hacking
http://www.80vul.com/pch/

[移动安全] AndroidManifest二进制文件格式分析
http://bbs.pediy.com/showthread.php?p=1329538#post1329538

[恶意分析] OnionDuke: APT Attacks Via the Tor Network
http://www.f-secure.com/weblog/archives/00002764.html

[编程技术] 谷歌公司发布程序员养成指南，推荐相关在线课程
http://mooc.guokr.com/post/610231/

[运维安全] 配置ModSecurity防火墙与OWASP规则
http://4shell.org/archives/85.html

[Web安全] 伪基站 + 钓鱼 = 完美黑产
http://zhuanlan.zhihu.com/wooyun/19890065

[漏洞分析] 安全科普：让高大上的Bash破壳漏洞不再难理解（下）
http://www.freebuf.com/articles/system/50707.html

[移动安全] AndroidManifest Ambiguity方案原理及代码
http://bbs.pediy.com/showthread.php?p=1329490#post1329490

[其它] 自动化渗透测试工具 – Heybe
http://www.freebuf.com/tools/50734.html

[漏洞分析] Bypassing Microsoft’s Patch for the Sandworm Zero Day
http://blogs.mcafee.com/mcafee-labs/bypassing-microsofts-patch-for-the-sandworm-zero-day-even-editing-can-cause-harm

[恶意分析] simple-rootkit：attack against gcc and Python via kernel module
https://github.com/mrrrgn/simple-rootkit

[移动安全] “破界”（WIRELURKER）综合分析报告
http://www.antiy.com/response/WireLurker.html

[漏洞分析] Critical Vulnerability and 'Godmode' Exploitation on CVE-2014-6332
http://blog.trendmicro.com/trendlabs-security-intelligence/a-killer-combo-critical-vulnerability-and-godmode-exploitation-on-cve-2014-6332/

[Web安全] HTML5和HTML4差异比较（工作草案）
http://www.w3.org/TR/2014/WD-html5-diff-20140918/

[Web安全] 子域名爆破软件dnsmap介绍
http://pan.baidu.com/s/1nt5HMw5

[运维安全] WireEdit:网络数据包编辑工具
https://wireedit.com/

[恶意分析] 假面攻击（Masque Attack）详细分析与利用
http://www.secpulse.com/archives/2123.html

[Web安全] clickjacking漏洞的挖掘与利用
http://drops.wooyun.org/web/3801

[恶意分析] TWC: Malware Hunting with Mark Russinovich and the Sysinternals Tools
http://channel9.msdn.com/Events/TechEd/NorthAmerica/2014/DCIM-B368#fbid=

[恶意分析] Website Malware Infections, Removal, and You
http://blog.sucuri.net/2014/11/the-art-of-website-malware-removal-the-basics.html

[恶意分析] 网络银行木马DYRE知多少（1）
http://blog.csdn.net/iqushi/article/details/41080457

[恶意分析] Observing the Havex RAT
http://www.netresec.com/?page=Blog&month=2014-11&post=Observing-the-Havex-RAT

[其它] XKungfoo2014安全会议全程纪实
http://www.freebuf.com/fevents/32658.html

[恶意分析] The G20 and the New Reality of Cyber Espionage
http://www.fireeye.com/blog/corporate/2014/11/the-g20-and-the-new-reality-of-cyber-espionage.html

[Web安全] 关于CTF的一些感想
http://le4f.net/post/essay/about-ctf

[Web安全] PHP文件包含漏洞总结
http://drops.wooyun.org/tips/3827

[恶意分析] Evolution of Upatre Trojan Downloader
http://research.zscaler.com/2014/11/evolution-of-upatre-trojan-downloader.html

[移动安全] 安卓Bug 17356824 BroadcastAnywhere漏洞分析
http://xteam.baidu.com/?p=77

[移动安全] Android Pattern Lock Cracker
https://github.com/sch3m4/androidpatternlock

[设备安全] 树莓派打造无线扫描仪.
http://drops.wooyun.org/wireless/3810

[Web安全] SSLStrip 终极版 —— location 劫持
http://drops.wooyun.org/web/3825

[设备安全] 追踪ICS扫描者（Trace ICS Scanner）
http://plcscan.org/blog/2014/11/trace-ics-scanner/

[编程技术] 小米11.11：海量数据压力下的推送服务
http://www.infoq.com/cn/news/2014/11/xiaomi-1111-pushservice

[Web安全] web扫描爬虫优化
http://drops.wooyun.org/tips/3831

[编程技术] Android运行时ART执行类方法的过程分析
http://blog.csdn.net/luoshengyang/article/details/40289405

[Web安全] WAP：Web Application Protection
http://sourceforge.net/projects/awap/

[Web安全] Zabbix的前台SQL注射漏洞0day
http://navisec.it/zabbix%E7%9A%84%E5%89%8D%E5%8F%B0sql%E6%B3%A8%E5%B0%84%E6%BC%8F%E6%B4%9E0day/

[Web安全] 渗透中寻找突破口的那些事
http://4shell.org/archives/63.html

[编程技术] CODE-PyconCN2014
https://github.com/xtao/CODE-PyconCN2014

[移动安全] Android Logcat Security
http://drops.wooyun.org/tips/3812

[移动安全] Abusing Samsung KNOX to remotely install a malicious application
http://blog.quarkslab.com/abusing-samsung-knox-to-remotely-install-a-malicious-application-story-of-a-half-patched-vulnerability.html

[无线安全] NFC手机：攻破交通卡
http://blog.avlyun.com/2014/11/1668/nfc-phone-fee-consumption/

[编程技术] 国内创业公司常用的服务
http://miao.hu/2014/11/14/startup-services/

[恶意分析] 一枚邪恶的输入法浅析
http://www.freebuf.com/articles/system/50579.html

[Web安全] BugMeNot: find and share logins
http://bugmenot.com/

[Web安全] How NSA's Cyber Warriors Helped Win (Sorta) The Last War in Iraq
http://www.matthewaid.com/post/102178369761/how-nsas-cyber-warriors-helped-win-sorta-the-last

[运维安全] 检测php网站是否已经被攻破的方法
http://4shell.org/archives/62.html

[编程技术] phantomjs小试牛刀
http://direwolf.gitcafe.com/2014/11/11/phantomjs%E5%B0%8F%E8%AF%95%E7%89%9B%E5%88%80/

[Web安全] When's document.URL not document.URL
http://tyranidslair.blogspot.co.uk/2014/11/whens-documenturl-not-documenturl-cve.html

-----微信ID：SecWiki-----
SecWiki，12年来一直专注安全技术资讯分析！
SecWiki：https://www.sec-wiki.com

本期原文地址: SecWiki周刊(第37期)

SecWiki周刊（第37期）

最新公告

友情链接

SecWiki公众号

安全学术圈