11月27日每日安全热点 - 某黑客组织通过终端API攻击Docker

360安全客 安全资讯 70066 4

漏洞 Vulnerability
CVE-2019-16241 TCL Alcatel Cingular Flip 2 B9HUAH1 设备PIN码验证绕过
https://twitter.com/CVEnew/status/1199368790938673153
[oss-security] Xen Security Advisory 306 v2
https://xenbits.xen.org/xsa/advisory-306.html
安全工具 Security Tools
Pigat：一款被动信息收集聚合工具
https://www.freebuf.com/sectool/219681.html
从0开始入门Chrome Ext安全（一）——了解一个Chrome Ext
https://www.anquanke.com/post/id/193666
Antispy – 免费的杀软和anti-rootkit工具
http://feedproxy.google.com/~r/PentestTools/~3/XkcKtXVulps/antispy-free-but-powerful-anti-virus.html
FIDL: FLARE’s IDA 反编译库
http://www.fireeye.com/blog/threat-research/2019/11/fidl-flare-ida-decompiler-library.html
AIEngine – AI驱动网络威胁检测引擎
https://twitter.com/Dinosn/status/1199005114855505921
安全报告 Security Report
卡巴2019 Q3季度欺诈和钓鱼报告
https://securelist.com/spam-report-q3-2019/95177/
安全事件 Security Incident
某黑客组织通过终端API攻击Docker
https://www.zdnet.com/article/a-hacking-group-is-hijacking-docker-systems-with-exposed-api-endpoints/#ftag=RSSbaffb68
恶意软件 Malware
新 ‘Ginp’ Android 木马主要针对信用卡攻击
http://feedproxy.google.com/~r/Securityweek/~3/R8hMEKv4oc4/new-ginp-android-trojan-targets-credentials-payment-card-data
俄罗斯窃密病毒通过.IMG文件攻击金融组织
https://gbhackers.com/raccoon-malware-2/
安全资讯 Security Information
专家发现飞机警示灯工控系统处于联网状态
https://securityaffairs.co/wordpress/94414/hacking/aircraft-warning-lights-hack.html
Facebook和Twitter警告部分用户被第三方sdk侵犯了隐私数据
https://www.tripwire.com/state-of-security/featured/facebook-twitter-private-data-accessed-sdk/#new_tab
黑五节日出现部分伪造域名
https://threatpost.com/black-friday-shoppers-scams-fake-domains/150593/
专家预计会有两个Apach Solr漏洞会被恶意利用
https://www.cbronline.com/news/apache-solr-vulnerabilities
多个APP受到类似whatsapp的GIF处理漏洞影响
http://feedproxy.google.com/~r/Securityweek/~3/WsOOzPBXUwM/many-apps-impacted-gif-processing-flaw-patched-recently-whatsapp
Palo Alto收购Aporeto增强其云安全能力
https://www.zdnet.com/article/palo-alto-networks-acquires-aporeto-for-cloud-security/#ftag=RSSbaffb68
（完）