每日安全动态推送(10-31)
2023-10-31 17:37:2 Author: mp.weixin.qq.com(查看原文) 阅读量:0 收藏

Tencent Security Xuanwu Lab Daily News

• Testing Compilers:
https://www.fuzzingbook.org/html/PythonFuzzer.html

   ・ 利用语法和基于语法的测试来系统地生成程序代码,以python为例 – SecTodayBot

• [vim-security] integer overflow in :history command in Vim < 9.0.2068:
https://seclists.org/oss-sec/2023/q4/186

   ・ Vim < 9.0.2068版本中的:history命令存在整数溢出漏洞,可能导致整数溢出和潜在的use-after-free问题。 – SecTodayBot

• Complex Spy Platform StripedFly Bites 1M Victims:
https://www.darkreading.com/threat-intelligence/complex-spy-platform-stripedfly-bites-1m-victims-disguised-as-a-cryptominer

   ・ StripedFly被误认为仅是一个加密货币挖矿程序,但实际上是一个复杂的间谍平台,已感染超过100万受害者。该恶意软件具备持久性入侵网络、全面监控活动并窃取凭证和其他数据的能力。 – SecTodayBot

• LIVE from Pwn2Own Toronto '23 - SEFCOM T0 targeting the Wyze Cam v3:
https://youtube.com/live/btrGDtJpzG4?feature=share

   ・ SEFCOM T0在Pwn2Own Toronto 23现场演示了对Wyze Cam v3的攻击 – SecTodayBot

• EVM Diff:
https://www.evmdiff.com/

   ・ EVM Diff,对比执行层上不同链的区别 – SecTodayBot

• CVE-2023-4632: Local Privilege Escalation in Lenovo System Updater:
http://enigma0x3.net/2023/10/26/cve-2023-4632-local-privilege-escalation-in-lenovo-system-updater/

   ・ Lenovo System Updater存在本地权限提升漏洞,攻击者可通过任意文件写入实现特权升级。 – SecTodayBot

• The single-packet attack: making remote race-conditions 'local':
https://portswigger.net/research/the-single-packet-attack-making-remote-race-conditions-local

   ・ 单数据包攻击是一种触发网络竞争条件的新技术,通过使用单个TCP数据包完成多个HTTP/2请求,有效消除了网络抖动,使得远程竞争条件与本地一样容易被利用。 – SecTodayBot

• Cascade: CPU Fuzzing via Intricate Program Generation:
http://comsec.ethz.ch/cascade

   ・ Cascade: CPU Fuzzing via Intricate Program Generation – SecTodayBot

• LXD for security research:
https://bo-tato.github.io/2023/10/22/lxd-for-security-research.html

   ・ 使用LXD进行安全研究的好处:统一容器和虚拟机接口,更好的安全性,默认快速快照,支持Wifi工具和Xorg应用程序。 – SecTodayBot

• #OBTS v6.0: "iObfuscate Unraveling iOS Obfuscation Techniques" - Laurie Kirk:
https://youtube.com/watch?v=5JuSp_7Xf1o

   ・ 揭秘iOS混淆技术 – SecTodayBot

* 查看或搜索历史推送内容请访问:
https://sec.today

* 新浪微博账号:腾讯玄武实验室
https://weibo.com/xuanwulab


文章来源: https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651959404&idx=1&sn=e378f7b45b5a23a1fec03d41434bca65&chksm=8baed0f3bcd959e53ca5ad8f8a49200eef0b6797ee08804d8bd27f4be8244df5c942fb9c8e88&scene=58&subscene=0#rd
如有侵权请联系:admin#unsafe.sh