Tencent Security Xuanwu Lab Daily News

• ARM TrustZone: pivoting to the secure world:
https://blog.thalium.re/posts/pivoting_to_the_secure_world/

   ・ ARM TrustZone是网络安全相关的重要技术，该文章讨论了发现的两个漏洞以及对其进行利用来实现代码执行的详细分析。 – SecTodayBot

• DY Fuzzing: Formal Dolev-Yao Models Meet Cryptographic Protocol Fuzz Testing:
https://buff.ly/4aVNKbd

   ・ 提出了一种新颖而有效的技术，即DY模型引导的模糊测试，用于加密协议的模糊测试，通过对三种流行的TLS实现进行模糊测试，发现了四个新漏洞。 – SecTodayBot

• CNEXT exploits:
https://github.com/ambionics/cnext-exploits/tree/main

   ・ 介绍了针对glibc的iconv()函数的漏洞利用 – SecTodayBot

• Decoding the Caesar Cipher Skimmer:
https://sucur.it/3zaqxVz

   ・ 介绍了一种新型的信用卡窃取攻击，该文章详细分析了这种新skimmer攻击的工作原理，以及它是如何注入到不同的CMS平台中的。 – SecTodayBot

• QR Code-Embedded PDFs exploit Financial Institutions via ONNX Store:
https://www.broadcom.com/support/security-center/protection-bulletin/qr-code-embedded-pdfs-exploit-financial-institutions-via-onnx-store

   ・ 讨论了针对金融机构的利用QR码嵌入的PDF文件的漏洞利用 – SecTodayBot

• Ace The Game:
https://github.com/KuhakuPixel/AceTheGame

   ・ 介绍了一款名为Ace The Game的开源黑客工具，该工具可用于操作Android应用程序的内存，包括冻结和更改内存数值，绕过付款方式，并具有适用于rooted和non-rooted Android设备的功能。这款工具在Blackhat Arsenal上展示。 – SecTodayBot

• MongoDB NoSQL Injection with Aggregation Pipelines:
https://soroush.me/blog/2024/06/mongodb-nosql-injection-with-aggregation-pipelines/

   ・ 介绍了MongoDB中一个新的NoSQL注入攻击漏洞 – SecTodayBot

• Zip Slip meets Artifactory: A Bug Bounty Story:
https://karmainsecurity.com/zip-slip-meets-artifactory-a-bug-bounty-story

   ・ JFrog Artifactory中的Zip Slip漏洞被披露，文章详细分析了漏洞的根本原因，并解释了路径遍历漏洞。 – SecTodayBot

• Reverse Engineering The Unicorn:
https://www.somersetrecon.com/blog/2024/6/5/reversing-the-unicorn

   ・ 讨论了发现一个名为unicorn的开发工具相关的二进制文件，通过对其进行逆向工程分析，揭示了潜在的安全隐患 – SecTodayBot

• Sponsored by:
https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell/tree/master

   ・ 讨论了多种绕过Antimalware Scan Interface (AMSI)的方法，包括ScriptBlock Smuggling、Reflection ScanContent Change、Using Hardware Breakpoints等多种绕过技术 – SecTodayBot

* 查看或搜索历史推送内容请访问：
https://sec.today

* 新浪微博账号： 腾讯玄武实验室
https://weibo.com/xuanwulab