12月23日每日安全热点 - 黑客免费公布 27 万加密货币钱包 Ledger 用户信息

360安全客 安全资讯 23496 4

漏洞 Vulnerability
FreeBSD ftpd chroot 本地提权漏洞分析（CVE-2020-7468）
https://www.zerodayinitiative.com/blog/2020/12/21/cve-2020-7468-turning-imprisonment-to-advantage-in-the-freebsd-ftpd-chroot-jail
MICROSOFT EXCHANGE远程执行代码-CVE-2020-16875补丁绕过
https://www.x41-dsec.de/security/advisory/exploit/research/2020/12/21/x41-microsoft-exchange-rce-dlp-bypass/
安全工具 Security Tools
FORESCOUT RESEARCH LABS发布了PROJECT MEMORIA TCP / IP堆栈检测器
https://www.forescout.com/company/blog/forescout-research-labs-releases-the-project-memoria-tcpip-stack-detector/
安全报告 Security Report
NCCGroup 对多款智能门铃 IoT 设备的安全分析报告
https://research.nccgroup.com/2020/12/18/domestic-iot-nightmares-smart-doorbells/
安全事件 Security Incident
印度Telangana政府站点因配置错误导致13万份文件泄露
https://gadgets.ndtv.com/internet/news/telangana-government-data-leak-breach-employees-pensioners-privacy-2340513
政府工作人员使用NSO Group的Pegasus间谍软件入侵半岛电视台记者
https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hacked-with-suspected-nso-group-imessage-zero-click-exploit/
Facebook Business Suite应用程序漏洞可导致在Instagram上查看任何人的私人电子邮件和生日
https://medium.com/nassec-cybersecurity-writeups/this-is-how-i-was-able-to-view-anyones-private-email-and-birthday-on-instagram-1469f44b842b
黑客免费公布 27 万加密货币钱包 Ledger 用户信息
http://hackernews.cc/archives/34244
安全研究 Security Research
Android Kernel Exploitation Workshop
https://cloudfuzz.github.io/android-kernel-exploitation/chapters/exploitation.html
绕过cobalt strike在使用.NET assemblies时的大小限制
https://redteamer.tips/a-tale-of-net-assemblies-cobalt-strike-size-constraints-and-reflection/
通过嗅探 TPM SPI 接口的流量泄漏 BitLocker 全盘加密 Key
https://labs.f-secure.com/blog/sniff-there-leaks-my-bitlocker-key/
（完）