10月7日每日安全热点 - iOS app安全研究——Slide

2020-10-07 11:11:35 360安全客安全资讯 82624 4

漏洞 Vulnerability

Chrome 86.0.4240.75版本发布，修复35个漏洞

https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html

Android 十月安全更新通告

https://source.android.com/security/bulletin/2020-10-01

CVE-2020-8243：利用Pulse Connect Secure 中的模板注入进行RCE

https://research.nccgroup.com/2020/10/06/technical-advisory-pulse-connect-secure-rce-via-template-injection-cve-2020-8243/

恶意软件 Malware

恶意样本MaliciousMacroMSBuild 和Cobalt Strike Stager的分析

https://pmelson.blogspot.com/2020/10/analysis-of-maliciousmacromsbuild.html

Kraken：一种利用Windows错误报告的无文件APT攻击

https://blog.malwarebytes.com/malwarebytes-news/2020/10/kraken-attack-abuses-wer-service/

HEH：一种利用脆弱的telnet服务的新型物联网P2P僵尸网络

https://blog.netlab.360.com/heh-an-iot-p2p-botnet/

安全研究 Security Research

5分钟快速使用cargo-fuzz / libfuzzer fuzz Rust library教程

https://academy.fuzzinglabs.com/fuzzing-popular-rust-library-in-5-min-using-cargo-fuzz-libfuzzer

HashiCorp Vault中的验证问题研究

https://googleprojectzero.blogspot.com/2020/10/enter-the-vault-auth-issues-hashicorp-vault.html

iOS app安全研究——Slide

https://speakerdeck.com/vashchenko/ios-application-security

高效分析Linux内核源码

https://mp.weixin.qq.com/s/AuLTFDmAnEWOgR_DhM4doQ

安全工具 Security Tools

sploit：用于帮助安全人员进行二进制利用工具

https://github.com/zznop/sploit

IoT安全研究工具

https://github.com/IoT-PTv/List-of-Tools

（完）