Tencent Security Xuanwu Lab Daily News
• [macOS] GitHub – NyanSatan/Virtual-iBoot-Fun: Another Virtualization.framework demo project, with focus to iBoot (WIP):
https://github.com/NyanSatan/Virtual-iBoot-Fun
・ 有研究员基于 Virtualization.framework 实现虚拟化执行 iBoot
– Jett
• [Vulnerability] 2241 – project-zero – Project Zero – Monorail:
https://bugs.chromium.org/p/project-zero/issues/detail?id=2241
・ Issue 2241: runc/libcontainer: insecure handling of bind mount sources
– Jett
• 解析服务提供商对非授权域名解析情况的评估:
https://blog.netlab.360.com/analysis-of-popular-domain-names-by-non-authorized-resolvers/
・ 解析服务提供商对非授权域名解析情况的评估
– Jett
• Mirai-based Botnet – Moobot Targets Hikvision Vulnerability | FortiGuard Labs:
https://www.fortinet.com/blog/threat-research/mirai-based-botnet-moobot-targets-hikvision-vulnerability
・ Moobot Botnet 利用海康威视的漏洞攻击用户
– Jett
• [Fuzzing, Tools] What is RESTler?:
https://github.com/microsoft/restler-fuzzer
・ RESTler – 微软开源了一个 Stateful REST API Fuzzer
– Jett
• 20+ Ways To Bypass Your Macos Privacy Mechanisms:
https://www.slideshare.net/wojdwo/20-ways-to-bypass-your-macos-privacy-mechanisms-250791887
・ 20+ Ways To Bypass Your Macos Privacy Mechanisms
– Jett
• Get shells with JET, the Jolokia Exploitation Toolkit:
https://thinkloveshare.com/hacking/shells_with_jolokia_exploitation_toolkit/
・ Get shells with JET, the Jolokia Exploitation Toolkit.
– lanying37
• WebAssembly and Back Again: Fine-Grained Sandboxing in Firefox 95:
https://hacks.mozilla.org/2021/12/webassembly-and-back-again-fine-grained-sandboxing-in-firefox-95/
・ Firefox 95 将启用 RLBox Sandbox 技术,使用 WebAssembly 隔离危险代码
– Jett
• Android12 应用启动流程分析:
https://evilpan.com/2021/12/05/apk-startup/
・ Android 12 应用启动流程分析
– Jett
• IOS PAC 实现详解:
http://paper.seebug.org/1777/
・ iOS 函数指针保护机制 PAC 实现详解
– Jett
* 查看或搜索历史推送内容请访问:
https://sec.today
* 新浪微博账号:腾讯玄武实验室
https://weibo.com/xuanwulab
原文始发于微信公众号(腾讯玄武实验室):每日安全动态推送(12-07)