每日安全动态推送(01-12)

Tencent Security Xuanwu Lab Daily News

• [Network] LoRaWAN’s Protocol Stacks: The Forgotten Targets at Risk:
https://www.trendmicro.com/en_us/research/22/a/lorawans-protocol-stacks-the-forgotten-targets-at-risk.html

   ・ 趋势科技对 LoRaWAN 协议栈的安全研究报告 – Jett

• Millions of Routers Exposed to RCE by USB Kernel Bug:
https://threatpost.com/millions-routers-exposed-bug-usb-module-kcodes-netusb/177506/

   ・ KCodes NetUSB 内核模块被发现高危 RCE，影响多款路由器厂商产品 – Jett

• 用DTA照亮DNS威胁分析之路 (2):
https://blog.netlab.360.com/use_dta_to_illuminate_the_path_of_dns_threat_analysis_2/

   ・ 用DTA照亮DNS威胁分析之路 (2). – lanying37

• Finding unhandled errors using CodeQL:
https://blog.trailofbits.com/2022/01/11/finding-unhandled-errors-using-codeql/

   ・ 利用 CodeQL 工具挖掘未处理异常漏洞的变种 – Jett

• Microsoft Faces Wormable, Critical RCE Bug & 6 Zero-Days:
https://threatpost.com/microsoft-wormable-critical-rce-bug-zero-day/177564/

   ・ 微软发布 2022 年 1 月份漏洞补丁，其中修复了一个蠕虫级别的 HTTP 协议栈漏洞（CVE-2022-21907） – Jett

• [Tools] More Information:
https://github.com/optiv/Ivy

   ・ Ivy – Payload 生成框架，用于在内存中执行 VBA 代码 – Jett

• Checking your browser before accessing rhinosecuritylabs.com.:
https://rhinosecuritylabs.com/research/cve-2021-41577-evga-precision-x1/

   ・ GPU 超频工具 EVGA Precision X1 从 MITM 到 RCE – Jett

• New SysJoker Backdoor Targets Windows, Linux, and macOS:
https://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker/

   ・ Intezer 对跨平台后门组件 SysJoker 的分析 – Jett

• [Tools, Malware] APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit:
https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/

   ・ 伊朗 APT35 组织被发现利用 Log4j 漏洞传播其 PowerShell 攻击组件 – Jett

• “重狗”组织分析报告：面向企业邮箱的大规模钓鱼:
http://paper.seebug.org/1811/

   ・ 针对“重狗”组织分析报告：面向企业邮箱的大规模钓鱼. – lanying37

* 查看或搜索历史推送内容请访问：
https://sec.today

* 新浪微博账号：腾讯玄武实验室
https://weibo.com/xuanwulab

原文始发于微信公众号（腾讯玄武实验室）：每日安全动态推送(01-12)