重大漏洞预警 | 疑似影响过万iOS应用的ZipperDown漏洞来了！微博、陌陌、快手、网易云音乐、QQ音乐均受影响！
Turla 在 Adobe Flash Player 植入后门欺骗用户下载安装
WhatsApp漏洞可能会让“潜在攻击者”对加密群组聊天进行监视
运营商劫持加入挖矿大军，波及十余省辽宁重灾区
最新资讯 全部 >

Critical Flaws in Sierra Wireless 5G Gateway Allow RCE, Command Injection

A 5G wireless gateway tailored for industrial internet of things (IoT), retail point-of-sale and enterprise redundancy applications is riddled with vulnerabilities, include two critical bugs that allow remote code-execution (RCE) and arbitrary command-injection.

七天前

工具 | PoCBox - 漏洞测试验证辅助平台

PoCBox功能： 生成漏洞验证代码（便于撰写报告）、在线测试（便于快速手工测试）

七天前

漏洞分析 | CVE-2019-3462 — apt/apt-get远程代码执行漏洞分析

apt/apt-get远程代码执行漏洞分析

七天前

Android | 逆向安卓版本McDonald应用

本文将对McDonald的安卓版本应用进行逆向分析。

七天前

fuzz | FoRTE-Research's Fuzzing Benchmarks

This repository contains a collection of benchmarks and seed inputs to make fuzzing research more readily comparable and reproducable. For instructions on installing and running a given benchmark, refer to the readme file in its respective directory.

七天前

Mobile phishing by the numbers

In a report published in 2011, IBM revealed that mobile users are three times more likely to fall for phishing scams compared to desktop users. This claim was based on accessed log files found on Web servers used to host websites involved in phishing campaigns.

七天前

STOLEN PENCIL Campaign Targets Academia

ASERT has learned of an APT campaign, possibly originating from DPRK, we are calling STOLEN PENCIL that is targeting academic institutions since at least May 2018. The ultimate motivation behind the attacks is unclear, but the threat actors are adept at scavenging for credentials. Targets are sent spear phishing e-mails that lead them to a web site displaying a lure document and are immediately prompted to install a malicious Google Chrome extension. Once gaining a foothold, the threat actors use off-the-shelf tools to ensure persistence, including Remote Desktop Protocol (RDP) to maintain access.

七天前

漏洞分析 | CVE-2018-9411: New critical vulnerability in multiple high-privileged Android services

本文将介绍cve-2018-9411这个漏洞的技术细节以及利用。

七天前

Android | Writing the worlds worst Android fuzzer, and then improving it

Today we’re going to write arguably one of the worst Android fuzzers possible. Experience unexpected success, and then make improvements to make it probably the second worst Android fuzzer.

七天前

iOS12中的Safari会缓存数组状态

A problem with Array's value state in the newly released iOS 12 Safari.

七天前

人工智能开源软件源代码安全缺陷分析报告

CNCERT发布了《开源软件代码安全缺陷分析报告——人工智能类开源软件专题》。本期报告聚焦国内外知名机器学习、人工智能类开源软件安全开发现状，通过分析多款知名人工智能类开源软件产品的安全缺陷，评估开源项目的代码安全控制情况。

七天前

行业报告 | Android进程保护研究分析报告

Google设计Android进程的设计是非常友好的，进程在不可见或者其他一些场景下APP要懂得主动释放，维护Android系统安全，然而低估恶意开发者“贪婪”，利用进程保护机制滋生很多流氓应用，破坏系统文件，资费受损，隐私泄露，推送恶意广告，导致设备资源浪费，破坏系统生态平衡。

七天前

OATmeal on the Universal Cereal Bus: Exploiting Android phones over USB

Recently, there has been some attention around the topic of physical attacks on smartphones, where an attacker with the ability to connect USB devices to a locked phone attempts to gain access to the data stored on the device. This blogpost describes how such an attack could have been performed against Android devices (tested with a Pixel 2).

七天前

科普 | 兼职诈骗新变种：借“壳”传播恶意程序，点击就扣费！

近期，根据360手机先赔用户的反馈，疑似发现兼职诈骗的新变种：借打字兼职App的“壳”，传播恶意扣费程序。

七天前

Compiler-based security mitigations in Android P

Android's switch to LLVM/Clang as the default platform compiler in Android 7.0 opened up more possibilities for improving our defense-in-depth security posture. In Android P, we're expanding our existing compiler mitigations, which instrument runtime operations to fail safely when undefined behavior occurs. This post describes the new build system support for Control Flow Integrity and Integer Overflow Sanitization.

七天前

McAfee’s Steve Povolny Leads Threat Research

Our guest today is Steve Povolny, head of advanced threat research at McAfee. We’ll learn how he came to lead his team of researchers at the well-known security company, his philosophy on leadership, and why investing in research makes sense for McAfee (and most companies). We’ll also cover how to strike a balance between maintaining a healthy competitive advantage in the marketplace, while contributing to the larger threat research community and helping to make the world a safer place. He shares his thoughts on threat intelligence, why he believes it’s grown in importance for most organizations, and we’ll get his advice on choosing what kinds of services you might need.

七天前

行业报告 | 威胁猎人 | 2018年上半年短视频行业黑灰产研究报告

黑灰产业的发展从最早期的纯刷人气，刷粉丝，刷赞模式转向纯粹的为刷量和解决刷量的存在业务模式。黑灰产的从业门槛逐渐降低，从最早期的专供上游工具，已经流向中下游。2018年上半年刷量任务的需求主要依靠最火的自建站点模式完成刷量任务。

七天前

漏洞分析 | MetInfo 任意文件读取漏洞的修复与绕过

404实验室内部的WAM(Web应用监控程序，文末有关于WAM的介绍)监控到 MetInfo 版本更新，并且自动diff了文件，从diff上来看，应该是修复了一个任意文件读取漏洞，但是没有修复完全，导致还可以被绕过，本文就是记录这个漏洞的修复与绕过的过程。

七天前

PoC | Safari RegExp Exec 类型混淆远程代码执行漏洞PoC

Apple Safari RegExp Exec Type Confusion Remote Code Execution Vulnerability PoC.

七天前

恶意软件 | 肚脑虫组织（APT-C-35）移动端攻击活动揭露

传统的APT攻击主要是针对PC端进行，而随着智能手机和移动网络在世界范围内的普及发展，越来越多黑客组织的攻击目标也迅速蔓延到移动端，甚至出现出和PC端结合的趋势。近几年被国内外安全厂商陆续披露的Fancy Bear、Lazarus、OperationManul、摩诃草、黄金鼠等多个攻击组织无疑印证了这点。近期，360烽火实验室发现肚脑虫组织（APT-C-35）最新的攻击已把移动端也加入到其攻击目标中。

七天前

热门APK应用仿冒数据

Janus仿冒检测

Janus监控各热门应用的仿冒数据并集合与其相关关联数据作为参考。

最新议题

高端安全人才职业发展规划及培养路径

议题简介：“互联网+”、“工业4.0”大潮下，各行各业都需要安全为其业务数字化保驾护航，安全人才紧缺成为日益凸显的问题。...

第六届全国网络与信息安全防护峰会（XDef 2017）

  孙颖

  2017-11-23

最新会议 全部 >

2017安全分析与情报大会

2017年11月29日，首届安全分析与情报大会将在北京皇冠假日酒店召开。本次会议将会是安全分析和威胁情报领域的一次盛会！...

  北京微步在线科技有限公司

  2017-11-29

如文章有误需要调整，请联系我们：media#appscan.io（“#”换成“@”）
© Copyright Appscan.io 2017-2018 All rights reserved. 沪ICP备15051915号-2 沪公网安备 31011202002938号