5月11日每日安全知识热点

今天咨询报道的在野的0DAY攻击如下:

CVE-2016-0167 Windows LPE

CVE-2016-0189 IE RCE

CVE-2016-4117 Flash RCE

疑似http://sanimabank.com银行被黑,47m压缩文件提供下载,解压后504MB , 1,280个文件.大部分是网站ASP源码。

趋势Trend Micro Direct Pass的filter绕过以及xss漏洞

http://seclists.org/fulldisclosure/2016/May/26

GNURadio for windows更新,可以在windows平台解码 ATSC制式的HDTV

http://www.gcndevelopment.com/gnuradio/

利用ImageMagick获取Polyvore (已经被Yahoo收购)的RCE

http://nahamsec.com/exploiting-imagemagick-on-yahoo/

Rooting the Amazon Echo [PDF]

https://rbfi.io/dl.php?key=/w3kf/rooting_the_amazon_echo.pdf

滥用基于Intel的Paging Systems(页系统),这个文章是对https://www.coresecurity.com/system/files/CSW2016%20-%20Getting%20Physical%20-%20Extended%20Version.pdf的补充

https://blog.coresecurity.com/2016/05/10/getting-physical-extreme-abuse-of-intel-based-paging-systems-part-1/

讲述从My Computer zone(本地计算机zone)对其他site zone(受信任,受限制,本地intranet,internet)发起的CSRF攻击。

http://blog.gdssecurity.com/labs/2016/5/9/local-request-forgery.html

讲述json web令牌的威胁面(如果JWTs的签名不强能够被破解,将允许攻击者获取私钥,实现提权和水平/垂直权限提升)

https://www.notsosecure.com/crafting-way-json-web-tokens/

windows提权0day [CVE-2016-0167 ]被发现用与针对信用卡数据的攻击

https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html

针对韩国的IE 0day [ (CVE-2016-0189)] 攻击

http://www.symantec.com/connect/ko/blogs/internet-explorer-zero-day-exploit-used-targeted-attacks-south-korea

在线查找你邮箱或者账户信息是否泄漏的网站

https://www.leakedsource.com/main

介绍docker安全扫描器

https://blog.docker.com/2016/05/docker-secure-scanning/

分析Dridex第三部分

http://www.malwaretech.com/2016/05/lets-analyze-dridex-part-3.html

cisco-SNMP-enumeration工具更新,列举SNMP,暴力破解,下载破解文件

https://github.com/commonexploits/cisco-SNMP-enumeration/

滥用API和取证实现ios http缓存分析

https://blog.silentsignal.eu/2016/05/06/ios-http-cache-analysis-for-abusing-apis-and-forensics/

InstallUtil.exe SSH = Bypass  + Tunnels What Fun! (通过调用Renci.SshNet.dll实现ssh端口转发)

https://gist.github.com/subTee/60832e2867163c1f8e518d141672da99